Changeset 75

Timestamp:

09/16/2008 08:52:10 AM (5 years ago)

Author:

deity

Message:

Fix for ticket #37

Location:

trunk

Files:

• docs/CHANGES.txt (modified) (1 diff)
• nikto.pl (modified) (1 diff)
• plugins/nikto_core.plugin (modified) (3 diffs)
• plugins/nikto_httpoptions.plugin (modified) (1 diff)

trunk/docs/CHANGES.txt

@@ +1 @@
+2008-09-16 plugins/nikto_core.plugin plugins/nikto_httpoptions.plugin
+        - Fix for ticket #37
+        - Allow fetch to optionally call LW2::http_fixup_request
+        - Better handling of extra headers within fetch
 2008-09-14 plugins/db_server_msgs plugins/nikto_*.plugin
         - Update server messages to dynamic database format

trunk/nikto.pl

@@ -163 +163 @@
 }
 
-nprint("+ %COUNTERS{host_total} host(s) tested");
+nprint("+ $COUNTERS{hosts_total} host(s) tested");
 send_updates();
 close_output();

trunk/plugins/nikto_core.plugin

@@ -1878 +1878 @@
  delete $request{'Content-Encoding'};
  delete $request{'Content-Length'};
+ my $header_hash=$_[3];
 
  if ($_[2] ne "")
@@ -1889 +1890 @@
  if (defined $_[3])
  {
-    # define temporary hash due to more perl stupidity
-    my $header_hash=$_[3];
     # loop through the hash ref passed and add each header to request
     while (my($key, $value) = each(%$header_hash))
     {
-       $request{'whisker'}->{$key}=$value;
+       $request{$key}=$value;
     }
  } 
  $NIKTO{totalrequests}++;
- LW2::http_fixup_request(\%request);
+ unless ($_[4]) { LW2::http_fixup_request(\%request); }
  LW2::http_do_request_timeout(\%request,\%result);
  dump_var("Request Hash", \%request);
@@ -1911 +1910 @@
   }
 
+ # Clean up extra headers
+ if (defined $_[3])
+ {
+    while (my($key, $value) = each(%$header_hash))
+    {
+       delete $request{$key};
+    }
+ }
  return $result{'whisker'}->{'code'}, $result{'whisker'}->{'data'};
 }

trunk/plugins/nikto_httpoptions.plugin

@@ -62 +62 @@
       foreach my $m (split /,? /, $public_methods) { eval_methods($m, "Public", $dbarray); }
    }
+
+   # Check for other weirdness
+   # IIS PROPFIND HEADER
+   my %headers=(
+      "Host" => "",
+      "Content-Length" => "0",
+   );
+   ($RES, $CONTENT) = fetch("/","PROPFIND","",\%headers,1);
+   if ($RES == 207)
+   {
+      if ($CONTENT =~ "<a:href>http://")
+      {
+         my $ipfound=$CONTENT;
+         $ipfound =~ s/^.*<a:href>//g;
+         $ipfound =~ s/<\/a:href>.*$//g;
+         add_vulnerability($CURRENT_HOST_ID,"PROPFIND may show the server's internal IP address: $ipfound",999973,13431);
+      }
+   } 
  
    # Now release memory for the dbarray