The scripts http-unsafe-output-escaping and http-phpself-xss depend on
the library httpspider. This library can be configured to increase its coverage and overall behavior.
For example, the library will only crawl 20 pages by default, but we can set the argument httpspider.maxpagecount accordingly for bigger sites:
$nmap -p80 --script http-phpself-xss --script-args httpspider.maxpagecount=200 <target>
Another interesting argument is httpspider.withinhost, which limits the web crawler to a given host. This is turned on by default, but you could use the following command to disable this behavior:
$nmap -p80 --script http-phpself-xss --script-args httpspider.withinhost=false <target>
We can also set the maximum depth of directories we want to cover. By default, this value is only 3, so if you notice that the web server has deeply nested files, especially when pretty...
