Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

There's more...

Some web servers do not return regular status 404 code responses when a page does not exist and instead return status code 200 all the time. This is an aspect that is often overlooked; just keep in mind that a 200 does not necessarily mean that the URI exists to avoid false positives in our scripts. The http.identify_404() and http.page_exists() functions were created to identify if a server returns regular 404 responses and if a given page exists:

   local status_404, req_404, page_404 = http.identify_404 (host, port) 

If the http.identify_404(host, port) function was successful, we can use http.page_exists():

   if http.page_exists(data, req_404, page_404, uri, true) then     stdnse.print_debug(1, "Page exists! → %s", uri)  end ...