diff --git a/modules/auxiliary/scanner/http/axis_login.rb b/modules/auxiliary/scanner/http/axis_login.rb index 36ef2bcb16..3563330d69 100644 --- a/modules/auxiliary/scanner/http/axis_login.rb +++ b/modules/auxiliary/scanner/http/axis_login.rb @@ -21,7 +21,7 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'Apache Axis2 Brute Force Utility', 'Description' => %q{ This module attempts to login to an Apache Axis2 instance using - username and password combindations indicated by the USER_FILE, + username and password combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options. It has been verified to work on at least versions 1.4.1 and 1.6.2. }, diff --git a/modules/auxiliary/scanner/http/glassfish_login.rb b/modules/auxiliary/scanner/http/glassfish_login.rb index 46cd3445bc..0bab8fb21b 100644 --- a/modules/auxiliary/scanner/http/glassfish_login.rb +++ b/modules/auxiliary/scanner/http/glassfish_login.rb @@ -19,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'GlassFish Brute Force Utility', 'Description' => %q{ This module attempts to login to GlassFish instance using username and password - combindations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options. + combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options. It will also try to do an authentication bypass against older versions of GlassFish. Note: by default, GlassFish 4.0 requires HTTPS, which means you must set the SSL option to true, and SSLVersion to TLS1. It also needs Secure Admin to access the DAS remotely.