Changeset 46

Timestamp:

06/24/2008 02:52:38 PM (5 years ago)

Author:

deity

Message:

Fix for bug #35 and an unraised bug on nmap input

Location:

trunk

Files:

• config.txt (modified) (1 diff)
• docs/CHANGES.txt (modified) (2 diffs)
• plugins/nikto_core.plugin (modified) (3 diffs)

trunk/config.txt

@@ -55 +55 @@
 #STATIC-COOKIE=cookiename=cookievalue
 
+# The below allows you to vary which HTTP methods are used to check whether
+# an HTTP(s) server is running. Some web servers, such as the autopsy web
+# server do not implement the HEAD method
+CHECKMETHODS=HEAD GET

trunk/docs/CHANGES.txt

@@ +1 @@
+2008-06-24 plugins/nikto_core.plugin
+        - Fix for ticket #35 - allow multiple HTTP methods to identify
+          an HTTP server, these are set with the variable CHECKMETHODS in
+          config.txt
+        - Fix for a bug in the nmap reader where it would ignore the IP
+          address if it nmap didn't return a hostname.
 2008-06-22 plugins/db_tests
         - Fix for ticket #26 - stop domino tests producing false positives
@@ -5 +11 @@
 2008-04-22 plugins/nikto_outdated.plugin
         - Change to allow stop duplication of items when scanning more than one
-        host. Fix for bug 28
+          host. Fix for bug 28
 2008-04-16 plugins/nikto_core.plugin
         - Change to allow reading of a host list from stdin

trunk/plugins/nikto_core.plugin

@@ -858 +858 @@
             my @line=split(/ /);
             my @name=split(/\(|\)/, $line[2]);
+            if (!$name[1]) { $name[1]=$line[1]; }
             
             $TARGETS{$host_ctr}{ident}=$name[1];
@@ -1358 +1359 @@
  proxy_check() unless $PROXYCHECKED;
 
- # try http
- if (!$CLI{ssl})
+ my @checktypes=('HTTP', 'HTTPS');
+ if ($CLI{ssl})
  {
-  nprint("- Checking for HTTP on port $TARGETS{$CURRENT_HOST_ID}{ip}:$port","v");
-  $request{'whisker'}->{'ssl'}=0;
-  $request{'whisker'}->{'port'}= $port;
-  $request{'whisker'}->{'http_eol'}=$http_eol;
-  dump_var("Request Hash", \%request);
-  LW2::http_close(\%request);  # force-close any old connections
-  LW2::http_fixup_request(\%request);
-  if ($CLI{pause} > 0) { sleep $CLI{pause}; }
-  if (!LW2::http_do_request_timeout(\%request,\%result)) 
-    { 
-      # this will fix for some Apaches that are smart enough to answer non ssl reqs on an ssl server
-      if ($result{'whisker'}->{'data'} !~ /speaking plain HTTP to an SSL/) 
-      {
-       $TARGETS{$CURRENT_HOST_ID}{ports}{$port}{ssl}=0;
-       nprint("- Server found: $TARGETS{$CURRENT_HOST_ID}{ip}:$port \t$result{'server'}","d"); 
-       $request{'whisker'}->{'host'}=$oldhost; 
-       dump_var("Result Hash", \%result);
-       return; 
-      }
+  shift(@checktypes);
+ }
+
+ foreach my $method (split(/ /,$NIKTOCONFIG{CHECKMETHODS}))
+ {
+  $request{'whisker'}->{'method'}=$method;
+  foreach my $checkssl (@checktypes)
+  {
+   nprint("- Checking for $checkssl on port $TARGETS{$CURRENT_HOST_ID}{ip}:$port, using $method","v");
+   $request{'whisker'}->{'ssl'}=($checkssl=="HTTP")?0:1;
+   $request{'whisker'}->{'port'}= $port;
+   $request{'whisker'}->{'http_eol'}=$http_eol;
+   dump_var("Request Hash", \%request);
+   LW2::http_close(\%request);  # force-close any old connections
+   LW2::http_fixup_request(\%request);
+   if ($CLI{pause} > 0) { sleep $CLI{pause}; }
+   if (!LW2::http_do_request_timeout(\%request,\%result)) 
+   { 
+    # this will fix for some Apaches that are smart enough to answer non ssl reqs on an ssl server
+    if ($result{'whisker'}->{'data'} !~ /speaking plain HTTP to an SSL/) 
+    {
+     $TARGETS{$CURRENT_HOST_ID}{ports}{$port}{ssl}=0;
+     nprint("- $checkssl Server found: $TARGETS{$CURRENT_HOST_ID}{ip}:$port \t$result{'server'}","d"); 
+     $request{'whisker'}->{'host'}=$oldhost; 
+     dump_var("Result Hash", \%result);
+     return; 
     }
-  else { dump_var("Result Hash", \%result); }
-  }
-
- # try https
- nprint("- Checking for HTTPS on port $TARGETS{$CURRENT_HOST_ID}{ip}:$port","v");
- $request{'whisker'}->{'ssl'}=1;
- $request{'whisker'}->{'port'}= $port;
- $request{'whisker'}->{'http_eol'}=$http_eol;
- dump_var("Request Hash", \%request); 
- LW2::http_close(\%request);  # force-close any old connections
- LW2::http_fixup_request(\%request);
- if ($CLI{pause} > 0) { sleep $CLI{pause}; }
- if (LW2::http_do_request_timeout(\%request,\%result) eq 0) 
-    { $TARGETS{$CURRENT_HOST_ID}{ports}{$port}{ssl}=1;
-      dump_var("Result Hash", \%result);
-      $request{'whisker'}->{'host'}=$oldhost; 
-      nprint("- Server found: $TARGETS{$CURRENT_HOST_ID}{ip}:$port \t$result{'server'}","d"); 
-    }
- dump_var("Result Hash", \%result);
+   }
+   else
+   {
+    dump_var("Result Hash", \%result);
+   }
+  }
+ }
+
  if (! $TARGETS{$CURRENT_HOST_ID}{ports}{$port})
  {
@@ -1407 +1404 @@
  return;
 }
-###############################################################################
-# this ugly, and potentially dangerous if untrusted plugins are present
+
+###############################################################################
+# this is ugly, and potentially dangerous if untrusted plugins are present
 ###############################################################################
 sub run_plugins