Index: sql-injection.nse
===================================================================
--- sql-injection.nse	(revision 14378)
+++ sql-injection.nse	(working copy)
@@ -9,10 +9,30 @@
 complicated is better suited to a standalone tool. Both meta-style and HTTP redirects
 are supported.
 
-We may not have access to the target web server's true hostname, which can prevent access to
-virtually hosted sites.  This script only follows absolute links when the host name component is the same as the target server's reverse-DNS name.
+It is possible to use a different start point using an argument.
+
+This script only follows absolute links when the host name component is the same as the target server's reverse-DNS name.
 ]]
 
+--- 
+-- @args sql-injection.host The server's hostname. Using this argument allows testing virtually hosted sites.
+-- @args sql-injection.start The starting page for the script
+-- @output
+-- PORT   STATE SERVICE
+-- 80/tcp open  http
+-- |  sql-injection: Host might be vulnerable
+-- |  /page.php?arg=x'%20OR%20sqlspider
+-- |  /page2.php?arg=y'%20OR%20sqlspider
+-- |_ http://www.foo.com/page.php?arg=z'%20OR%20sqlspider
+-- @usage
+-- nmap --script sql-injection.nse \
+--      --script-args sql-injection.start=<start>
+
+author = "Eddie Bell <ejlbell () gmail com>"
+license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
+categories = {"intrusive", "vuln"}
+runlevel = 1.0
+
 require('url')
 require('shortport')
 require('stdnse')
@@ -20,11 +40,6 @@
 require('listop')
 require('comm')
 
-author = "Eddie Bell <ejlbell () gmail com>"
-license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
-categories = {"intrusive", "vuln"}
-runlevel = 1.0
-
 -- Change this to increase depth of crawl
 local maxdepth = 10
 local get_page_from_host
@@ -35,6 +50,15 @@
 
 portrule = shortport.port_or_service({80, 443}, {"http","https"})
 
+-- Returns the target's hostname.
+local function get_hostname(host)
+  if type(host) == "table" then
+    return host.targetname or ( host.name ~= '' and host.name ) or host.ip
+  else
+    return host
+  end
+end
+
 --[[
 Download a page from host:port http server. The url is passed 
 straight to the get request, so shouldn't include the domain name
@@ -46,11 +70,6 @@
 	local response = ""
 	local opts = {timeout=10000, recv_before=false}
 
-	-- connect to webserver 
-	--soc = nmap.new_socket()
-	--soc:set_timeout(4000)
-	--try(soc:connect(host.ip, port.number))
-
 	httpurl = string.gsub(httpurl, "&amp;", "&")
 	--print(filename .. ": " .. httpurl) 
 
@@ -60,10 +79,9 @@
 	query = query .. "Accept: */*"
 	query = query .. "Accept-Language: en"
 	query = query .. "User-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; http://nmap.org/book/nse.html)"
-	query = query .. "Host: " .. host.ip .. ":" .. port.number 
-	--try(soc:send(strbuf.dump(query, '\r\n') .. '\r\n\r\n'))
+        query = query .. "Host: " .. get_hostname(host)  
 
-	soc, response, bopt = comm.tryssl(host, port, strbuf.dump(query, '\r\n') .. '\r\n\r\n' , opts)
+	local soc, response, bopt = comm.tryssl(host, port, strbuf.dump(query, '\r\n') .. '\r\n\r\n' , opts)
 	while true do
 		status, lines = soc:receive_lines(1)
 		if not status then break end
@@ -219,7 +237,11 @@
 	get_page_from_host = get_page_curried(host, port)
 
 	-- start at the root
-	table.insert(urllist, "/")
+	if nmap.registry.args['sql-injection.start'] then
+		table.insert(urllist, "/" .. nmap.registry.args['sql-injection.start'])
+	else
+		table.insert(urllist, "/")
+	end
 
 	while not(urllist[i] == nil) and i <= maxdepth do
 		page = get_page_from_host(urllist[i])