a8ec733a3a
Interpolate all the things!
2014-07-11 17:14:09 -05:00
4abe856fc1
Rescue http_header notes from getting truncated
...
Seems that only one header line gets added to host notes, and the rest are thrown away. This adds the counter number to the type string, so that each header line entry is unique and correctly saved. I also added port in case you want headers from several ports on one host without the previous getting overwritten.
(scanning shodanhq.com)
----BEFORE----
msf auxiliary(http_header) > run -j
[*] Auxiliary module running as background job
msf auxiliary(http_header) >
[*] 162.159.245.38:80: requesting / via HEAD
[*] 162.159.245.38:80: deleted header Expires
[*] 162.159.245.38:80: CF-RAY: 1485d013ca880773-EWR
[*] 162.159.245.38:80: CACHE-CONTROL: max-age=15
[*] 162.159.245.38:80: CONNECTION: keep-alive
[*] 162.159.245.38:80: CONTENT-TYPE: text/html; charset=UTF-8
[*] 162.159.245.38:80: DATE: Fri, 11 Jul 2014 14:50:20 GMT
[*] 162.159.245.38:80: SERVER: cloudflare-nginx
[*] 162.159.245.38:80: SET-COOKIE: __cfduid=d3914e07fc681306bb53129adb3e6b1d41405090220122; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly
[+] 162.159.245.38:80: detected 7 headers
[*] Scanned 1 of 1 hosts (100% complete)
msf auxiliary(http_header) > notes
[*] Time: 2014-07-11 14:50:19 UTC Note: host=162.159.245.38 type=HTTP header data="SET-COOKIE: __cfduid=d3914e07fc681306bb53129adb3e6b1d41405090220122; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly"
msf auxiliary(http_header) >
----AFTER----
msf auxiliary(http_header) > run -j
[*] Auxiliary module running as background job
msf auxiliary(http_header) >
[*] 162.159.245.38:80: requesting / via HEAD
[*] 162.159.245.38:80: CF-RAY: 14869ad5c0970f57-FRA
[*] 162.159.245.38:80: CACHE-CONTROL: max-age=15
[*] 162.159.245.38:80: CONNECTION: keep-alive
[*] 162.159.245.38:80: CONTENT-TYPE: text/html; charset=UTF-8
[*] 162.159.245.38:80: DATE: Fri, 11 Jul 2014 17:08:45 GMT
[*] 162.159.245.38:80: EXPIRES: Fri, 11 Jul 2014 17:09:00 GMT
[*] 162.159.245.38:80: SERVER: cloudflare-nginx
[*] 162.159.245.38:80: SET-COOKIE: __cfduid=db2918126c4b49780b4669e88b72580521405098525082; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly
[+] 162.159.245.38:80: detected 8 headers
[*] Scanned 1 of 1 hosts (100% complete)
msf auxiliary(http_header) > notes
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.0 data="CF-RAY: 14869ad5c0970f57-FRA"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.1 data="CACHE-CONTROL: max-age=15"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.2 data="CONNECTION: keep-alive"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.3 data="CONTENT-TYPE: text/html; charset=UTF-8"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.4 data="DATE: Fri, 11 Jul 2014 17:08:45 GMT"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.5 data="EXPIRES: Fri, 11 Jul 2014 17:09:00 GMT"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.6 data="SERVER: cloudflare-nginx"
[*] Time: 2014-07-11 17:08:44 UTC Note: host=162.159.245.38 type=http.80.header.7 data="SET-COOKIE: __cfduid=db2918126c4b49780b4669e88b72580521405098525082; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; HttpOnly"
msf auxiliary(http_header) >
2014-07-11 17:14:09 -05:00
6ef69b4014
scraper report_note, remove eol whitespace
2014-07-11 21:21:56 +02:00
ad46c37988
scraper report_note, remove unnecessary to_s
2014-07-11 21:08:35 +02:00
7a7d149dc5
scraper report_note, change note type string
2014-07-11 21:01:20 +02:00
e5d7dae016
Land #3513 , Author name fixups from @jvazquez-r7
2014-07-11 13:58:38 -05:00
b09fab13f0
Fix one flubbed author address
2014-07-11 13:50:37 -05:00
8b302cd472
Add report_note to scraper.rb
...
Just a suggestion. I always personally modify this. I use it to scrape titles often, and i prefer it to be saved in notes rather than wmap results, because i find it easier to search and automatically add results to rhosts.
2014-07-11 20:31:46 +02:00
b834e7d3cb
Update scraper.rb
2014-07-11 20:20:40 +02:00
da67a63ad0
Add report_note to scraper.rb
...
Just a suggestion. I always personally modify this. I use it to scrape titles often, and i prefer it to be saved in notes rather than wmap results, because i find it easier to search and automatically add results to rhosts.
