George's status report - #1 of 16

[George Chatzisofroniou <sophron () latthi com>]

Hi all,

Here's my first GSoC report.

Accomplishments:

* Compiled nmap from source and set up SVN.

* Started reading NSE documentation, Fyodor's book, LUA
  tutorials, list's archives and existing NSE scripts.

* Had a meeting with Patrick. We discussed some of my proposed
  ideas and he gave me a good first idea on the things i could
  work on this summer. He also gave me some feedback on my
  http-comments-displayer script and suggested some guides to
  read.

* Subscribed to the mailing lists Fyodor suggested and signed
  the copyright assignments.

* Sent all the required paperwork to Google.

* Made some improvements on my current NSE scripts and wrote
  the first version of a new one (http-referer-checker).
  http-fileupload-expoit:
    - After uploading the payloads, this script will try to
      find them on common directories like "/upload" or
      "/files". The user has the oppurtunity to change / add
      this list of directories.
    - The script will now try to fill every field found in an
      upload form with some sample data. That may fail due to
      fields' restrictions, so the user can manually fill those
      fields by passing a dictionary to the 'fieldvalues'
      argument.
    - The script now (by default) crawls the webpage to find any 
      upload forms and tests them using various techniques. 
      Of'course the user can pass paths of forms to test as an 
      argument.

  http-comments-displayer:
    - This scripts now displays comments for all the HTML files
      on a website using a crawler. Of'course the user can turn
      this off and grep only a specific page of his choice by
      using the 'page' argument.
  http-referer-checker:
    - This script informs about cross-domain include of scripts 
      using a big pattern to check all links in the HTTP response 
      and prints those that src attributes point to a different 
      domain.

* Emailed my scripts to Patrick for a review.

Priorities:

(I'm starting my exams this week, so development may be a little 
slow for a while.)

* I still use Github for development. I should switch to nmap's
  SVN repo.

* Fix mistakes and make improvements on my current scripts.

* Start writing a new script. I'm thinking of http-stored-xss.
  This won't be much different from my fileupload-exploit 
  script. The logic should be the same: POST data and check 
  if payload was executed. 

Cheers,

-- 
George Chatzisofroniou
http://sophron.latthi.com

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Sent through the dev mailing list
http://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/