Improved version of NSE script http-shellshock

[cldrn]

A script to detect the shellshock vulnerabilities in web applications was committed in rev 33916. However, there is room for improvements (although i'm not sure how urgent they are):

-The current script uses / as the default URI but the spidering library could be integrated to attempt to find all files inside /cgi-bin/ directories.
-A list of popular cgi-bin paths could be added. This also generates more traffic and is useless against the majority of non vulnerable hosts.

Nmap-dev thread:
http:https://seclists.org/nmap-dev/2014/q4/291

[h4ck3rk3y]

Hi,
This issue seems to be open for some time now. I think spidering a page would really slow down the script. I implemented option 2 with an invasive argument. Only if invasive is set true, then it goes through the popular directories.
Gyani
https://github.com/h4ck3rk3y/nmap/blob/master/test_scripts/http-shellshock.nse