drgreen/coolbins
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity
coolbins/system/usr/share/nmap/scripts/http-grep.nse

327 lines
11 KiB
Lua
Raw Blame History

local string = require "string"
local httpspider = require "httpspider"
local shortport = require "shortport"
local stdnse = require "stdnse"
local table = require "table"
local tableaux = require "tableaux"
description = [[
Spiders a website and attempts to match all pages and urls against a given
string. Matches are counted and grouped per url under which they were
discovered.
Features built in patterns like email, ip, ssn, discover, amex and more.
The script searches for email and ip by default.
]]
---
-- @usage
-- nmap -p 80 www.example.com --script http-grep --script-args='match="[A-Za-z0-9%.%%%+%-]+@[A-Za-z0-9%.%%%+%-]+%.%w%w%w?%w?",breakonmatch'
-- nmap -p 80 www.example.com --script http-grep --script-args 'http-grep.builtins ={"mastercard", "discover"}, http-grep.url="example.html"'
-- @output
-- | http-grep:
-- | (1) https://nmap.org/book/man-bugs.html:
-- | (1) email:
-- | + dev@nmap.org
-- | (1) https://nmap.org/book/install.html:
-- | (1) email:
-- | + fyodor@nmap.org
-- | (16) https://nmap.org/changelog.html:
-- | (7) ip:
-- | + 255.255.255.255
-- | + 10.99.24.140
-- | + 74.125.53.103
-- | + 64.147.188.3
-- | + 203.65.42.255
-- | + 192.31.33.7
-- | + 168.0.40.135
-- | (9) email:
-- | + d1n@inbox.com
-- | + fyodor@insecure.org
-- | + uce@ftc.gov
-- | + rhundt@fcc.gov
-- | + jquello@fcc.gov
-- | + sness@fcc.gov
-- | + president@whitehouse.gov
-- | + haesslich@loyalty.org
-- | + rchong@fcc.gov
-- | (6) https://nmap.org/5/#5changes:
-- | (6) ip:
-- | + 207.68.200.30
-- | + 64.13.134.52
-- | + 4.68.105.6
-- | + 209.245.176.2
-- | + 69.63.179.23
-- |_ + 69.63.180.12
--
--
-- @args http-grep.match the string to match in urls and page contents or list of patterns separated by delimiter
-- @args http-grep.maxdepth the maximum amount of directories beneath
-- the initial url to spider. A negative value disables the limit.
-- (default: 3)
-- @args http-grep.maxpagecount the maximum amount of pages to visit.
-- A negative value disables the limit (default: 20)
-- @args http-grep.url the url to start spidering. This is a URL
-- relative to the scanned host eg. /default.html (default: /)
-- @args http-grep.withinhost only spider URLs within the same host.
-- (default: true)
-- @args http-grep.withindomain only spider URLs within the same
-- domain. This widens the scope from <code>withinhost</code> and can
-- not be used in combination. (default: false)
-- @args http-grep.breakonmatch Returns output if there is a match for a single pattern type.
-- @args http-grep.builtins supply a single or a list of built in types. supports email, phone, mastercard, discover,
-- visa, amex, ssn and ip addresses. If you just put in script-args http-grep.builtins then all will be enabled.
--
-- @xmloutput
-- <table key="(1) https://nmap.org/book/man-bugs.html">
-- <table key="(1) email">
-- <elem>+ dev@nmap.org</elem>
-- </table>
-- </table>
-- <table key="(1) https://nmap.org/book/install.html">
-- <table key="(1) email">
-- <elem>+ fyodor@nmap.org</elem>
-- </table>
-- </table>
-- <table key="(16) https://nmap.org/changelog.html">
-- <table key="(7) ip">
-- <elem>+ 255.255.255.255</elem>
-- <elem>+ 10.99.24.140</elem>
-- <elem>+ 74.125.53.103</elem>
-- <elem>+ 64.147.188.3</elem>
-- <elem>+ 203.65.42.255</elem>
-- <elem>+ 192.31.33.7</elem>
-- <elem>+ 168.0.40.135</elem>
-- </table>
-- <table key="(9) email">
-- <elem>+ d1n@inbox.com</elem>
-- <elem>+ fyodor@insecure.org</elem>
-- <elem>+ uce@ftc.gov</elem>
-- <elem>+ rhundt@fcc.gov</elem>
-- <elem>+ jquello@fcc.gov</elem>
-- <elem>+ sness@fcc.gov</elem>
-- <elem>+ president@whitehouse.gov</elem>
-- <elem>+ haesslich@loyalty.org</elem>
-- <elem>+ rchong@fcc.gov</elem>
-- </table>
-- </table>
-- <table key="(6) https://nmap.org/5/#5changes">
-- <table key="(6) ip">
-- <elem>+ 207.68.200.30</elem>
-- <elem>+ 64.13.134.52</elem>
-- <elem>+ 4.68.105.6</elem>
-- <elem>+ 209.245.176.2</elem>
-- <elem>+ 69.63.179.23</elem>
-- <elem>+ 69.63.180.12</elem>
-- </table>
-- </table>
author = {"Patrik Karlsson", "Gyanendra Mishra"}
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}
portrule = shortport.http
-- Shortens a matching string if it exceeds 60 characters
-- All characters after 60 will be replaced with ...
