Home page logo

nmap-dev logo Nmap Development mailing list archives

Re: [NSE] http-waf-fingerprint.nse
From: Hani Benhabiles <kroosec () gmail com>
Date: Sun, 10 Jun 2012 23:06:56 +0100

On 06/10/2012 02:17 PM, Djalal Harouni wrote:

Thanks for the script.

You have probably discussed this with Henri, but I just want to bring it
Why fingerprints are included in the script ?
Because there wouldn't be as many fingerprints for WAFs as for something like http-enum and outside of the fingerprints, the script is nothing fancy.

Perhaps adding an 'author' field will bring new fingerprints ?

It could be added as a comment for the fingerprints (see the ModSecurity ones).

On Fri, Jun 08, 2012 at 11:44:07AM +0100, Hani Benhabiles wrote:
netscaler = {
     name = "Citrix Netscaler",
     detected = false,
     version = nil,

     match = function(responses)
         for _, response in pairs(responses) do

             -- TODO Check for other version detection possibilities
             -- based on fingerprint difference
             if response.header.via and string.find(response.header.via, 'NS-CACHE') then --
                 stdnse.print_debug("%s Citrix Netscaler detected through Via Header.", SCRIPT_NAME)
                 netscaler.version = string.sub(response.header.server, 10, 12)
In other places you have the checks, but here the check that
response.header.server is set is missing...

Another quick review ?
It should get the version from the via header, I corrected that. Thanks.


Hani Benhabiles

Twitter: https://twitter.com/#!/kroosec
Blog: http://kroosec.blogspot.com

Attachment: http-waf-fingerprint.nse

Sent through the nmap-dev mailing list
Archived at http://seclists.org/nmap-dev/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]