no404 and 302 (redirect)

Michel Arboi <[email protected]>
Newsgroups gmane.comp.security.nessus.devel
Organization http://www.nessus.org/
Message-ID <[email protected]>
What about this patch?
(unnamed) (text/x-patch, 1.3 KB)
--- nessus-plugins/scripts/no404.nasl   6 Mar 2003 15:25:41 -0000       1.41
+++ nessus-plugins/scripts/no404.nasl   19 Mar 2003 11:43:02 -0000
@@ -201,9 +201,10 @@
         # check for a 302 Moved
         if(ereg(pattern:"^HTTP.*302", string:raw_http_line))
         {
-             # put the first line of the response as no404 msg ;)
+             # put the location field as no404 msg
              found = string("www/no404/", port);
-             set_kb_item(name:found, value:raw_http_line);
+            loc = egrep(string: ret, pattern: "^Location:");
+             set_kb_item(name:found, value:loc);
              
              security_note(port);
              if(debug) display("302: Using ", raw_http_line, "\n");
--- nessus-libraries/libnessus/www_funcs.c      1 Mar 2003 12:25:45 -0000      1.52
+++ nessus-libraries/libnessus/www_funcs.c      19 Mar 2003 11:43:00 -0000
@@ -802,7 +802,13 @@
                i = 0;
                break;
                }
-
+       if (no404 != NULL && strncasecmp(no404, "Location:", 9) == 0)
+         if (strncasecmp(no404, redir_loc, strlen(no404)) == 0)
+           {
+             /* Redirection to error page */
+             i = 0;
+             break;
+           }
        redir_loc = strchr(redir_loc, ' ');
        redir_loc+=sizeof(char);
        end = redir_loc;
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.