no404 and 302 (redirect)
Michel Arboi <[email protected]>
| Newsgroups | gmane.comp.security.nessus.devel |
|---|---|
| Organization | http://www.nessus.org/ |
| Message-ID | <[email protected]> |
What about this patch?
(unnamed)
(text/x-patch, 1.3 KB)
--- nessus-plugins/scripts/no404.nasl 6 Mar 2003 15:25:41 -0000 1.41
+++ nessus-plugins/scripts/no404.nasl 19 Mar 2003 11:43:02 -0000
@@ -201,9 +201,10 @@
# check for a 302 Moved
if(ereg(pattern:"^HTTP.*302", string:raw_http_line))
{
- # put the first line of the response as no404 msg ;)
+ # put the location field as no404 msg
found = string("www/no404/", port);
- set_kb_item(name:found, value:raw_http_line);
+ loc = egrep(string: ret, pattern: "^Location:");
+ set_kb_item(name:found, value:loc);
security_note(port);
if(debug) display("302: Using ", raw_http_line, "\n");
--- nessus-libraries/libnessus/www_funcs.c 1 Mar 2003 12:25:45 -0000 1.52
+++ nessus-libraries/libnessus/www_funcs.c 19 Mar 2003 11:43:00 -0000
@@ -802,7 +802,13 @@
i = 0;
break;
}
-
+ if (no404 != NULL && strncasecmp(no404, "Location:", 9) == 0)
+ if (strncasecmp(no404, redir_loc, strlen(no404)) == 0)
+ {
+ /* Redirection to error page */
+ i = 0;
+ break;
+ }
redir_loc = strchr(redir_loc, ' ');
redir_loc+=sizeof(char);
end = redir_loc;