RE: [NSE] NSE HTTP library

["Thomas Buchanan" <TBuchanan () thecompassgrp net>]

> -----Original Message-----
> From: nmap-dev-bounces () insecure org 
> [mailto:nmap-dev-bounces () insecure org] On Behalf Of Sven Klemm
> Sent: Friday, January 18, 2008 3:55 PM
> To: nmap-dev () insecure org
> Subject: Re: [NSE] NSE HTTP library
>
> Sven Klemm wrote:
>
> > Ah I found the bug. I forgot to declare the socket variable as local.
> > Now everything works fine. I've attached the fixed version.
>
> In the last version the newline fix got lost so this version adds it
> back in. I've also attached a patch for HTTPAuth.nse,
> showHTMLTitle.nse and robots.nse to make use of the library.
>
> Cheers,
> Sven

Sven,

Great to see this library being developed.  It seems like it will be
very useful.  I'm not quite sure about the way the library handles
multiple headers.  It looks like if it encounters multiple instances of
the same header, it combines their values into a comma separated list.
But there's nothing that prevents a server from returning a header value
that includes a comma, which could lead to ambiguous results.  Maybe
instead of creating a comma separated list, you could create a table
that holds each individual header value.  The caller would have to check
the type of the return value, which has it's own drawbacks, but it does
eliminate ambiguity.  Perhaps you have a better idea, or perhaps I'm not
reading the code correctly.

I noticed this in testing your patch to HTTPAuth.nse, it doesn't look
like it correctly handles multiple authentication headers.  For example,
one server I tested sent this back as part of the header:

Server: Microsoft-IIS/5.1
Date: Fri, 18 Jan 2008 22:05:34 GMT
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="Here be dragons!"

With your patch to the script, the output read:
80/tcp   open   http
|  HTTP Auth: HTTP Service requires authentication
|_   Auth type: Negotiate, realm = Here be dragons!

It should be (output from unpatched script):
80/tcp   open   http
|  HTTP Auth: HTTP Service requires authentication
|    Auth type: Negotiate
|    Auth type: NTLM
|_   Auth type: Basic, realm = Here be dragons!

I was trying to come up with a way to properly determine if multiple
auth headers were present, but as indicated, parsing a comma separated
list could lead to ambiguous results.  For example, if the
authentication type is Digest, additional information is provided by the
server in a comma separated list, such as the domain, nonce values, etc.

Anyway, not trying to discourage you from your development efforts, just
wanted to give you a little feedback.  I'm planning to try and port my
UPnP script over to your http library this weekend, and I'll try to let
you know how that goes.

Thomas

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org