imap-capabilities gets spurious capabilities from following OK line

[David Fifield <david () bamsoftware com>]

Here's a run of imap-capabilities against the Gmail imaps server. Notice
the jumbled "Thats all she wrote" among the capabilities and "OK" and
"gm9mb409695764pbc".

$ ./nmap -Pn --script imap-capabilities imap.gmail.com -p imaps --packet-trace
Nmap scan report for imap.gmail.com (74.125.20.108)
PORT    STATE SERVICE
993/tcp open  imaps
|_imap-capabilities: AUTH=XOAUTH2 QUOTA XYZZY NAMESPACE IDLE CHILDREN Thats wrote X-GM-EXT-1 ID she all 
AUTH=XOAUTHA0001 AUTH=PLAIN-CLIENTTOKEN OK gm9mb409695764pbc XLIST AUTH=PLAIN SASL-IR IMAP4rev1 UNSELECT

It seems to be reading too much into the capabilities. Here is a
transcript, edited from --packet-trace:

< * OK Gimap ready for requests from X.X.X.X gm9mb409695764pbc
> A0001 CAPABILITY
< * CAPABILITY IMAP4rev1 UNSELECT IDLE NAMESPACE QUOTA ID XLIST CHILDREN X-GM-EXT-1 XYZZY SASL-IR AUTH=XOAUTH2 
AUTH=PLAIN AUTH=PLAIN-CLIENTTOKEN AUTH=XOAUTH
< A0001 OK Thats all she wrote! gm9mb409695764pbc
_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/