Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

How to do it...

1. To scan a web server looking for files vulnerable to XSS, we use the following command:

$ nmap -p80 --script http-unsafe-output-escaping <target>  

2. All the files suspected to be vulnerable will be listed in the results:

   PORT   STATE SERVICE REASON    80/tcp open  http   syn-ack    | http-unsafe-output-escaping:     |_  Characters [> " '] reflected in parameter id at               http://target/1.php?id=1 

The script output will also include the vulnerable parameter and which characters were returned without being filtered or encoded.

3. If you are working with a PHP server, run the following Nmap command:

$nmap -p80 --script http-phpself-xss,http-unsafe-output-escaping <target>  

Against a web server with vulnerable files, you will see a similar ...