NSE is well-known for its web scanning capabilities, and some of the scripts also require data files to increase their flexibility. Again, as a general recommendation, you should go through them to ensure that they apply to your locale. Let's review what data files are available for web security auditing.
This is the most important file related to web scanning in NSE. It contains the fingerprints used by the http-enum script. The http-enum script is the web enumeration script that looks for common application paths and forgotten configuration files; it even detects some web vulnerabilities.
The fingerprints are actually Lua tables. An entry looks somewhat similar to the following:
table.insert(fingerprints, {
category='cms',
probes={
{path='/changelog.txt'},
{path='/tinymce/changelog.txt'},
},
matches={
{match='Version (.-) ', output='Version \\1'},
{output='Interesting, a changelog.'}
}
})You may select the location of a different...