Lucene search

K
nmapPatrik KarlssonNMAP:AJP-METHODS.NSE
HistoryMay 07, 2012 - 6:49 p.m.

ajp-methods NSE Script

2012-05-0718:49:22
Patrik Karlsson
nmap.org
311

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.8%

Discovers which options are supported by the AJP (Apache JServ Protocol) server by sending an OPTIONS request and lists potentially risky methods.

In this script, “potentially risky” methods are anything except GET, HEAD, POST, and OPTIONS. If the script reports potentially risky methods, they may not all be security risks, but you should check to make sure. This page lists the dangers of some common methods:

<http://www.owasp.org/index.php/Testing_for_HTTP_Methods_and_XST_(OWASP-CM-008)&gt;

Script Arguments

ajp-methods.path

the path to check or <code>/<code> if none was given

slaxml.debug

See the documentation for the slaxml library.

http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent

See the documentation for the http library.

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

See the documentation for the smbauth library.

Example Usage

nmap -p 8009 &lt;ip&gt; --script ajp-methods

Script Output

PORT     STATE SERVICE
8009/tcp open  ajp13
| ajp-methods:
|   Supported methods: GET HEAD POST PUT DELETE TRACE OPTIONS
|   Potentially risky methods: PUT DELETE TRACE
|_  See https://nmap.org/nsedoc/scripts/ajp-methods.html

Requires


local ajp = require "ajp"
local shortport = require "shortport"
local stdnse = require "stdnse"
local stringaux = require "stringaux"
local table = require "table"
local tableaux = require "tableaux"

description = [[
Discovers which options are supported by the AJP (Apache JServ
Protocol) server by sending an OPTIONS request and lists potentially
risky methods.

In this script, "potentially risky" methods are anything except GET,
HEAD, POST, and OPTIONS. If the script reports potentially risky
methods, they may not all be security risks, but you should check to
make sure. This page lists the dangers of some common methods:

http://www.owasp.org/index.php/Testing_for_HTTP_Methods_and_XST_%28OWASP-CM-008%29
]]

---
-- @usage
-- nmap -p 8009 <ip> --script ajp-methods
--
-- @output
-- PORT     STATE SERVICE
-- 8009/tcp open  ajp13
-- | ajp-methods:
-- |   Supported methods: GET HEAD POST PUT DELETE TRACE OPTIONS
-- |   Potentially risky methods: PUT DELETE TRACE
-- |_  See https://nmap.org/nsedoc/scripts/ajp-methods.html
--
-- @args ajp-methods.path the path to check or <code>/<code> if none was given
--

author = "Patrik Karlsson"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "safe"}


portrule = shortport.port_or_service(8009, 'ajp13', 'tcp')

local arg_url = stdnse.get_script_args(SCRIPT_NAME .. ".path") or "/"
local UNINTERESTING_METHODS = { "GET", "HEAD", "POST", "OPTIONS" }

local function filter_out(t, filter)
  local result = {}
  for _, e in ipairs(t) do
    if ( not(tableaux.contains(filter, e)) ) then
      result[#result + 1] = e
    end
  end
  return result
end

action = function(host, port)

  local helper = ajp.Helper:new(host, port)
  if ( not(helper:connect()) ) then
    return stdnse.format_output(false, "Failed to connect to server")
  end

  local status, response = helper:options(arg_url)
  helper:close()
  if ( not(status) or response.status ~= 200 or
    not(response.headers) or not(response.headers['allow']) ) then
    return "Failed to get a valid response for the OPTION request"
  end

  local methods = stringaux.strsplit(",%s", response.headers['allow'])

  local output = {}
  table.insert(output, ("Supported methods: %s"):format(table.concat(methods, " ")))

  local interesting = filter_out(methods, UNINTERESTING_METHODS)
  if ( #interesting > 0 ) then
    table.insert(output, "Potentially risky methods: " .. table.concat(interesting, " "))
    table.insert(output, "See https://nmap.org/nsedoc/scripts/ajp-methods.html")
  end
  return stdnse.format_output(true, output)
end

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.973 High

EPSS

Percentile

99.8%

Related for NMAP:AJP-METHODS.NSE