Script `http-cookie-flags`

Script types: portrule
Categories: default, safe, vuln
Download: https://svn.nmap.org/nmap/scripts/http-cookie-flags.nse

Script Summary

Examines cookies set by HTTP services. Reports any session cookies set without the httponly flag. Reports any session cookies set over SSL without the secure flag. If http-enum.nse is also run, any interesting paths found by it will be checked in addition to the root.

Script Arguments

cookie: Specific cookie name to check flags on. Default: A variety of commonly used session cookie names and patterns.
path: Specific URL path to check for session cookie flags. Default: / and those found by http-enum.
slaxml.debug: See the documentation for the slaxml library.
http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent: See the documentation for the http library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.

Example Usage

nmap -p 443 --script http-cookie-flags <target>

Script Output

443/tcp open  https
| http-cookie-flags:
|   /:
|     PHPSESSID:
|       secure flag not set and HTTPS in use
|   /admin/:
|     session_id:
|       secure flag not set and HTTPS in use
|       httponly flag not set
|   /mail/:
|     ASPSESSIONIDASDF:
|       httponly flag not set
|     ASP.NET_SessionId:
|_      secure flag not set and HTTPS in use

Requires

Author:

Steve Benson

License: Same as Nmap--See https://nmap.org/book/man-legal.html