On Fri, 2003-06-06 at 23:23, Todd A. Jacobs wrote:
> It could be a badly written ASP file, I guess.
No, that's just a badly configured server. The problem is with the
access control on the web root directory.
> You'd have to look at the errors and the log (if there is one), compare it
> to the server log, and see if you have a false positive. It happens.
I think that this script may give a false positive if the server returns
a 200 OK code on non existing pages.
Try this patch:
----------------------------------------------------------
diff -b -w -u -r1.20 http_methods.nasl
--- http_methods.nasl 22 Feb 2003 21:15:44 -0000 1.20
+++ http_methods.nasl 7 Jun 2003 11:37:40 -0000
@@ -52,6 +52,7 @@
#
# The script code starts here
#
+include("http_func.inc");
integrist = script_get_preference("Integrist test");
if (!integrist) integrist="no";
@@ -63,9 +64,13 @@
req = http_get(item:file, port:port);
send(socket:_soc, data:req);
r = recv_line(socket:_soc, length:4096);
+ buf = http_recv(socket: _soc, code: r);
close(_soc);
- if(ereg(pattern:"^HTTP/[0-9]\.[0-9] 200 .*", string:r))
+ if(ereg(pattern:"^HTTP/[0-9]\.[0-9] 200 .*", string:r)
+ && ("A quick brown fox jumps over the lazy dog" >< buf))
+ {
return(1);
+ }
else
return(0);
}
---------------------------------------------------------------
