nasl脚本写法

1，添加插件注册信息。
if(description)
{
#添加Nessus ID
script_id(10871);

#添加CVE ID
script_cve_id("CAN-2001-1143");

#添加bug traq id
script_bugtraq_id(126);

#添加版本信息
script_version("$Revision:1.0$");

#name变量赋值，添加脚本名称
#语言支持：english(英语)、francais(法语)、deutch(德语)、portuguese(葡萄牙语)
name["english"] = "Script Name in English";
script_name(englist:name["english"]);

#描述漏洞的详细信息
desc["english"] = "This desc of the script will show up in Nessus";
script_description(english:desc["english"]);

#描述脚本要执行的动作
summary["english"] = "One line English description.";
script_summary(english:summary["english"]);

#设置脚本类型
#类型如下：
# ACT_INIT:Plugin sets KB items.
# ACT_SCANNER: Plugin is a port scanner or similar (like ping).
# ACT_SETTINGS: Plugin sets KB items after ACT_SCANNER.
# ACT_GATHER_INFO: Plugin identi?es services, parses banners.
#   ACT_ATTACK: For non-intrusive attacks (eg directory traversal).
# ACT_MIXED_ATTACK: Plugin launches potentially dangerous attacks.
# ACT_DESTRUCTIVE_ATTACK: Plugin attempts to destroy data.
# ACT_DENIAL: Plugin attempts to crash a service.
# ACT_KILL_HOST: Plugin attempts to crash target host.
script_category(ACT_DENIAL);

#添加版权信息
script_copyright(english:"No copyright.");

#添加攻击种类描述
#种类类型：
# - Backdoors 
# - CGI abuses
# - CISCO
# - Denial of Service
# - Finger abuses
# - Firewalls
# - FTP
# - Gain a shell remotely
# - Gain root remotely
# - General
# - Misc.
# - Netware
# - NIS
# - Ports scanners
# - Remote ?le access
# - RPC
# - Settings
# - SMTP problems
# - SNMP
# - Untested
# - Useless services
# - Windows
# - Windows : User management
family["english"] = "Denial of Service";
script_family(english:family["english"]);

#添加所依赖的脚本
script_dependencies("find_service.nes");

#添加所需的端口
script_require_ports("Services/www", 80);

#退出
exit(0);
}


2，添加引用的类库。
include("http_func.inc");


3，初始化信息。
port = get_kb_item("Services/www");
if(!port) port = 80;
if(!get_port_state(port)) exit(0);


4，脚本执行（最核心部分）。


#Nessus可以进行Safe Checks Only方式的检查
if(safe_checks())
{
b = get_http_banner(port:port);
if(b =~ 'Server: *Apache/2\.')
{
#添加安全提示信息
report = "This is a report .";
#安全提示等级函数如下：
# security_note: an informational finding
# security_warning: a minor problem
# security_hole: a serious problem
security_hole(port:port, data:report);
}
exit(0);
}
else
{
#在开始之前，先检查服务器是否存活
if(http_is_dead(port:port)) exit(0);

#打开目标端口
soc = http_open_socket(port);
if(soc)
{
payload = "some nasty string \n\n";

#发送数据
send(socket:soc, data:payload);

#接收数据
r = http_recv(socket:soc);

#关闭Socket
http_close_socket(soc);

#检查服务器是否有反应
if(http_id_dead(port:port)) security_hole(port);
}
}