I’ve just wasted 2 hours of sleep, but I’ve (finally) figured out some XSLT basics and created this simple XSL template to extract base URLs of web-applications from the XML output of a NMap scan. Very handy when you want to automatically pass NMap scan results to a web-application sitemap enumeration tool, such as dirsearch or dirb.
Just save the file to nmap-http-services.xsl and run xsltproc nmap-http-services.xsl nmap.xml, given that nmap.xml is the output of your nmap -oX nmap.xml ... scan.
Now dude, go get some sleep.
<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet version="1.0" xmlns:xsl="https://www.w3.org/1999/XSL/Transform">
<xsl:output method="text" indent="yes"/>
<xsl:template match="/nmaprun">
<xsl:for-each select="host">
<xsl:for-each select="ports/port">
<xsl:if test="state/@state = 'open' and service/@name = 'http'">
<xsl:if test="../../hostnames/hostname[@type='user']">
<xsl:if test="@portid = '80'">
<xsl:text>https://</xsl:text>
<xsl:value-of select="../../hostnames/hostname[@type='user']/@name"/>
<xsl:text> </xsl:text>
</xsl:if>
<xsl:if test="@portid = '443'">
<xsl:text>https://</xsl:text>
<xsl:value-of select="../../hostnames/hostname[@type='user']/@name"/>
<xsl:text> </xsl:text>
</xsl:if>
<xsl:if test="@portid != '80' and @portid != '443'">
<xsl:text>https://</xsl:text>
<xsl:value-of select="../../hostnames/hostname[@type='user']/@name"/>
<xsl:value-of select="portid"/>
<xsl:text> </xsl:text>
</xsl:if>
</xsl:if>
</xsl:if>
</xsl:for-each>
</xsl:for-each>
</xsl:template>
</xsl:stylesheet>