Update to http-wordpress-users.nse

--===============0999350777548554249==
Content-Type: multipart/alternative; boundary="00000000000012376705905054cc"

--00000000000012376705905054cc
Content-Type: text/plain; charset="UTF-8"

Hi,

Been a long time since my last post to this list :P I was making use of the
http-wordpress-users.nse script when I noticed a bug. The regular
expression for the case when the server returns a 200 HTTP status is too
open, it needs to be more specific.

When there is a link similar to the feed link that occurs before the feed
link, the expression will include everything between that initial link and
the feed link. An example output of when this happens follows below.

80/tcp open  http    syn-ack ttl 128
| http-wordpress-users:
| Username found: administrator/" />
| <link rel="alternate" hreflang="nl-NL" href="
http://scanme.nmap.org/author/administrator/" />
|
| (snipped for brevity)
|
| <link rel="alternate" type="application/rss+xml" title="ScanMe &raquo;
Posts by Administrator Feed" href="
http://scanme.nmap.org/author/administrator/

To fix this, the group that matches/captures the author username will only
do so until it finds a forward slash.

Patch follows below, cheers,
Duarte


Index: scripts/http-wordpress-users.nse
===================================================================
--- scripts/http-wordpress-users.nse (revision 37717)
+++ scripts/http-wordpress-users.nse (working copy)
@@ -64,7 +64,7 @@
     elseif req.status == 200 then
       -- Users with no posts get a 200 response, but the name is in an RSS
link.
       -- http://seclists.org/nmap-dev/2011/q3/812
-      local _, _, user = string.find(req.body,
'https?://.-/author/(.-)/feed/')
+      local _, _, user = string.find(req.body,
'https?://.-/author/([^/]+)/feed/')
       return user
     end
   end

--00000000000012376705905054cc
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div>Hi,</div><div><br></div><div>Been a =
long time since=20
my last post to this list :P I was making use of the=20
http-wordpress-users.nse script when I noticed a bug. The regular=20
expression for the case when the server returns a 200 HTTP status is too
 open, it needs to be more specific.</div><div><br></div><div>When there
 is a link similar to the feed link that occurs before the feed link,=20
the expression will include everything between that initial link and the
 feed link. An example output of when this happens follows below.</div><div=
><br></div><div>80/tcp open =C2=A0http =C2=A0 =C2=A0syn-ack ttl 128<br>| ht=
tp-wordpress-users:</div><div>| Username found: administrator/&quot; /&gt;<=
br>| &lt;link rel=3D&quot;alternate&quot; hreflang=3D&quot;nl-NL&quot; href=
=3D&quot;<a href=3D"http://scanme.nmap.org/author/administrator/" target=3D=
"_blank">http://scanme.nmap.org/author/administrator/</a>&quot; /&gt;<br>|=
=C2=A0</div><div>| (snipped for brevity)<br></div><div>| <br>| &lt;link rel=
=3D&quot;alternate&quot; type=3D&quot;application/rss+xml&quot; title=3D&qu=
ot;ScanMe &amp;raquo; Posts by Administrator Feed&quot; href=3D&quot;<a hre=
f=3D"http://scanme.nmap.org/author/administrator/" target=3D"_blank">http:/=
/scanme.nmap.org/author/administrator/</a></div><div><br></div><div>To fix =
this, the group that matches/captures the author username will only do so u=
ntil it finds a forward slash.</div><div><br></div><div>Patch follows below=
, cheers,</div><div>Duarte<br></div><div><br></div><div><br></div><div>Inde=
x: scripts/http-wordpress-users.nse<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D<br>--- scripts/http-wordpress-users.nse	(revision 37717)<br=
>+++ scripts/http-wordpress-users.nse	(working copy)<br>@@ -64,7 +64,7 @@<b=
r>=C2=A0 =C2=A0 =C2=A0elseif req.status =3D=3D 200 then<br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0-- Users with no posts get a 200 response, but the name is in =
an RSS link.<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0-- <a href=3D"http://seclists.or=
g/nmap-dev/2011/q3/812" target=3D"_blank">http://seclists.org/nmap-dev/2011=
/q3/812</a><br>- =C2=A0 =C2=A0 =C2=A0local _, _, user =3D string.find(req.b=
ody, &#39;https?://.-/author/(.-)/feed/&#39;)<br>+ =C2=A0 =C2=A0 =C2=A0loca=
l _, _, user =3D string.find(req.body, &#39;https?://.-/author/([^/]+)/feed=
/&#39;)<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0return user<br>=C2=A0 =C2=A0 =C2=A0en=
d<br>=C2=A0 =C2=A0end</div></div></div>

--00000000000012376705905054cc--

--===============0999350777548554249==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/
--===============0999350777548554249==--