2014-07-11 20:07:48 +02:00
8937fbb2f5
Fix email format
2014-07-11 12:45:23 -05:00
79603c9a73
Land #3505 , a bunch o' Linux post module fixes
2014-07-11 12:39:31 -05:00
eb9d2f130c
Change title
2014-07-11 12:03:09 -05:00
a356a0e818
Code cleanup
2014-07-11 12:00:31 -05:00
6fd1ff6870
Merge master
2014-07-11 11:40:39 -05:00
d637171ac0
Change module filename
2014-07-11 11:39:32 -05:00
c55117d455
Some cleanup
2014-07-11 11:39:01 -05:00
a7a700c70d
Land #3502 , @m-1-k-3's DLink devices HNAP Buffer Overflow CVE-2014-3936
2014-07-11 11:25:03 -05:00
b9cda5110c
Add target info to message
2014-07-11 11:24:33 -05:00
dea68c66f4
Update title and description
2014-07-11 10:38:53 -05:00
f238c2a93f
change module filename
2014-07-11 10:30:50 -05:00
f7d60bebdc
Do clean up
2014-07-11 10:28:31 -05:00
43f41de124
Land #3508 , CVE-2014-4671 Flash JSONP disclosure
2014-07-11 10:11:48 -05:00
8f3197c192
Land #3496 , @m-1-k-3's switch to CmdStager on dlink_upnp_exec_noauth
2014-07-11 09:50:57 -05:00
4ea2daa96a
Minor cleanup
2014-07-11 09:50:22 -05:00
51cfa168b1
Fix deprecation information
2014-07-11 09:47:30 -05:00
46f5282fd3
Land #3455 , @m-1-k-3's exploit for DLink UPNP M-Search Command Injection
2014-07-11 09:39:05 -05:00
611b8a1b6d
Modify title and ranking
2014-07-11 09:35:21 -05:00
a9b92ee581
Change module filename
2014-07-11 09:17:56 -05:00
36c6e74221
Do minor fixes
2014-07-11 09:17:34 -05:00
b8225ae2dc
Remove unnecessary ||= and ivars.
2014-07-10 16:06:28 -05:00
e0389dfbc3
Update code as per @wvu's code review.
2014-07-10 15:03:40 -05:00
62a2f1dc0a
Credential -> Model for realm key constants
2014-07-10 14:30:25 -05:00
109201a5da
little auto detect fix
2014-07-10 20:45:49 +02:00
781149f13f
little auto detect fix
2014-07-10 20:40:39 +02:00
dd439066ca
Patch rhost to display hostname of JSONP_URL.
2014-07-10 12:02:22 -05:00
bcec2df0a4
Fix Meterpreter PHP hop description
2014-07-10 11:35:48 -05:00
841cb6a590
STEAL_URL -> STEAL_URLS.
2014-07-10 09:14:32 -05:00
fad30bc874
Add flash rosetta exploit module for stealing URLs.
2014-07-10 09:09:10 -05:00
c5226352de
Un-login-able should be print_status, not good
2014-07-09 17:45:41 -05:00
038d1e210a
Merge upstream/master to deconflict.
...
Conflicts:
Gemfile.lock
2014-07-09 17:43:42 -05:00
f068006f05
auto target
2014-07-09 21:53:11 +02:00
6a765ae3b0
small cleanup
2014-07-09 21:16:29 +02:00
0674314c74
auto target included
2014-07-09 20:56:04 +02:00
b4812c1b7d
auto target included
2014-07-09 20:53:24 +02:00
7d9c0da691
Record correct creds with non-success status
2014-07-09 13:26:49 -05:00
afe36ab6ad
Merge branch 'staging/electro-release' into feature/MSP-9707/smb-bruteforce-refactor
...
Conflicts:
lib/metasploit/framework/login_scanner/smb.rb
2014-07-09 12:50:24 -05:00
42823fe15e
Test download_exec with linux meterpreter
2014-07-09 09:41:10 -05:00
f4c6505351
Test mount_cifs_creds on linux meterpreter
2014-07-09 09:20:30 -05:00
14b218dce5
Make hashdump compatible with meterpreter
2014-07-09 08:48:20 -05:00
73fdc06d1d
Fix enum_xchat to work with meterpreter
2014-07-09 08:37:17 -05:00
b47650580a
Fix bugs
2014-07-08 16:51:39 -05:00
a364172978
Add meterpreter as session type
2014-07-08 16:25:50 -05:00
c25c5f6806
Make linux gather post modules compatible with meterpreter
2014-07-08 16:23:57 -05:00
f89f47c4d0
dlink_dspw215_info_cgi_rop
2014-07-08 22:29:57 +02:00
6fbd6bb4a0
stager
2014-07-08 22:17:02 +02:00
ac727dae89
dlink_dsp_w215_hnap_exploit
2014-07-08 22:13:13 +02:00
579ce0a858
cleanup
2014-07-08 21:58:15 +02:00
51001f9cb3
Merge branch 'master' of git://github.com/rapid7/metasploit-framework into dlink_upnp_msearch_command_injection
2014-07-08 21:39:53 +02:00
84d6d56e15
cleanup, deprecated
2014-07-08 21:36:07 +02:00
10bcef0c33
cleanup, deprecated
2014-07-08 21:34:28 +02:00
aeda74f394
Merge branch 'master' into staging/electro-release
...
