Trendnet TV-IP110W webcams allow unauthenticated access to their video feed by simply requesting the URI /anony/mjpg.cgi. Let's write an NSE script to detect these devices. For now, let's ignore the documentation tags:

The complete script with documentation tags can be downloaded from https://github.com/cldrn/nmap-nse-scripts/blob/master/scripts/6.x/http-trendnet-tvip110w.nse.

In the script http-trendnet-tvip110w.nse, we defined the execution rule with the alias http from the shortport library:

portrule = shortport.http

The alias shortport.http is defined in the file /nselib/shortport.lua as follows:

LIKELY_HTTP_PORTS = {
        80, 443, 631, 7080, 8080, 8088, 5800, 3872, 8180, 8000
}

LIKELY_HTTP_SERVICES = {
        "http", "https", "ipp", "http-alt", "vnc-http", "oem-agent", "soap",
        "http-proxy",
}

http = port_or_service(LIKELY_HTTP_PORTS, LIKELY_HTTP_SERVICES)

The http library has methods such as http.head(), http.get(), and http.post() corresponding to the common HTTP methods HEAD, GET, and POST respectively, but it also has a generic method named http.generic_request() to allow more flexibility to developers who may want to try more obscure HTTP verbs.

In the script http-trendnet-tvip110w, we used the function http.head() to retrieve the URI /anony/mjpg.cgi:

local resp = http.head(host, port, uri)

The function http.head() returns a table containing the following response information:

The library stdnse is also used in the script http-trendnet-tvip110w.nse. This library is a collection of miscellaneous functions that come in handy when writing NSE scripts. The script used the function stdnse.print_debug(), a function to print debugging messages:

stdnse.print_debug(<debug level required>, <format string>, arg1, arg2...)  

The complete documentation for these libraries can be found at http://nmap.org/nsedoc/lib/http.html and http://nmap.org/nsedoc/lib/stdnse.html.

Some web servers do not return regular status 404 code responses when a page does not exist, and instead return status code 200 all the time. This is an aspect that is often overlooked and even I have made the mistake before of assuming that a status of 200 meant that the URI exists. We need to be careful with this to avoid false positives in our scripts. The functions http.identify_404() and http.page_exists() were created to identify if a server returns regular 404 responses and if a given page exists.

local status_404, req_404, page_404 = http.identify_404(host, port)

If the function http.identify_404(host, port) was successful, we can use http.page_exists():

if http.page_exists(data, req_404, page_404, uri, true) then
  stdnse.print_debug(1, "Page exists! → %s", uri)
end

$ nmap -p80 --script http-google-email -d4 <target>

$ nmap -p80 --script http-sqli-finder --script-args http.useragent="Mozilla 42" <target>

options = {header={}}
options['header']['User-Agent'] = "Mozilla/9.1 (compatible; Windows NT 5.0 build 1420;)"
local req = http.get(host, port, uri, options)

$ nmap -p80 --script http-methods --script-args http.pipeline=25 <target>

local reqs = nil

reqs = http.pipeline_add('/Trace.axd', nil, reqs)
reqs = http.pipeline_add('/trace.axd', nil, reqs)
reqs = http.pipeline_add('/Web.config.old', nil, reqs)

local results = http.pipeline(target, 80, reqs)

for i, req in pairs(results) do
  stdnse.print_debug(1, "Request #%d returned status %d", I, req.status)
end