File manager - Edit - /usr/share/nmap/scripts/coap-resources.nse
Back
local coap = require "coap" local shortport = require "shortport" local stdnse = require "stdnse" local stringaux = require "stringaux" local table = require "table" description = [[ Dumps list of available resources from CoAP endpoints. This script establishes a connection to a CoAP endpoint and performs a GET request on a resource. The default resource for our request is <code>/.well-known/core</core>, which should contain a list of resources provided by the endpoint. For additional information: * https://en.wikipedia.org/wiki/Constrained_Application_Protocol * https://tools.ietf.org/html/rfc7252 * https://tools.ietf.org/html/rfc6690 ]] --- -- @usage nmap -p U:5683 -sU --script coap-resources <target> -- -- @output -- PORT STATE SERVICE REASON -- 5683/udp open coap udp-response ttl 36 -- | coap-resources: -- | /large: -- | rt: block -- | sz: 1280 -- | title: Large resource -- | /large-update: -- | ct: 0 -- | rt: block -- | sz: 55 -- | title: Large resource that can be updated using PUT method -- | /link1: -- | if: If1 -- | rt: Type1 Type2 -- |_ title: Link test resource -- -- @args coap-resources.uri URI to request via the GET method, -- <code>/.well-known/core</code> by default. -- -- @xmloutput -- <table key="/"> -- <elem key="ct">0</elem> -- <elem key="title">General Info</elem> -- </table> -- <table key="/ft"> -- <elem key="ct">0</elem> -- <elem key="title">Faults Reporting</elem> -- </table> -- <table key="/mn"> -- <elem key="ct">0</elem> -- <elem key="title">Monitor Reporting</elem> -- </table> -- <table key="/st"> -- <elem key="ct">0</elem> -- <elem key="title">Status Reporting</elem> -- </table> -- <table key="/time"> -- <elem key="ct">0</elem> -- <elem key="obs,</devices/block>;title">Devices Block</elem> -- <elem key="title">Internal Clock</elem> -- </table> -- <table key="/wn"> -- <elem key="ct">0</elem> -- <elem key="title">Warnings Reporting</elem> -- </table> author = "Mak Kolybabi <mak@kolybabi.com>" license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"safe", "discovery"} -- TODO: Add 5684 "coaps" if DTLS support is added portrule = shortport.port_or_service(5683, "coap", "udp") format_payload = function(payload) -- Leave strings alone. if type(payload) == "string" then return payload end local tbl = stdnse.output_table() -- We want to go through all of the links in alphabetical order. table.sort(payload, function(a,b) return a.name < b.name end) for _, link in ipairs(payload) do -- We want to go through all of the parameters in alphabetical -- order. table.sort(link.parameters, function(a,b) return a.name < b.name end) local row = stdnse.output_table() for _, param in ipairs(link.parameters) do row[param.name] = param.value end tbl[link.name] = row end return tbl end get_blocks = function(helper, options, b2opt, payload, max_reqs) -- Initialize the block table to store all of our received blocks. local blocks = {} blocks[b2opt.number] = payload -- If we don't know the number of the last block, we'll need to use -- the largest number we've seen as the maxumum. local max = b2opt.number -- If the first block we received happens to be the last one, either -- by being a one-block sequence or by the endpoint sending us the -- last block in the sequence first, we want to record the final -- number in the sequence. local last = nil if b2opt.more == false then last = b2opt.number max = b2opt.number end -- We'll continue to request blocks that are the same size as the -- original block, since the endpoint likely prefers that. local length = b2opt.length -- We want to track the number of requests we make so that a -- malicious endpoint can't keep us on the hook forever. for req = 1, max_reqs do -- Determine if there are any blocks in the sequence that we have -- not yet received. local top = max + 1 if last then top = last end local num = top for i = 0, top do if not blocks[i] then num = i break end end -- If the block we think we're missing is at the end of the -- sequence, we've got them all. if last and num >= last then stdnse.debug3("All %d blocks have been retrieved.", last) break end -- Create the request. local opts = { ["code"] = "get", ["type"] = "confirmable", ["options"] = { {["name"] = "block2", ["value"] = { ["number"] = num, ["more"] = false, ["length"] = length }} } } local components = stringaux.strsplit("/", options.uri) for _, component in ipairs(components) do if component ~= "" then table.insert(opts.options, {["name"] = "uri_path", ["value"] = component}) end end -- Send the request and receive the response. stdnse.debug3("Requesting block %d of size %d.", num, length) local status, response = helper:request(opts) if not status then return false, response end if not response.payload then return false, "Response did not contain a payload." end -- Check for the presence of the block2 option, and if it's -- missing then we're going to stop. b2opt = coap.COAP.header.find_option(response, "block2") if not b2opt then stdnse.debug1("Stopped requesting more blocks, response found without block2 option.") break end stdnse.debug3("Received block %d of size %d.", b2opt.number, b2opt.length) blocks[b2opt.number] = response.payload if b2opt.more == false then stdnse.debug3("Block %d indicates it is the end of the sequence.", b2opt.number, b2opt.length) last = b2opt.number max = b2opt.number elseif b2opt.number > max then max = b2opt.number end end -- Reassemble payload, handling potentially missing blocks. local result = "" for i = 1, max do if not blocks[i] then stdnse.debug3("Block %d is missing, replacing with dummy data.", i) result = result .. ("<! missing block %d!>"):format(i) else result = result .. blocks[i] end end return true, result end local function parse_args () local args = {} local uri = stdnse.get_script_args(SCRIPT_NAME .. '.uri') if not uri then uri = "/.well-known/core" end args.uri = uri return true, args end action = function(host, port) local output = stdnse.output_table() -- Parse and sanity check the command line arguments. local status, options = parse_args() if not status then output.ERROR = options return output, output.ERROR end -- Create an instance of the CoAP library's client object. local helper = coap.Helper:new(host, port) -- Connect to the CoAP endpoint. local status, response = helper:connect({["uri"] = options.uri}) if not status then -- Erros at this stage indicate we're probably not talking to a CoAP server, -- so we exit silently. return nil end -- Check that the response is a 2.05, otherwise we don't know how to -- continue. if response.code ~= "content" then -- If the port runs an echo service, we'll see an unexpected 'get' code. if response.code == "get" then -- Exit silently, this has all been a mistake. return nil end -- If the requested resource wasn't found, that's okay. if response.code == "not_found" then stdnse.debug1("The target reports that the resource '%s' was not found.", options.uri) return nil end -- Otherwise, we assume that we're getting a legitimate CoAP response. output.ERROR = ("Server responded with '%s' code where 'content' was expected."):format(response.code) return output, output.ERROR end local result = response.payload if not result then output.ERROR = "Payload for initial response was not part of the packet." return output, output.ERROR end -- Check for the presence of the block2 option, which indicates that -- we'll need to perform more requests. local b2opt = coap.COAP.header.find_option(response, "block2") if b2opt then -- Since the block2 option was used, the payload should be an unparsed string. assert(type(result) == "string") local status, payload = get_blocks(helper, options, b2opt, result, 64) if not status then output.ERROR = result return output, output.ERROR end result = result .. payload -- Parse the payload. local status, parsed = coap.COAP.payload.parse(response, result) if not status then stdnse.debug1("Failed to parse payload: %s", parsed) stdnse.debug1("Falling back to returning raw payload as last resort.") output["Raw CoAP response"] = result return output, stdnse.format_output(true, output) end result = parsed end -- Regardless of whether the block2 option was used, we should now have a -- parsed payload in some format or another. For now, they should all be -- strings or tables. assert(type(result) == "string" or type(result) == "table") -- If the payload has been parsed, and we requested the default -- resource, then we know how to format it nicely. local formatted = result if true then formatted = format_payload(result) end return formatted end
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 1.24 |
proxy
|
phpinfo
|
Settings