Don't save creds of anyuser:anypass

If http accepts any user and any pass, it's not a real auth
there is no reason to create cred objects for this.
These creds have been confusing our users
unstable
David Maloney 2013-05-16 10:25:32 -05:00
parent c82bb73347
commit 4503a7af50
1 changed files with 13 additions and 11 deletions

View File

@ -149,6 +149,7 @@ class Metasploit3 < Msf::Auxiliary
print_status("#{target_url} - Random passwords are not allowed.")
end
unless user == "anyuser" and pass == "anypass"
report_auth_info(
:host => rhost,
:port => rport,
@ -159,6 +160,7 @@ class Metasploit3 < Msf::Auxiliary
:source_type => "user_supplied",
:active => true
)
end
return :abort if ([any_user,any_pass].include? :success)
return :next_user