Home page logo
/

nmap-dev logo Nmap Development mailing list archives

Re: Possible NSE SCRIPT_NAME content issue
From: Djalal Harouni <tixxdz () opendz org>
Date: Mon, 9 May 2011 01:59:17 +0100

On 2011-05-08 19:13:56 +0200, Gorjan Petrovski wrote:
Hello,

I've ran across a possible issue. When I run "nmap --script <script>
<target>" and <script> is a file in the current directory which hasn't
been added to the script database, for ex. "nmap --script test
<target>" and the script name is "test.nse", the SCRIPT_NAME variable
is filled with "test.nse". Should it not strip the .nse extension, so
as to get correct arguments passed from --script-args and collected
with stdnse.get_script_args( SCRIPT_NAME .. <script_argument>) ?
You can add the metacharacter '*' to the match that is used to extract
the script name.

file: nse_main.lua, line 391
  local short_basename = match(filename, "[/\\]([^/\\]-)%.nse$")
can be:
  local short_basename = match(filename, "[/\\]*([^/\\]-)%.nse$")

The 'short_basename' will be assigned to the environment variable
'SCRIPT_NAME'


But I don't know if we should remove the '.nse' extension in this case.
There are some advantages :) (we know that the script is not in the
script.db file)

And I also think that using the SCRIPT_NAME for script arguments is not
a good idea.

Thanks.

-- 
tixxdz
http://opendz.org
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]