Re: NSE: http.identify_404 follows redirects

[Johanna Curiel <johannapcuriel () gmail com>]

Hi Tom,

I did a couple of tests with the latest version from the SVN.

Setup a simpleHTTP python server with a redirect 302
C:\Documents\Python_Scripts>python redirect302.py
serving at port 8000
/
10.0.0.6 - - [05/Dec/2015 16:54:56] "GET / HTTP/1.1" 302 -

Tests:
(1)

Johannas-iMac:nmap johannacuriel$ *nmap -p8000 --script=http-headers
10.0.0.12 --datadir .*


Starting Nmap 6.49SVN ( https://nmap.org ) at 2015-12-05 17:02 AST

Nmap scan report for 10.0.0.12

Host is up (0.0085s latency).

PORT     STATE SERVICE

8000/tcp open  http-alt

| http-headers:

|   Server: SimpleHTTP/0.6 Python/2.7.10

|   Date: Sat, 05 Dec 2015 21:02:43 GMT

|   Content-type: text/html; charset=mbcs

|   Content-Length: 286

|

|_  (Request type: HEAD)


This request created an error in the server:

Exception happened during processing of request from ('10.0.0.6', 59206)

Traceback (most recent call last):

  File "C:\Python27\lib\SocketServer.py", line 295, in
_handle_request_noblock

    self.process_request(request, client_address)

  File "C:\Python27\lib\SocketServer.py", line 321, in process_request

    self.finish_request(request, client_address)

  File "C:\Python27\lib\SocketServer.py", line 334, in finish_request

    self.RequestHandlerClass(request, client_address, self)

  File "C:\Python27\lib\SocketServer.py", line 655, in __init__

    self.handle()

  File "C:\Python27\lib\BaseHTTPServer.py", line 340, in handle

    self.handle_one_request()

  File "C:\Python27\lib\BaseHTTPServer.py", line 310, in handle_one_request

    self.raw_requestline = self.rfile.readline(65537)

  File "C:\Python27\lib\socket.py", line 480, in readline

    data = self._sock.recv(self._rbufsize)

error: [Errno 10054] An existing connection was forcibly closed by the
remote host


Nmap done: 1 IP address (1 host up) scanned in 12.76 seconds


(2)

Johannas-iMac:nmap johannacuriel$ *nmap -p80 --script http-errors.nse
10.0.0.12 --datadir .*


Starting Nmap 6.49SVN ( https://nmap.org ) at 2015-12-05 16:59 AST

Nmap scan report for 10.0.0.12

Host is up (0.0033s latency).

PORT   STATE SERVICE

80/tcp open  http

| http-errors:

| Spidering limited to: maxpagecount=40; withinhost=10.0.0.12

|   Found the following error pages:

|

|   Error Code: 404

|_   http://10.0.0.12:80/




When doing the same test using

root@kali:~# nmap -p8000 --script=http-headers 10.0.0.12


Starting Nmap 6.47 ( http://nmap.org ) at 2015-12-05 15:15 EST

Nmap scan report for 10.0.0.12

Host is up (0.0015s latency).

PORT     STATE SERVICE

8000/tcp open  http-alt

| http-headers:

|   Server: SimpleHTTP/0.6 Python/2.7.10

|   Date: Sat, 05 Dec 2015 20:15:57 GMT

|   Content-type: text/html; charset=mbcs

|   Content-Length: 286

|

|_  (Request type: HEAD)

The server response without issues:
10.0.0.12 - - [05/Dec/2015 16:15:31] "HEAD / HTTP/1.1" 200 -
10.0.0.12 - - [05/Dec/2015 16:15:57] "HEAD / HTTP/1.1" 200 -

Follow-up:
Which nse scripts should be tested?(all http-xxx?)
What is the expected behaviour result in case of redirects (302)?


Regards

On Sat, Dec 5, 2015 at 10:05 AM, Tom Sellers <nmap () fadedcode net> wrote:

> Hi Johanna,
>
>   The changes have been committed.  There were a few scripts listed in my
> original email that were not changed either due to
> their login or, in one case, due to the script no longer existing.  Git PR
> 251 shows the changes made can be found here:
>
> https://github.com/nmap/nmap/pull/251
>
> If you update from SVN you will have the updated code in addition to a few
> other semi related NSE script changes that fix
> a few false positives.
>
>
>
> Tom
>
>
>
> On 12/4/2015 10:17 AM, Johanna Curiel wrote:
> > Hi Tom
> >
> > If you commit this change if no one objects, I would like to test it and
> feedback my results to you
> > Also you can make available the scripts you changed  and I can feedback
> my results
> > regards
> >
> > Johanna
> >
> > On Thu, Dec 3, 2015 at 8:56 AM, Tom Sellers <nmap () fadedcode net <mailto:
> nmap () fadedcode net>> wrote:
> >     The change did not appear to be disruptive in my tests. Unless
> someone objects I will commit the update to http.lua and as well as updates
> to the related scripts to standardize the call to
> >     identify_404.
> >
> >     Tom
> >
> >
> >     On 11/30/2015 7:46 PM, Tom Sellers wrote:
> >     > All,
> >     >
> >     >   I was going to open a git issue on this, but I decided to toss
> it at the list for discussion.
> >     >
> >     > References:
> >     >   https://nmap.org/nsedoc/lib/http.html#identify_404
> >     >   https://svn.nmap.org/nmap/nselib/http.lua
> >     >
> >     > http.identify_404 is a function that can be used to determine how
> an HTTP server responds to unknown pages. It can be used, for example, to
> detect when an HTTP server responds 200 OK to everything
> >     > which can break a script if it is merely checking the status code
> when requesting something like  /MyAppsSpecialPage.
>
>
> <snip>
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/