Don't save creds of anyuser:anypass
If http accepts any user and any pass, it's not a real auth there is no reason to create cred objects for this. These creds have been confusing our usersunstable
parent
c82bb73347
commit
4503a7af50
|
@ -149,6 +149,7 @@ class Metasploit3 < Msf::Auxiliary
|
|||
print_status("#{target_url} - Random passwords are not allowed.")
|
||||
end
|
||||
|
||||
unless user == "anyuser" and pass == "anypass"
|
||||
report_auth_info(
|
||||
:host => rhost,
|
||||
:port => rport,
|
||||
|
@ -159,6 +160,7 @@ class Metasploit3 < Msf::Auxiliary
|
|||
:source_type => "user_supplied",
|
||||
:active => true
|
||||
)
|
||||
end
|
||||
|
||||
return :abort if ([any_user,any_pass].include? :success)
|
||||
return :next_user
|
||||
|
|
Loading…
Reference in New Issue