Conflicts:
Gemfile
Gemfile.lock
2014-07-07 16:41:23 -05:00
2a9ac0a007
Axe SSHKey in favor of a unified SSH
2014-07-07 13:35:17 -05:00
9fef2ca0f3
Description/whitespace changes (minor)
...
Four modules updated for the weekly release with minor cosmetic fixes.
- [ ] See all affected modules still load.
- [ ] See all affected modules have expected `info`
2014-07-07 12:39:05 -05:00
cd6b83858b
Add new Yokogawa SCADA exploit
2014-07-07 11:20:49 -05:00
6f433db609
Minor typo fix
2014-07-06 23:44:17 -05:00
3ef35f19dc
Prefer strip over chomp
2014-07-06 23:17:09 -05:00
d76081bcef
Prefer strip over chomp
2014-07-06 23:16:56 -05:00
ab7848a895
Merge master for testing of #2809
2014-07-06 22:27:58 -05:00
e7ade9f84d
migrate from wget to echo mechanism
2014-07-06 21:45:53 +02:00
d5843f8eaf
Updated Mailpoet exploit to work with another version
2014-07-06 10:53:40 +02:00
cf5d29c53b
Add EOF newline to satisfy msftidy
2014-07-05 13:51:12 -05:00
6d9bf83ded
Small fixes for the recent WP MailPoet module
...
Correct casing in the title
Anchor the use of ::File
Force body.to_s since it can be nil in corner cases
2014-07-05 13:17:23 -05:00
98a82bd145
Land #3486 , @brandonprry's exploit for CVE-2014-4511 gitlist RCE
2014-07-04 16:41:04 -05:00
59881323b9
Clean code
2014-07-04 16:40:16 -05:00
a33a6dc79d
add bash to requiredcmd
2014-07-03 16:52:52 -05:00
806f26424c
&& not and
2014-07-03 16:50:21 -05:00
6fb2fc85a0
address @jvasquez-r7 review points
2014-07-03 16:43:01 -05:00
2efa3d6bc0
Land #3487 , @FireFart's exploit for WordPress MailPoet file upload
2014-07-03 14:34:58 -05:00
f1b7a9f421
Land #3488 - loot storage into the enum_services post module
2014-07-03 14:18:16 -05:00
79c433e7ea
Land #3480 - Oracle Event Processing FileUploadServlet Arbitrary File Upload
2014-07-03 14:09:12 -05:00
c207d14d1f
Update description
2014-07-03 14:08:31 -05:00
97a6b298a8
Use print_warning
2014-07-03 13:38:20 -05:00
dcba357ec3
implement feedback
2014-07-03 20:27:08 +02:00
2c999d3099
Better describe the problem
2014-07-03 13:06:19 -05:00
9aa3c75234
Do something for the shut-everything-up event handling practice
2014-07-03 13:04:56 -05:00
8a513058f6
Fix comments
2014-07-03 12:59:10 -05:00
ebeb9880a6
Favor "unless" over "if" for negative conditions
...
Please refer to https://github.com/bbatsov/ruby-style-guide
2014-07-03 12:55:13 -05:00
1d828a951f
string interpolation is preferred over concatenation
...
Please refer to https://github.com/bbatsov/ruby-style-guide
2014-07-03 12:46:56 -05:00
b781b87d74
Avoid unnecessary "if not"
2014-07-03 12:44:17 -05:00
86a31b1896
Update gitlist_exec.rb
2014-07-03 12:40:37 -05:00
aeb4fff796
Added FileDropper
2014-07-03 19:25:31 +02:00
51695c4932
Land #2484 , @zeroSteiner's refactoring for CmdStager
2014-07-03 11:33:46 -05:00
b15297eee0
Land #3490 , @Meatballs1 tns listener verbose output
2014-07-03 16:20:38 +02:00
5e0211016d
Merge to solve conflicts
2014-07-03 09:16:04 -05:00
071f236946
Changed check method
2014-07-02 22:31:02 +02:00
a58ff816c5
Changed check method
2014-07-02 22:29:00 +02:00
90df0f1bb5
Land #3489 - Add verbosity to Jenkins Enum
2014-07-02 14:40:25 -05:00
ecba95644d
Land #3473 - skype post module to extract password hash
2014-07-02 14:34:10 -05:00
e5b441314c
removed wrong edit ...
2014-07-02 21:33:49 +02:00
nodeofgithub
Tod Beardsley
jvazquez-r7
William Vu
joev
James Lee
Michael Messner
David Maloney
HD Moore
Christian Mehlmauer
Brandon Perry
sinn3r