Skip to content

Commit 7a8e228

Browse files
peter-hackertargetpeter-hackertarget
committed
Upload files
0 parents  commit 7a8e228

7 files changed

+3590
-0
lines changed

‎LICENSE

+340
Large diffs are not rendered by default.

‎README.md

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# nmap-nse-scripts
2+
Nmap NSE scripts that I have created or customised. At this stage these are custom scripts that you will have to copy into your Nmap Scripts directory manually to use them.
3+
4+
##Installation of Custom Nmap Scripts
5+
6+
Depending on your installation method and distribution the exact location of the Nmap script files could be slightly different. If you have installed from source then copying these into the `/usr/local/share/nmap/scripts/` folder will do the trick.
7+
8+
Note for the **http-wordpress-themes.nse** script you will also need to copy the **wp-themes.lst** into the `/usr/local/share/nmap/nselib/data/` folder for the script to access the theme list.
9+
10+
If you have a Windows installation of Nmap or are using a package, then the location of the files could be slightly different (it should not be too hard to find).
11+
12+
##http-wordpress-info.nse
13+
14+
This script is non-intrusive and simply examines the source HTML of a WordPress page to find plugins, theme and the version of WordPress from the Meta Generator Tag, if the Meta Generator is not present it will attempt to download the **/readme.html** file that also contains the WordPress version.
15+
16+
##http-wordpress-plugins.nse
17+
18+
A modified version of the original `http-wordpress-plugins.nse` script that will also attempt to identify the version of the plugins that have been detected following the brute force of the plugin paths.
19+
20+
##http-wordpress-themes.nse
21+
22+
Another modified version of the `http-wordpress-plugins.nse` script this script will identify themes installed in the **/wp-content/themes/** folder and also attempt to identify the version of the themes from the **style.css** file. The **wp-theme.lst** was created by crawling the Top 1 million WordPress sites and ranking the themes by popularity.
23+
24+
Themes that are installed but not in use by a WordPress installation can still contain vulnerabilities that could lead to the compromise of the WordPress installation and server.
25+
26+
##hostmap-hackertarget.nse
27+
28+
Similar to the hostmap-robtex.nse this script will attempt to identify hosts sharing the IP address that is being scanned. The hosts are found using the [Reverse IP Lookup API](https://hackertarget.com/reverse-ip-lookup/ "Reverse IP Lookup") that utilises DNS records from the [Scans.IO](https://scans.io) project.

‎hostmap-hackertarget.nse

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
local http = require "http"
2+
local ipOps = require "ipOps"
3+
local stdnse = require "stdnse"
4+
local string = require "string"
5+
local table = require "table"
6+
7+
description = [[
8+
Discovers hostnames (DNS A records) that resolve to the target's IP address by querying the online reverse IP lookup at http://hackertarget.com/reverse-ip-lookup/.
9+
10+
Script based on hostmap-robtex.nse by Arturo 'Buanzo' Busleiman.
11+
12+
Nmap 6.47 may error with:
13+
/usr/local/bin/../share/nmap/nselib/shortport.lua:200: attempt to index field 'version' (a nil value)
14+
Fix issue by getting latest shortport.lua from the Nmap svn.
15+
16+
]]
17+
18+
---
19+
-- @usage
20+
-- nmap --script hostmap-hackertarget -p 80 -Pn nmap.org
21+
--
22+
-- @output
23+
-- | hostmap-hackertarget:
24+
-- | hosts:
25+
-- | cgi.insecure.org
26+
-- | download.insecure.org
27+
-- | images.insecure.org
28+
-- | insecure.com
29+
-- | insecure.org
30+
-- | nmap.com
31+
-- | nmap.net
32+
-- | nmap.org
33+
-- | seclists.org
34+
-- | sectools.org
35+
-- | svn.nmap.org
36+
-- | www.insecure.org
37+
-- | www.nmap.org
38+
-- |_ www.sectools.org
39+
40+
--
41+
-- @xmloutput
42+
-- <table key="hosts">
43+
-- <elem>nmap.org</elem>
44+
-- </table>
45+
---
46+
47+
author = "Peter Hill"
48+
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
49+
categories = {
50+
"discovery",
51+
"safe",
52+
"external"
53+
}
54+
55+
56+
-- Scrape domains sharing target host ip from hackertarget.com website
57+
-- @param data string containing the retrieved web page
58+
-- @return table containing the host names sharing host.ip
59+
function parse_hackertarget_response (data)
60+
local result = {}
61+
62+
for domain in string.gmatch(data, "([0-9a-z-.]+)") do
63+
if not stdnse.contains(result, domain) then
64+
table.insert(result, domain)
65+
end
66+
end
67+
return result
68+
end
69+
70+
hostrule = function (host)
71+
return not ipOps.isPrivate(host.ip)
72+
end
73+
74+
action = function (host)
75+
local link = "http://api.hackertarget.com/reverseiplookup/?q=" .. host.ip
76+
local htmldata = http.get_url(link)
77+
local domains = parse_hackertarget_response(htmldata.body)
78+
local output_tab = stdnse.output_table()
79+
if (#domains > 0) then
80+
output_tab.hosts = domains
81+
end
82+
return output_tab
83+
end

