Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

Configuring the NSE library httpspider

The scripts http-unsafe-output-escaping and http-phpself-xss depend on the library httpspider. This library can be configured to increase its coverage and overall behavior.

For example, the library will only crawl 20 pages by default, but we can set the argument httpspider.maxpagecount accordingly for bigger sites:

$nmap -p80 --script http-phpself-xss --script-args httpspider.maxpagecount=200 <target>

Another interesting argument is httpspider.withinhost, which limits the web crawler to a given host. This is turned on by default, but you could use the following command to disable this behavior:

$nmap -p80 --script http-phpself-xss --script-args httpspider.withinhost=false <target>

We can also set ...