Making scripts production-ready

local http      = require "http"
local shortport = require "shortport"
local stdnse    = require "stdnse"

description = [[
Checks a web server for missing security response headers and for a short list
of commonly exposed sensitive files. A file is only reported when the response
body matches a known signature and does not look like a catch-all page.

The script sends at most one request for the site root, one baseline request,
and one request per probe (a maximum of about a dozen requests per service).
]]

---
-- @usage
-- nmap -p 80,443 --script http-hygiene <target>
-- nmap -p 80 --script http-hygiene --script-args http-hygiene.basepath=/app/ <target>
--
-- @args http-hygiene.basepath  Path prefix to test under. Default: "/".
-- @args http-hygiene.timeout   Per-request timeout in seconds. Default: 5, range 1-60.
--
-- @output
-- PORT   STATE SERVICE
-- 80/tcp open  http
-- | http-hygiene:
-- |   missing_headers:
-- |     x-content-type-options
-- |   exposed_files:
-- |_    /.git/HEAD (git repository metadata)
--
-- @xmloutput
-- <table key="missing_headers">
--   <elem>x-content-type-options</elem>
-- </table>
-- <table key="exposed_files">
--   <elem>/.git/HEAD (git repository metadata)</elem>
-- </table>

author = "Your Name"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}

portrule = shortport.http

local WANTED_HEADERS = {
  "strict-transport-security",
  "x-content-type-options",
  "content-security-policy",
  "x-frame-options",
}

local PROBES = {
  {path = "/.git/HEAD",     sig = "^ref: refs/",          what = "git repository metadata", plain = true},
  {path = "/.env",          sig = "^[A-Z][A-Z0-9_]*=",    what = "environment file",        plain = true},
  {path = "/server-status", sig = "Apache Server Status", what = "Apache server-status page"},
  {path = "/phpinfo.php",   sig = "PHP Version",          what = "phpinfo() output"},
}

local MAX_BODY = 64 * 1024   -- never read more than this from any response

-- Validate the arguments once. Returns options table, or nil + message.
local function get_options()
  local base = stdnse.get_script_args(SCRIPT_NAME .. ".basepath") or "/"
  if base:sub(1, 1) ~= "/" then
    return nil, "basepath must start with /"
  end
  if base:sub(-1) ~= "/" then base = base .. "/" end

  local secs = tonumber(stdnse.get_script_args(SCRIPT_NAME .. ".timeout")) or 5
  if secs < 1 or secs > 60 then
    return nil, "timeout must be between 1 and 60 seconds"
  end
  return {base = base, timeout = secs * 1000}
end

-- One bounded request. Returns the response only if a real HTTP reply arrived.
local function fetch(host, port, path, opts)
  local resp = http.get(host, port, path, {
    timeout = opts.timeout,
    redirect_ok = false,
    max_body_size = MAX_BODY,
    truncated_ok = true,
  })
  if resp and resp.status then return resp end
  stdnse.debug2("no response for %s%s", host.ip, path)
  return nil
end

action = function(host, port)
  local opts, err = get_options()
  if not opts then return "ERROR: " .. err end

  local root = fetch(host, port, opts.base, opts)
  if not root then return nil end

  local missing = {}
  for _, name in ipairs(WANTED_HEADERS) do
    local applicable = (name ~= "strict-transport-security") or shortport.ssl(host, port)
    if applicable and not root.header[name] then
      missing[#missing + 1] = name
    end
  end

  -- A server that returns 200 for a nonsense path answers everything with 200,
  -- so status codes prove nothing there. Remember it and require plain-text files.
  local baseline = fetch(host, port, opts.base .. "nse-no-such-path-7f3a", opts)
  local catch_all = baseline ~= nil and baseline.status == 200

  local exposed = {}
  for _, probe in ipairs(PROBES) do
    local resp = fetch(host, port, opts.base .. probe.path:sub(2), opts)
    if resp and resp.status == 200 and resp.body then
      local body = resp.body:sub(1, 4096)
      local looks_html = body:lower():find("<html", 1, true) ~= nil
      local same_as_baseline = catch_all and baseline.body == resp.body
      if body:find(probe.sig)
         and not (probe.plain and looks_html)
         and not same_as_baseline then
        exposed[#exposed + 1] = ("%s (%s)"):format(probe.path, probe.what)
      end
    end
  end

  if #missing == 0 and #exposed == 0 then return nil end

  local out = stdnse.output_table()
  if #missing > 0 then out.missing_headers = missing end
  if #exposed > 0 then out.exposed_files = exposed end
  return out
end

import socket, time
s = socket.socket(); s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind(("127.0.0.1", 8088)); s.listen()
while True:
    c, _ = s.accept()   # accept the connection... and say nothing
    time.sleep(3600)

time nmap -p 8088 --script ./http-hygiene.nse --script-args http-hygiene.timeout=2 127.0.0.1

# 1. Lint. luacheck understands Lua; tell it about NSE's globals.
luacheck http-hygiene.nse --std max --globals description author license categories \
    portrule hostrule prerule postrule action dependencies SCRIPT_NAME

# 2. The script loads and documents itself
nmap --script-help ./http-hygiene.nse

# 3. Run against your fixtures (containers or local servers) and compare with golden output
nmap -p 8000 --script ./http-hygiene.nse -oX out.xml 127.0.0.1
diff <(grep -A20 http-hygiene out.xml) expected.xml