‎http-wordpress-info.nse

+123
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
local http = require "http"
2+
local shortport = require "shortport"
3+
local stdnse = require "stdnse"
4+
local string = require "string"
5+
6+
description = [[
7+
Finds the WordPress version, theme and plugins observed in the page response.
8+
- Version detection tests for a meta generator html tag, if this is not found an attempt
9+
is made to access /readme.html a default file in all versions of WordPress.
10+
- Theme is determined by searching HTML resposne for /wp-content/themes/$themename
11+
- Discovered plugins are those that match /wp-content/plugins/$pluginname in the HTML
12+
response. This will not find all plugins, to find all plugins you will need the
13+
http-wordpress-plugins nse script to brute force the plugin paths.
14+
15+
Script based on code from Michael Kohl's http-generator.nse
16+
]]
17+
18+
author = "Peter Hill <[email protected]>"
19+
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
20+
categories = {"default", "discovery", "safe"}
21+
22+
---
23+
-- @usage
24+
-- nmap --script http-wordpress-info [--script-args http-wordpress-info.path=<path>,http-wordpress-info.redirects=<number>,...] <host>
25+
--
26+
-- @output
27+
-- PORT STATE SERVICE
28+
-- 80/tcp open http
29+
-- | http-wordpress-info:
30+
-- | version: WordPress 4.0
31+
-- | theme: canvas
32+
-- | plugins:
33+
-- | w3-total-cache
34+
-- |_ simple-tooltips
35+
36+
-- @args http-wordpress-info.path Specify the path you want to check for a generator meta tag (default to '/').
37+
-- @args http-wordpress-info.redirects Specify the maximum number of redirects to follow (defaults to 3).
38+
39+
40+
-- helper function
41+
local follow_redirects = function(host, port, path, n)
42+
local pattern = "^[hH][tT][tT][pP]/1.[01] 30[12]"
43+
local response = http.get(host, port, path)
44+
45+
while (response['status-line'] or ""):match(pattern) and n > 0 do
46+
n = n - 1
47+
local loc = response.header['location']
48+
response = http.get_url(loc)
49+
end
50+
51+
return response
52+
end
53+
54+
55+
-- find plugins in HTML page source and return table
56+
function parse_plugins_response (data)
57+
local result = {}
58+
local pluginmatch = 'wp%-content/plugins/([0-9a-z%-.]+)'
59+
60+
for plugin in string.gmatch(data, pluginmatch) do
61+
if not stdnse.contains(result, plugin) then
62+
table.insert(result, plugin)
63+
end
64+
end
65+
return result
66+
end
67+
68+
69+
portrule = shortport.http
70+
71+
action = function(host, port)
72+
local response, loc, generator
73+
local path = stdnse.get_script_args('http-wordpress-info.path') or '/'
74+
local redirects = tonumber(stdnse.get_script_args('http-wordpress-info.redirects')) or 3
75+
local output_tab = stdnse.output_table()
76+
77+
-- Find Version in "meta generator tag"
78+
local pattern = '<meta name="?generator"? content="WordPress ([.0-9]*)" ?/?>'
79+
local themematch = 'wp%-content/themes/([0-9a-z]+)'
80+
81+
-- make pattern case-insensitive
82+
pattern = pattern:gsub("%a", function (c)
83+
return string.format("[%s%s]", string.lower(c),
84+
string.upper(c))
85+
end)
86+
87+
-- Find version in readme.html file
88+
local readmepattern = 'Version ([.0-9]*)'
89+
local wpversion = nil
90+
local themes = nil
91+
92+
93+
94+
response = follow_redirects(host, port, path, redirects)
95+
if ( response and response.body ) then
96+
wpversion = response.body:match(pattern)
97+
themes = response.body:match(themematch)
98+
plugins = parse_plugins_response(response.body)
99+
end
100+
101+
-- If version not in generator tag, check /readme.html
102+
if ( not wpversion and response.body:match("wp%-content")) then
103+
readmepath = path .. '/readme.html'
104+
readmeresponse = follow_redirects(host, port, readmepath, redirects)
105+
if ( readmeresponse and readmeresponse.body ) then
106+
wpversion = readmeresponse.body:match(readmepattern)
107+
end
108+
end
109+
110+
-- Store results in output table
111+
if wpversion then
112+
output_tab.version = 'WordPress ' .. wpversion
113+
end
114+
if ( themes and #themes > 0 ) then
115+
output_tab.theme = themes
116+
end
117+
if ( plugins and #plugins > 0 ) then
118+
output_tab.plugins = plugins
119+
end
120+
if ( output_tab.version or output_tab.plugins or output_tab.theme ) then
121+
return output_tab
122+
end
123+
end

0 commit comments

Comments
 (0)