[NSE] WebDAV / DeltaV finding script

[Kris Katterjohn <katterjohn () gmail com>]

Hey everyone!

I've attached a script that tries to determine if an HTTP server 
supports the WebDAV and DeltaV authoring / versioning extensions.

It uses Sven's HTTP library to send an OPTIONS message to the server and 
then counts the amount of WebDAV and/or DeltaV methods the server 
advertises.

If 40-70% of the methods are advertised, the extension "might" be 
supported.  If 70+% are advertised, the extension "appears" to be 
supported.  70% allows for 5/7 WebDAV methods and 8/11 DeltaV methods. 
The upper number is the amount of *standard* methods that are checked 
for.  I check for 9 total WebDAV methods, so it's possible for a server 
to have 9/7 (I've seen 8/7 from one).

Please let me know what you think (the methods checked for, the 
percentages, the overall usefulness, etc.)

Thanks,
Kris Katterjohn

-- Checks if an HTTP server support the WebDAV and DeltaV authoring and
-- versioning extensions.

-- This script works by requesting the methods the HTTP server supports and
-- tallying the results.  The output depends on the number of the extension's
-- methods the server advertises.

-- 02/08/2008

id = "HTTP Extensions"

description = "Checks for HTTP extensions like WebDAV and DeltaV"

author = "Kris Katterjohn <katterjohn () gmail com>"

license = "Look at Nmap's COPYING"

categories = {"discovery"}

require "http"
require "shortport"
require "stdnse"

-- Amount of *standard* WebDAV methods checked for;
-- Nonstandard methods are like extra-credit
local webdavtotal = 7

-- Is this a WebDAV method?
local iswebdav = function(method)
        method = method:upper()

        if method == "LOCK" then
                return true
        elseif method == "UNLOCK" then
                return true
        elseif method == "PROPFIND" then
                return true
        elseif method == "PROPPATCH" then
                return true
        elseif method == "COPY" then
                return true
        elseif method == "MOVE" then
                return true
        elseif method == "MKCOL" then
                return true
        -- non-standard
        elseif method == "SEARCH" then
                return true
        elseif method == "ACL" then
                return true
        end

        return false
end

-- Amount of DeltaV methods checked for
local deltavtotal = 11

-- Is this a DeltaV method?
local isdeltav = function(method)
        method = method:upper()

        if method == "CHECKIN" then
                return true
        elseif method == "CHECKOUT" then
                return true
        elseif method == "UNCHECKOUT" then
                return true
        elseif method == "VERSION-CONTROL" then
                return true
        elseif method == "REPORT" then
                return true
        elseif method == "UPDATE" then
                return true
        elseif method == "LABEL" then
                return true
        elseif method == "MERGE" then
                return true
        elseif method == "MKWORKSPACE" then
                return true
        elseif method == "BASELINE-CONTROL" then
                return true
        elseif method == "MKACTIVITY" then
                return true
        end

        return false
end

local check = function(response)
        if not response.header['allow'] then
                return nil
        end

        local list = stdnse.strsplit(",%s*", response.header['allow'])

        if (not list) or (#list == 0) then
                return nil
        end

        local wd = 0           -- Amount of WebDAV methods counted
        local dv = 0           -- Amount of DeltaV methods counted
        local okayperc  = 0.7  -- See if 70+% of methods are supported
        local maybeperc = 0.4  -- See if 40%-70% of methods are supported

        local i

        for _, i in pairs(list) do
                if iswebdav(i) then
                        wd = wd + 1
                elseif isdeltav(i) then
                        dv = dv + 1
                end
        end

        local output = " \n"

        if (wd / webdavtotal) >= okayperc then
                output = output .. "WebDAV appears to be supported\n"
        elseif (wd / webdavtotal) >= maybeperc then
                output = output .. "WebDAV might be supported\n"
        end

        if (dv / deltavtotal) >= okayperc then
                output = output .. "DeltaV appears to be supported\n"
        elseif (dv / deltavtotal) >= maybeperc then
                output = output .. "DeltaV might be supported\n"
        end

        if output:len() > 2 then
                return output
        end

        return nil
end

portrule = shortport.port_or_service({80, 443, 8080}, {"http", "https"})

action = function(host, port)
        local cmd, response

        -- 'OPTIONS *' may seem like a good idea (it did to me), but it blows
        cmd = "OPTIONS / HTTP/1.0\r\nConnection: close\r\n\r\n"

        response = http.request(host, port, cmd, {timeout=5000})

        if (not response.status) or (response.status ~= 200) then
                return nil
        end

        return check(response)
end


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org