Crawling web servers to detect vulnerabilities
When assessing the security of web applications, certain checks need to be done on every file in a web server. For example, looking for forgotten backup files may reveal the application source code or database passwords. NSE supports web crawling, to help us with tasks that require a list of existing files on a web server.
This recipe will show you how to write an NSE script that will crawl a web server looking for files with a .php extension and perform an injection test via the $_SERVER["PHP_SELF"] variable to find reflected cross-site scripting vulnerabilities.
How to do it...
A common task that some major security scanners miss is to locate reflected cross-site scripting vulnerabilities in PHP files via the $_SERVER["PHP_SELF"]variable. The web crawler httpspider library comes in handy when automating this task. Let's see how we can write a script:
- Create the
http-phpself-xss.nsescript file...
