Re: run nmap automatically from index.html (??)

[Daniel Miller <bonsaiviking () gmail com>]

On 11/16/2011 10:16 AM, securityfocus () rawchaos com wrote:
> If you can modify the source for the website, you can add something like this with PHP at the end of the page:
>
> <?php
> passthru("/path/to/nmap<args>  " . $_SERVER['REMOTE_ADDR'] . ">>  /path/to/log_file.log 2>&1&");
> ?>
>
> It is important to note that "2>&1&" allows this command to be backgrounded so PHP will not wait for this command to finish 
> before rendering the page and closing.  Also if you are behind a proxy you might have to use something like $_SERVER["HTTP_X_FORWARDED_FOR"] 
> instead.
>
> If modifying the source of the page is out of the question, I would avoid scanning the logs as there's no guarantee of when 
> apache will flush logs to disk (it does not happen in real time).  It would probably work just fine, but if you are going to 
> write a log scraping service anyway, I'd sooner write an apache2 module or use mod_perl to hook EXEC_ON_READ or similar.
>
> -a
Using HTTP_X_FORWARDED_FOR in a system command is a terrible idea, as it 
is under the control of the client. You would be introducing a command 
injection vulnerability.

Dan

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------