local function shortenMatch(match)
if ( #match > 60 ) then
return match:sub(1, 60) .. " ..."
else
return match
end
end
-- A function to validate IP addresses.
local function ip(matched_ip)
local oct_1, oct_2, oct_3, oct_4 = matched_ip:match('(%d%d?%d?)%.(%d%d?%d?)%.(%d%d?%d)%.(%d%d?%d?)')
oct_1, oct_2, oct_3, oct_4 = tonumber(oct_1), tonumber(oct_2), tonumber(oct_3), tonumber(oct_4)
if oct_1 > 255 or oct_2 > 255 or oct_3 > 255 or oct_4 > 255 then
return false
end
return true
end
-- A function to validate credit card numbers.
local function luhn(matched_ccno)
local ccno = matched_ccno:gsub("%D", ""):reverse()
local sum = 0
for i = 1, #ccno do
local d = tonumber(ccno:sub(i,i))
if i % 2 == 0 then
local dd = 2 * d
d = dd // 10 + dd % 10
end
sum = sum + d
end
return sum % 10 == 0
end
-- A function to validate ssn numbers.
local bad_ssn = {
-- https://www.ssa.gov/history/ssn/misused.html
["078-05-1120"] = true,
["219-09-9999"] = true,
-- Obvious fakes
["123-12-1234"] = true,
["123-45-6789"] = true,
["321-21-4321"] = true,
["111-11-1111"] = true,
["222-22-2222"] = true,
["333-33-3333"] = true,
["444-44-4444"] = true,
["555-55-5555"] = true,
["666-66-6666"] = true,
["777-77-7777"] = true,
["888-88-8888"] = true,
["999-99-9999"] = true,
}
local bad_group_1 = {
["000"] = true,
["333"] = true,
["666"] = true,
}
local function ssn(matched_ssn)
if bad_ssn[matched_ssn] then return false end
local group_1, group_2, group_3 = matched_ssn:match('(%d%d%d)%-(%d%d)%-(%d%d%d%d)')
if bad_group_1[group_1] then return false end
if group_2 == "00" or group_3 == "0000" then return false end
group_1 = tonumber(group_1)
-- This line rules out ITINs, which may also be of interest.
if 900 <= group_1 and group_1 <= 999 then return false end
return true
end
-- The default function if there is no validator.
local function default()
return true
end
action = function(host, port)
-- a list of popular patterns with their validators.
local BUILT_IN_PATTERNS = {
['email'] = {'[A-Za-z0-9%.%%%+%-]+@[A-Za-z0-9%.%%%+%-]+%.%w%w%w?%w?'},
['phone'] = {'%f[%d]%d%d%d%-%d%d%d%d%f[^%d]','%f[%d%(]%(%d%d%d%)%s%d%d%d%-%d%d%d%f[^%d]','%f[%d%+]%+%-%d%d%d%-%d%d%d%-%d%d%d%d%f[^%d]','%d%d%d%-%d%d%d%-%d%d%d%d%f[^%d]'},
['mastercard']= {'%f[%d]5%d%d%d%s?%-?%d%d%d%d%s?%-?%d%d%d%d%s?%-?%d%d%d%d%f[^%d]', ['validate'] = luhn},
['visa'] = {'%f[%d]4%d%d%d%s?%-?%d%d%d%d%s?%-?%d%d%d%d%s?%-?%d%d%d%d%f[^%d]', ['validate'] = luhn},
['discover']={'%f[%d]6011%s?%-?%d%d%d%d%s?%-?%d%d%d%d%s?%-?%d%d%d%d%f[^%d]', ['validate'] = luhn},
['amex'] ={'%f[%d]3%d%d%d%s?%-?%d%d%d%d%d%d%s?%-?%d%d%d%d%d%f[^%d]', ['validate'] = luhn},
['ssn'] = {'%f[%d]%d%d%d%-%d%d%-%d%d%d%d%f[^%d]', ['validate'] = ssn},
['ip']={'%f[%d]%d%d?%d?%.%d%d?%d?%.%d%d?%d%.%d%d?%d?%f[^%d]', ['validate'] = ip},
}
-- read script specific arguments
local match = stdnse.get_script_args(SCRIPT_NAME .. ".match")
local break_on_match = stdnse.get_script_args(SCRIPT_NAME .. ".breakonmatch")
local builtins = stdnse.get_script_args(SCRIPT_NAME .. ".builtins")
local to_be_searched = {}
local crawler = httpspider.Crawler:new(host, port, nil, { scriptname = SCRIPT_NAME } )
local results = stdnse.output_table()
local all_match = {} -- a table that stores all matches. used to eliminate duplicates.
