HEX
Server: nginx/1.22.1
System: Linux iZuf67d4hh2ssx30nkok6dZ 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64
User: www (1000)
PHP: 7.4.33
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: //usr/share/nmap/scripts/http-gitweb-projects-enum.nse
local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local tab = require "tab"
local table = require "table"

description=[[
Retrieves a list of Git projects, owners and descriptions from a gitweb (web interface to the Git revision control system).
]]

---
-- @usage
-- nmap -p80 www.example.com --script http-gitweb-projects-enum
--
-- @output
-- 80/tcp open  http
-- | http-gitweb-projects-enum: 
-- | Projects from gitweb.samba.org:
-- |   PROJECT                         AUTHOR            DESCRIPTION
-- |   sando.git                       authornum1        no description
-- |   camui/san.git                   devteam           no description
-- |   albert/tdx.git/.git             blueteam          no description
-- |
-- |   Number of projects: 172
-- |_  Number of owners: 42
--
-- @args http-gitweb.projects-enum.path specifies the location of gitweb
--       (default: /)

author = "riemann"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}


portrule = shortport.http

---
-- @param author bloc (if author name are too long we have a span bloc)
-- @return author name filtred from html entities
---
get_owner = function(res)
	local result=res
	local _
	if ( res:match('<span') ) then
		_,_,result=string.find(res,'title="(.-)"')
	end
	return result
end

action = function(host, port)

	local path = stdnse.get_script_args(SCRIPT_NAME .. '.path') or '/'
	local response = http.get(host,port,path)
	local result, result_stats = {}, {}
	
	if not response or not response.status or response.status ~= 200 or
		not response.body then
		stdnse.print_debug(1, "%s: Failed to retrieve file: %s",
		    SCRIPT_NAME, path)
		return
	end

	local html = response.body
	local repo=tab.new()
	tab.addrow(repo,'PROJECT','AUTHOR','DESCRIPTION')

	-- verif generator
	if (html:match('meta name="generator" content="gitweb(.-)"')) then
		result['name'] = string.format("Projects from %s:", host.targetname or host.ip)
		
		local owners, projects_counter, owners_counter = {}, 0, 0
		
		for tr_code in html:gmatch('(%<tr[^<>]*%>(.-)%</tr%>)') do
			local regx='<a[^<>]*href="(.-)">(.-)</a>(.-)title="(.-)"(.-)<i>(.-)</i>'
			for _, project, _, desc, _, owner in tr_code:gmatch(regx) do

				--if desc result return default text of gitweb replace it by no description
				if(string.find(desc,'Unnamed repository')) then
					desc='no description'
				end
				
				tab.addrow(repo, project, get_owner(owner), desc)

        -- Protect from parsing errors or long owners
        -- just an arbitrary value
				if owner:len() < 128 and not owners[owner] then
					owners[owner] = true
					owners_counter = owners_counter + 1
				end

				projects_counter = projects_counter + 1
			end
		end

		table.insert(result,tab.dump(repo))
		table.insert(result, "")
		table.insert(result,
			  string.format("Number of projects: %d", projects_counter))
		if (owners_counter > 0 ) then
				table.insert(result,
				    string.format("Number of owners: %d", owners_counter))
		end

	end
	return stdnse.format_output(true,result)
end