Re: Nasl script for TRACE XSS vulnerability

[Thomas Reinke]

Some suggest improvements - new script re-attached.

Thomas

[EMAIL PROTECTED] wrote:

Quoting Thomas Reinke <[EMAIL PROTECTED]>:

Note the scriptid needs to be set.

Thomas

FYI: You may want to have it also check for TRACK as well as TRACE, (per RFP's VulnWatch message from a few minutes ago--link below).

http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0035.html
-Sullo

#
# This script was written by Thomas Reinke <[EMAIL PROTECTED]>
# Improvements re TRACK and RFP reference courtesy of <[EMAIL PROTECTED]>
#
# See the Nessus Scripts License for details
#

if(description)
{
 script_id(xxx);
 script_version ("$");
 name["english"] = "http TRACE XSS attack";
 script_name(english:name["english"]);
 
 desc["english"] = "
Your webserver supports the TRACE method. It has been
shown that servers supporting this method are subject
to cross-site-scripting attacks, dubbed XST for
'Cross-Site-Tracing', when used in conjunction with
various weaknesses in browsers.

Solution: Disable the TRACE method.

See http://www.whitehatsec.com/press_releases/WH-PR-20030120.pdf
    http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0035.html

Risk factor : Medium";

 script_description(english:desc["english"]);
 
 summary["english"] = "http TRACE XSS attack";
 script_summary(english:summary["english"]);
 
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2003 E-Soft Inc.");
 family["english"] = "CGI abuses";
 script_family(english:family["english"]);
 exit(0);
}

#
# The script code starts here
#

include("http_func.inc");

port = get_kb_item("Services/www");
if(!port)port = 80;
if (get_port_state(port))
{
    cmd1 = "TRACE /thisFiledoesnNotexist.html HTTP/1.0";
    cmd2 = "TRACK /thisFiledoesnNotexist.html HTTP/1.0";
    soc = http_open_socket(port);
    if(!soc) exit(0);
    request = string(cmd1, "\r\n\r\n");
    send(socket:soc, data:request);
    code = recv(socket:soc, length:1024, timeout:3);
    http_close_socket(soc); 
    if(cmd1 >< code)
    {
        security_hole(port:port);
        exit(0);
    }

    soc = http_open_socket(port);
    if(!soc) exit(0);
    request = string(cmd2, "\r\n\r\n");
    send(socket:soc, data:request);
    code = recv(socket:soc, length:1024, timeout:3);
    http_close_socket(soc); 
    if((cmd1 >< code) || (cmd2 >< code))
    {
        security_hole(port:port);
    }
}