-- check if builtin argument is a table or a single value
if builtins and builtins == 1 then
for name, patterns in pairs(BUILT_IN_PATTERNS) do
to_be_searched[name] = {}
for _, pattern in ipairs(patterns) do
table.insert(to_be_searched[name], pattern)
end
end
elseif builtins and type(builtins) ~= 'table' then
if BUILT_IN_PATTERNS[builtins] ~= nil then
to_be_searched[builtins] = {}
for _, pattern in ipairs(BUILT_IN_PATTERNS[builtins]) do
table.insert(to_be_searched[builtins], pattern)
end
end
elseif builtins and type(builtins) == 'table' then
for _, builtin in ipairs(builtins) do
if BUILT_IN_PATTERNS[builtin] ~= nil then
to_be_searched[builtin] = {}
for _, pattern in ipairs(BUILT_IN_PATTERNS[builtin]) do
table.insert(to_be_searched[builtin], pattern)
end
end
end
end
-- check if match argument is a table or a single value
if match and type(match) ~= 'table' then
to_be_searched['User Pattern 1'] = {}
table.insert(to_be_searched['User Pattern 1'], match)
elseif type(match) == 'table' then
for i, pattern in pairs(match) do
local k = 'User Pattern ' .. tostring(i)
to_be_searched[k] = {}
table.insert(to_be_searched[k], pattern)
end
end
-- if nothing is specified then email and ip are checked.
if not next(to_be_searched) then
to_be_searched['email'] = {}
to_be_searched['ip'] = {}
table.insert(to_be_searched['email'], BUILT_IN_PATTERNS["email"][1])
table.insert(to_be_searched['ip'], BUILT_IN_PATTERNS["ip"][1])
end
-- set timeout to 10 seconds
crawler:set_timeout(10000)
while(true) do
local status, r = crawler:crawl()
-- if the crawler fails it can be due to a number of different reasons
-- most of them are "legitimate" and should not be reason to abort
if ( not(status) ) then
if ( r.err ) then
return stdnse.format_output(false, r.reason)
else
break
end
end
local count = 0 -- pattern matches per url
local pattern_count = 0 -- number of matches for particual pattern type say 'email'
local matches = {} -- a table that stores matches for all pattern types
local pattern_type = {} -- a table that resets for every pattern type
for pattern_name, pattern_table in pairs(to_be_searched) do
pattern_type = {}
pattern_count = 0
for _, pattern in ipairs(pattern_table) do
local body = r.response.body
-- try to match the url and body
if body and ( body:match( pattern ) or tostring(r.url):match(pattern) ) then
pattern_count = select(2, body:gsub(pattern, ""))
count = count + pattern_count
for match in body:gmatch(pattern) do
local validate = BUILT_IN_PATTERNS[pattern_name]and BUILT_IN_PATTERNS[pattern_name]['validate'] or default
if validate(match) and not tableaux.contains(all_match, match) then
table.insert(pattern_type, "+ " .. shortenMatch(match))
table.insert(all_match, match)
else
count = count - 1
pattern_count = pattern_count - 1
end
end
end
end
if pattern_count > 0 then
matches[("(%d) %s"):format(pattern_count, pattern_name)] = pattern_type
end
end
if count > 0 then
results[("(%d) %s"):format(count,tostring(r.url))] = matches
end
-- should we continue to search for matches?
if break_on_match and pattern_count > 0 then
crawler:stop()
break
end
end
if #results > 0 then return results end
end
Reference in New Issue View Git Blame Copy Permalink