Server : Apache/2.4.41 (Ubuntu) System : Linux absol.cf 5.4.0-198-generic #218-Ubuntu SMP Fri Sep 27 20:18:53 UTC 2024 x86_64 User : www-data ( 33) PHP Version : 7.4.33 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, Directory :  /usr/share/nmap/scripts/

Upload File : current_dir [ Writeable ] document_root [ Writeable ]

local http = require "http"
local nmap = require "nmap"
local shortport = require "shortport"
local stringaux = require "stringaux"
local table = require "table"

description = [[
Tests an http server for Cross-Origin Resource Sharing (CORS), a way
for domains to explicitly opt in to having certain methods invoked by
another domain.

The script works by setting the Access-Control-Request-Method header
field for certain enumerated methods in OPTIONS requests, and checking
the responses.
]]

---
-- @args http-cors.path The path to request. Defaults to
-- <code>/</code>.
--
-- @args http-cors.origin The origin used with requests. Defaults to
-- <code>example.com</code>.
--
-- @usage
-- nmap -p 80 --script http-cors <target>
--
-- @output
-- 80/tcp open
-- |_cors.nse: GET POST OPTIONS


author = "Toni Ruottu"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"default", "discovery", "safe"}


portrule =  shortport.http

local methods = {"HEAD", "GET", "POST", "PUT", "DELETE", "TRACE", "OPTIONS", "CONNECT", "PATCH"}

local function origin_ok(raw, origin)
  if not raw then
    return false
  end
  if raw == "*" then
    return true
  end
  if raw == "null" then
    return false
  end
  local allowed = stringaux.strsplit(" ", raw)
  for _, ao in ipairs(allowed) do
    if origin == ao then
      return true
    end
  end
  return false
end

local function method_ok(raw, method)
  if not raw then
    return false
  end
  local stuff = stringaux.strsplit(" ", raw)
  local nospace = table.concat(stuff, "")
  local allowed = stringaux.strsplit(",", nospace)
  for _, am in ipairs(allowed) do
    if method == am then
      return true
    end
  end
  return false
end

local function test(host, port, method, origin)
  local header = {
    ["Origin"] = origin,
    ["Access-Control-Request-Method"] = method,
  }
  local response = http.generic_request(host, port, "OPTIONS", "/", {header = header})
  local aorigins = response.header["access-control-allow-origin"]
  local amethods = response.header["access-control-allow-methods"]
  local ook = origin_ok(aorigins, response)
  local mok = method_ok(amethods, method)
  return ook and mok
end

action = function(host, port)
  local path = nmap.registry.args["http-cors.path"] or "/"
  local origin =  nmap.registry.args["http-cors.origin"] or "example.com"
  local allowed = {}
  for _, method in ipairs(methods) do
    if test(host, port, method, origin) then
      table.insert(allowed, method)
    end
  end
  if #allowed > 0 then
    return table.concat(allowed, " ")
  end
end