It seems that the nmap script http-referer-checker does not respect the NOT external reference provided during nmap scanning.
For example:
nmap -vv -dd --script=(http-referer-checker) and not (external) xxx.xxx.xxx.xxx
Debug output:
NSE: [http-stored-xss W:55eb7076ad38 10.[REDACTED]:80] httpspider: Link is not within host: http://en.wikipedia.org:80/wiki/Mr._T
NSE: [http-referer-checker W:55eb71ca2a88 10.[REDACTED]:80] httpspider: Fetching url [14 of 30]: http://en.wikipedia.org:80/wiki/Mr._T
NSE: [http-referer-checker W:55eb71ca2a88 10.[REDACTED]:80] httpspider: Scraping is not allowed for url: http://en.wikipedia.org:80/wiki/Mr._T
As can be seen by the above debug output, the http-stored-xss respects the link as not within the host, however the http-referer-checker does not respect the not external reference and fetches the url via a GET
This script should be in the external category as there is scans to external domains outside the original scanned domain and host (which may not be part of the original scanning scope), this can lead to detection as well as scanning leaks.
It seems that the nmap script http-referer-checker does not respect the NOT external reference provided during nmap scanning.
For example:
nmap -vv -dd --script=(http-referer-checker) and not (external) xxx.xxx.xxx.xxx
Debug output:
As can be seen by the above debug output, the http-stored-xss respects the link as not within the host, however the http-referer-checker does not respect the not external reference and fetches the url via a GET
This script should be in the external category as there is scans to external domains outside the original scanned domain and host (which may not be part of the original scanning scope), this can lead to detection as well as scanning leaks.