Nasl script for TRACE XSS vulnerability

[Thomas Reinke]

Note the scriptid needs to be set.

Thomas

#
# This script was written by Thomas Reinke <[EMAIL PROTECTED]>
#
# See the Nessus Scripts License for details
#

if(description)
{
 script_id(xxx);
 script_version ("$");
 name["english"] = "http TRACE XSS attack";
 script_name(english:name["english"]);
 
 desc["english"] = "
Your webserver supports the TRACE method. It has been
shown that servers supporting this method are subject
to cross-site-scripting attacks, dubbed XST for
'Cross-Site-Tracing', when used in conjunction with
various weaknesses in browsers.

See http://www.whitehatsec.com/press_releases/WH-PR-20030120.pdf

Solution: Disable the TRACE method.

Risk factor : Medium";

 script_description(english:desc["english"]);
 
 summary["english"] = "http TRACE XSS attack";
 script_summary(english:summary["english"]);
 
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2003 E-Soft Inc.");
 family["english"] = "CGI abuses";
 script_family(english:family["english"]);
 exit(0);
}

#
# The script code starts here
#

include("http_func.inc");

port = get_kb_item("Services/www");
if(!port)port = 80;
if (get_port_state(port))
{
    soc = http_open_socket(port);
    if(!soc) exit(0);
    cmd = "TRACE /thisFiledoesnNotexist.html HTTP/1.0";
    request = string(cmd, "\r\n\r\n");
    send(socket:soc, data:request);
    code = recv(socket:soc, length:1024, timeout:3);
    http_close_socket(soc); 
    if(cmd >< code)
    {
        security_hole(port:port);
    }
}