2

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though.

For example I try to run nmap like this:

nmap --script http-title wikipedia.com

Output:

Starting Nmap 7.70 ( https://nmap.org ) at 2018-10-17 03:09 EDT

Nmap scan report for wikipedia.com (91.198.174.192)

Host is up (0.032s latency).

Other addresses for wikipedia.com (not scanned): 2620:0:862:ed1a::1

rDNS record for 91.198.174.192: text-lb.esams.wikimedia.org

Not shown: 989 closed ports

PORT     STATE    SERVICE

...

80/tcp   open     http
|_http-title: Did not follow redirect to http://www.wikipedia.org/

139/tcp  filtered netbios-ssn

179/tcp  filtered bgp

443/tcp  open     https
|_http-title: Did not follow redirect to https://www.wikipedia.org/

...


Nmap done: 1 IP address (1 host up) scanned in 2.53 seconds

I am running the current Kali build, fully up to date. I am using a VPN in this example but the result is the same without it.

Does anybody have a solution?

1

It has to do with the kind of redirect.

Here is the code: https://github.com/nmap/nmap/blob/master/scripts/http-title.nse

  -- check for a redirect
  if resp.location then
    redirect_url = resp.location[#resp.location]
    if resp.status and tostring( resp.status ):match( "30%d" ) then
      return {redirect_url = redirect_url}, ("Did not follow redirect to %s"):format( redirect_url )
    end
  end

If the status code is anything in the HTTP 300 range, then ""Did not follow redirect to ..."

So, basically, it is hardcoded to not follow redirects.

I found another NSE script called showHTMLTitle.nse to allow one redirect.

  • I found that one too, but couldn't test it because the original showHTMLTitle.nse is nowhere to be found. It used to be integrated into nmap but has been replaced I think. Cant find a source for it online – user189140 Oct 18 '18 at 7:11
  • @user189140 the code of the script is found in a few places but not as a packaged download. The nmap code above is why you are not following redirects. The only option is to use a 3rd part nse script or use a different tool. – schroeder Oct 18 '18 at 7:46
0

The http-title NSE script does follow redirects, but only those that can be guaranteed to be found on the same target and the same port. So the redirect in this case is not followed because you scanned wikipedia.com but the redirect was to www.wikipedia.com. Since these are different DNS names, they could resolve to different IP addresses, but the script is only allowed to check the same IP address and port. If you scan www.wikipedia.com instead, the script should work like you want it to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.