Re: http-methods & http-trace NSE Script Enhancement Ideas

[Toni Ruottu <toni.ruottu () iki fi>]

Does this affect http-cors too?

On Wednesday, 23 May 2012, Paulino Calderon wrote:

> On 23/05/2012 07:17 a.m., King Thorin wrote:
>
> > I was just looking through some online docs and some nmap results. I've
> > never seen a server that includes public or allow header(s) on a
> > redirect response [maybe my experience is limited?]. It seems to me that
> > the http-methods NSE should follow
> > redirects (HTTP 301, 302, 303) in order to perform the necessary OPTIONS
> >  request on a page/resource that's providing a HTTP 200.
> >
> >
> > Perhaps similar to the http-trace script:
> > http://nmap.org/svn/scripts/**http-trace.nse<http://nmap.org/svn/scripts/http-trace.nse>
> > Though
> >  even that only follows one 301 or 302 redirect.
> >
> > Further, maybe both scripts should follow a configurable
> >  # of redirects (default 2, 3, 4 and configurable further) looking for a
> >  HTTP 200&  handle 301, 302, and 303 redirect codes.
> >
> >
> > Reference:
> > http://www.w3.org/Protocols/**rfc2616/rfc2616-sec10.html<http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html>
> >
> > I've emailed the devs of both scripts without any luck.
> >
> >
> >
> > I'd be glad to provide the necessary changes, if someone can simply fill
> > me in as to how they should be submitted.
> >
> >
> > ______________________________**_________________
> > Sent through the nmap-dev mailing list
> > http://cgi.insecure.org/**mailman/listinfo/nmap-dev<http://cgi.insecure.org/mailman/listinfo/nmap-dev>
> > Archived at http://seclists.org/nmap-dev/
> I think adding a configuration value for redirects will work better in
> some cases. I would say most of the libraries follow 2-3 redirects but no
> more than that. In your experience, what would be a good default?
>
> --
> Paulino Calderón Pale
> Website: http://calderonpale.com
> Twitter: http://twitter.com/calderpwn
>
> ______________________________**_________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/**mailman/listinfo/nmap-dev<http://cgi.insecure.org/mailman/listinfo/nmap-dev>
> Archived at http://seclists.org/nmap-dev/
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/