Crawling web servers to detect vulnerabilities
When assessing the security of web applications, certain checks need to be done on every file in a web server. For example, looking for forgotten backup files may reveal the application source code or database passwords. NSE supports web crawling, to help us with tasks that require a list of existing files on a web server.
This recipe will show you how to write an NSE script that will crawl a web server looking for files with a .php extension and perform an injection test via the $_SERVER['PHP_SELF'] variable to find reflected cross-site scripting vulnerabilities.
How to do it...
A common task that some major security scanners miss is locating reflected cross-site scripting vulnerabilities in PHP files via the $_SERVER['PHP_SELF'] variable. The web crawler httpspider library comes in handy when automating this task. Let's see how we can write a script: