8c0bcd2e03
Update wordpress_cp_calendar_sqli.rb
...
Use the new WPVDB
2015-04-19 16:32:57 -05:00
4f903a604c
Fix #5103 , Revert unwanted URI encoding
...
Fix #5103 . By default, Httpclient will encode the URI but
we don't necessarily want that. These modules originally
didn't use URI encoding when they were written so we should
just keep them that way.
2015-04-17 13:59:49 -05:00
6653c9e33d
Land #5162 , WordPress Dukapress File Read Vulnerability
2015-04-17 11:20:55 +02:00
6c77b64dae
wrong method name
2015-04-17 11:20:14 +02:00
aef464fc2e
Land #5159 , WordPress Mobile Edition Plugin File Read Vuln
2015-04-17 11:13:00 +02:00
153344a1dd
fix Unkown typo
2015-04-16 23:59:28 +02:00
ed588e335b
Changed the print_error output.
2015-04-16 17:32:59 -03:00
bf3bdcffb4
Changed the deph value to 7.
2015-04-16 17:30:28 -03:00
dd474757fe
Changed the print_error output.
2015-04-16 17:26:44 -03:00
f50cedeafd
Changed the depth value to 7.
2015-04-16 17:22:49 -03:00
0e186fa617
first fail_with fixes
2015-04-16 21:08:33 +02:00
1455d4e94d
Fix AUTH_TIME
2015-04-16 11:39:33 -05:00
7c572777e1
Fix whitespace
2015-04-16 11:34:50 -05:00
7a9167b235
Fix comments
2015-04-16 11:34:47 -05:00
9bcc988266
Update owa_login
2015-04-16 11:23:04 -05:00
75b88f199a
Create wordpress_cp_calendar_sqli.rb
2015-04-16 09:53:00 -05:00
ecc67b1a57
Fix loot name
2015-04-16 10:42:20 -03:00
d898af5513
Add check version and removed HttpClient
2015-04-16 10:40:35 -03:00
768294710b
Add check and removed HttpClient
2015-04-16 10:22:10 -03:00
890561bff3
Rewriting the condition 'if' for only one line
2015-04-16 09:23:56 -03:00
b90ff36ef4
Rewriting the condition 'if' for only one line
2015-04-16 09:15:17 -03:00
21e964e699
Add Author and references..
2015-04-16 07:20:48 -03:00
f6f4bd0746
Add WordPress Dukapress File Read Vulnerability
2015-04-16 07:17:46 -03:00
c8e1185a04
Included Wordpress mixin.
2015-04-16 05:02:39 -03:00
42ff0decc7
Land #4722 , timing options for snmp_login
2015-04-16 02:25:29 -05:00
88062a578d
Clean up PR
2015-04-16 02:25:06 -05:00
bec6270f07
Fix regex
2015-04-15 23:47:03 -05:00
0a4ab99aa5
Land #5149 , couchdb_enum cleanup
2015-04-15 21:50:30 -05:00
4410f8da6e
Clean up module some more
2015-04-15 21:48:19 -05:00
01ae7002cf
Fix EOF whitespace
2015-04-15 21:27:53 -05:00
20d4d1ce3f
Move report_goods before the return
2015-04-15 21:22:41 -05:00
0031f09d60
Add author, EDB, WPVDB and fix loot.
2015-04-15 20:03:36 -03:00
0f1cf1d1b1
Add Module WP Mobile Edition Plugin File Read Vuln
2015-04-15 19:45:08 -03:00
66b7179a97
Rename module to owa_iis_internal_ip
2015-04-15 17:10:01 -05:00
a109dae033
Fix EOL whitespace
2015-04-15 16:58:59 -05:00
cc422eeeea
Fix splat
2015-04-15 16:58:18 -05:00
34ce4edacb
Add exchange_iis_internal_ip
2015-04-15 16:55:19 -05:00
1d6300991c
Clean the code of the module couchdb_enum.
2015-04-15 02:58:51 -03:00
d87483b28d
Squashed commit of the following:
...
commit 49f480af8b9d27e676c02006ae8873a119e1aae6
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Mon Apr 13 10:42:13 2015 -0500
Fix funny punctuation on rootpipe exploit title
See #5119
commit 0b439671efd6dabcf1a69fd0b089c28badf5ccff
Author: Tod Beardsley <tod_beardsley@rapid7.com>
Date: Mon Apr 13 10:37:39 2015 -0500
Fix vendor caps
Trusting the github repo README at
https://github.com/embedthis/goahead
See #5101
2015-04-13 10:46:47 -05:00
284ef5bbbb
Land #5112 , Nessus REST Login Module
2015-04-10 13:32:53 -05:00
7810f3d9a3
Add previous nessus_xmlrpc_login file
2015-04-10 12:32:42 +05:00
bbbd4d3634
change name to keep both XML and REST modules
2015-04-10 12:20:43 +05:00
b6e750d7eb
Nessus auxiliary scanner for updated REST API
2015-04-09 11:36:17 +05:00
1bfda9e78f
Land #5101 , Add Directory Traversal for GoAhead Web Server
2015-04-08 15:30:23 -05:00
e03f2df691
Land #5002 , RMI/JMX improvements
2015-04-08 15:23:29 -05:00
5f389cf3c2
Add ManageEngine Desktop Central Login Utility
2015-04-08 02:05:56 -05:00
dc14c770be
Changed the traversal variable to just one line
2015-04-08 02:26:59 -03:00
441042ed37
Removed the segments variable
2015-04-08 01:29:45 -03:00
d399d05383
Add Directory Traversal for GoAhead Web Server
2015-04-07 20:22:06 -03:00
42e82cc644
Rubocop fixes
2015-04-07 18:21:08 -05:00
7275d5745f
Fixes, refactoring and adding JBoss AS default creds scanning
2015-04-07 17:40:25 -05:00
56dc7afea6
Land #5068 , @todb-r7's module author cleanup
2015-04-03 16:00:36 -05:00
79b2a23dff
Land #5015 , @espreto file traversal scanner for RIPS
2015-04-03 15:35:58 -05:00
ce6e5e12d8
Make depth an option
2015-04-03 15:33:27 -05:00
70fad73092
Add metadata
2015-04-03 15:27:28 -05:00
e3bbb7c297
Solve conflicts
2015-04-03 14:57:49 -05:00
4bd40fed7f
yard doc and comment corrections for auxiliary
2015-04-03 16:12:23 +05:00
c9e8f9cbea
Add BigIP HTTP VS scanner and fix connection errors
2015-04-03 02:30:03 -04:00
6532fad579
Remove credits to Alligator Security Team
...
All but one of these modules credits both a team name and individual
team members. We should just be crediting team members. The domain
persists in all the other credits.
The one that didn't was credited to dflah_ specifically, so merely
changed the author name.
Longer description, if needed, wrapped at 72 characters.
[See #5012 ]
2015-04-02 15:12:22 -05:00
a592f645f0
Land #5039 , Webdorado gallery wd 1.2.5 unauthenticated SQLi scanner
2015-04-01 14:34:58 -05:00
e73286cfa5
update stale references
2015-03-30 17:17:48 -05:00
613f4777ce
Land #5024 , add joomla_ecommercewd_sqli_scanner.rb
2015-03-30 12:45:09 -05:00
de2bf0181c
add first pass at gallerywd sqli scanner
2015-03-28 16:15:51 -05:00
9f0483248c
add TARGETURI datastore option
2015-03-28 15:46:41 -05:00
6ede476423
Update joomla_ecommercewd_sqli_scanner.rb
2015-03-28 08:38:12 -05:00
0dbd8544b4
Update joomla_ecommercewd_sqli_scanner.rb
2015-03-27 21:20:59 -05:00
31be47d5bc
Create joomla_ecommercewd_sqli_scanner.rb
2015-03-27 20:25:33 -05:00
3e104fd8e6
Add Directory Traversal for RIPS Scanner
2015-03-27 05:08:43 -03:00
0540e25db2
Calculate the java/rmi/registry/RegistryImpl_Stub hash dinamically
2015-03-25 11:29:07 -05:00
040a1af9c5
Delete useless ecnryption cookie detection, fix minor issues
2015-03-25 02:34:33 -04:00
49a6057f74
Grammaring harder
2015-03-24 11:10:36 -05:00
ee17d6e606
Deleted spaces at EOL
2015-03-23 04:34:38 -04:00
2a0deaa6c8
Deleted default options and SYN scan
2015-03-23 04:31:08 -04:00
6f51946aa0
Land #4969 , GitLab module references
2015-03-20 17:26:51 -05:00
99f3de0843
Clean up info hash formatting
2015-03-20 17:26:21 -05:00
1226b3656f
Land #4945 , @wchen-r7's login scanner for Symantec web gateway
2015-03-20 14:44:05 -05:00
2f35fcff99
Fix require
2015-03-20 14:43:42 -05:00
8ee520e749
Add reference
2015-03-20 19:17:34 +00:00
b19f766728
Land #4942 , Gitlab Login Scanner
2015-03-20 13:02:12 -05:00
a2ce14a31e
Land #4941 , Gitlab Unauth User Enumeration
2015-03-20 12:28:35 -05:00
235124a40a
Fix typo
2015-03-20 12:27:23 -05:00
84164b44b2
Should also rescue JSON::ParserError for banner parsing
2015-03-20 12:27:02 -05:00
94ab2f94fd
Remove symbols that aren't used
...
These symbols belong to the AuthBrute mixin, but we are not using
AuthBrute for login testing.
2015-03-19 14:14:01 -05:00
14be07a2c4
Update java_rmi_server modules
2015-03-17 21:29:52 -05:00
1242404085
Delete comment
2015-03-17 14:18:07 -05:00
d1d6378179
Land #4566 , Misfortune Cookie scanner improvements
2015-03-17 12:32:35 -05:00
f95b783193
I don't need these eitehr
2015-03-17 11:33:49 -05:00
ebe7ad07b0
Add specs, plus modify java_rmi_server modules
2015-03-17 11:26:27 -05:00
e1ebc6c7fe
Update date, remove URL (will replace later)
2015-03-17 12:50:47 +00:00
0cd85cb052
Correct capitilzation of GitLab
2015-03-17 11:33:57 +00:00
d18224e3cb
Correct capitilzation of GitLab
2015-03-17 11:32:14 +00:00
f4a1e981ab
Add gitlab login scanner
2015-03-17 11:19:23 +00:00
878247f495
Small modifications
2015-03-17 10:03:32 +00:00
f1d5d8f1ce
Store to loot as well
2015-03-17 09:55:28 +00:00
9f40826f8e
Store creds in database
2015-03-17 09:17:08 +00:00
3830e71257
Catch 7.5 401
2015-03-17 09:17:08 +00:00
1b565b0290
Check revision
2015-03-17 09:17:07 +00:00
7216f2a971
Initial commit
2015-03-17 09:17:07 +00:00
14296826f7
A cleaner way to set datastore options
2015-03-17 03:07:49 -05:00
ff58f7d270
Add Symantec Web Gateway Login Module
2015-03-17 02:51:57 -05:00
e01f824b2c
Fix capitalization warnings
2015-03-17 03:46:00 -04:00
78be03623f
Fix indent warnings
2015-03-17 03:39:04 -04:00
34c30502fd
Add SSL/TLS support, fix minor errors, change default parameters
2015-03-17 02:49:11 -04:00
0a37df67a0
Add initial support for better RMI calls
2015-03-16 23:44:16 -05:00
4d3a1a2f71
fix all duplicated keys in modules
2015-03-14 13:10:42 +01:00
a32cd2ae9e
Land #4877 , CVE-2015-0240 (Samba) aux module
2015-03-13 00:03:53 -05:00
bc0276a9c8
Add scanner for F5 web management interfaces
2015-03-12 06:50:29 -04:00
5b25ba5df3
moved array definition to avoid error
2015-03-07 12:57:44 -05:00
fac777da3d
brocade_enable_login msftidy success
2015-03-06 20:33:09 -05:00
591716e557
brocade enable command bruteforcer
2015-03-06 09:41:14 -05:00
e429d4c04f
Add reference and description for PTH on Postgres
...
Dave and William did most of the work already over on PR #4871 , this
just points it out in the module.
2015-03-05 14:36:56 -06:00
16c86227e2
Change to OptBool and default to explicit
2015-03-05 13:07:03 -06:00
2f4df39dc9
Fixed typo
2015-03-05 17:40:51 +11:00
d40e7485dd
Add CVE-2015-0240 auxiliary module
2015-03-04 23:50:14 -06:00
199c3ba96c
postgres hashdump now stores PostgresMD5 objects
...
instead of nonreplayabke hashes the postgres_hashdump
aux module now saves them approriately as PostgresMD5s
with the md5 tag intact at the front
MSP-12244
2015-03-03 16:45:13 -06:00
f24da1b178
Add file checking to printer_delete_file
2015-02-25 18:14:13 -06:00
dc3ba40e5d
Add file checking to printer_upload_file
2015-02-25 18:13:36 -06:00
513d11ce93
Complete replacement of "pathname" with "path"
...
See e8c2c3687d
2015-02-25 15:52:26 -06:00
b3d4fc798f
Add printer_delete_file module
2015-02-25 15:47:53 -06:00
90d179e56f
Add printer_upload_file module
2015-02-25 15:01:01 -06:00
3cf94740e6
Land #4817 , CHECK_TCP option for Lantronix module
2015-02-25 13:16:14 -06:00
d301752a88
Fix whitespace
2015-02-25 13:16:03 -06:00
a1c80d9f18
Fix URL
2015-02-25 08:54:08 -08:00
ab0d0d4ad4
Remove UDPScanner from MDNS and LLMNR mixin -- leave that for modules
2015-02-25 08:53:38 -08:00
e48425db31
Update LLMNR code to use MDNS, since the format is the same
2015-02-24 16:06:07 -08:00
efd10ee08a
Show name in status
2015-02-24 15:37:40 -08:00
54495a4f4c
Correct URL
2015-02-24 15:37:40 -08:00
9ccd59cefc
Simplify mdns query response printing (for now)
2015-02-24 15:37:40 -08:00
5396618a2e
Build LLMNR data ourselves, since Net::DNS is too restrictive.
2015-02-24 15:37:40 -08:00
c0d1775d86
Show rport in each batch
2015-02-24 15:37:40 -08:00
093606ae23
stash
2015-02-24 15:37:40 -08:00
80f5e68e8e
Add basic descriptions
2015-02-24 15:37:40 -08:00
95353da107
Cleanup, new base mDNS query module
2015-02-24 15:37:39 -08:00
ece84c0e30
Use build_probe
2015-02-24 15:37:39 -08:00
4feda7f3e7
Allow friendly LLMNR type (PTR, ptr, 12) and class (IN, in, 1)
2015-02-24 15:37:39 -08:00
4d82976740
Store LLMNR results
2015-02-24 15:37:39 -08:00
b3787ded6b
Add mDNS mixins, update query module to use them
2015-02-24 15:37:38 -08:00
9d21f29298
Update LLMNR query to use new UDPScanner functionality
2015-02-24 15:37:38 -08:00
fef19dd2a8
Add preliminary module for scanning mDNS
2015-02-24 15:37:38 -08:00
5f4c4ee4be
Use correct options to Packet.new
2015-02-24 15:37:38 -08:00
1e38a5db86
Use Net::DNS::Packet to build queries, static probe
2015-02-24 15:37:38 -08:00
473213849f
More truthy method to determine whether to print, better inspection
2015-02-24 15:37:38 -08:00
5cb14255c1
Inspect any responses
2015-02-24 15:37:38 -08:00
d2bddd6bcd
Parse and print each response (for real. 3rd time's a charm...)
2015-02-24 15:37:38 -08:00
25d85b60f3
Parse and print each response (for real)
2015-02-24 15:37:38 -08:00
0f5aaaf607
Parse and print each response (for now)
2015-02-24 15:37:37 -08:00
9ad0fc38f7
Print something more useful with LLMNR responses
2015-02-24 15:37:37 -08:00
a9a6a564c6
Use LLMNR multicast address for RHOSTS by default
2015-02-24 15:37:37 -08:00
f4a1ce7fb6
Default RHOSTS to 224.0.0.252, the multicast group for LLMNR
2015-02-24 15:37:37 -08:00
7917a70216
Initial commit of some code for LLMNR research
...
This is largely useless right now because LLMNR is only supposed to
work in the same multicast/broadcast domain and implementations are
supposed to ignore requests with an IP TTL != 1.
2015-02-24 15:37:37 -08:00
f3cad229d3
Fix duplicate hash key "References"
...
In modules/auxiliary/scanner/http/http_login.rb.
2015-02-24 05:19:58 -06:00
8c5ff858d0
Land #4812 , hp_sys_mgmt_login configurable URIs
2015-02-23 19:04:14 -06:00
bf103def9e
Add the /ews/ path to enable easy OWA brute force
2015-02-23 14:03:39 -06:00
bcfbcb7eea
Clean up whitespace
2015-02-23 13:15:21 -06:00
ea54696d99
Remove redundant params now provided by the mixin helper
2015-02-22 02:32:28 -06:00
8e8a366889
Pass Http::Client parameters into LoginScanner::Http (see #4803 )
2015-02-22 02:26:15 -06:00
2e58a3d1dd
Update credential reporting mechanism
...
Replace :report_auth_info deprecated method with hooks into the
Metasploit Credential based system.
2015-02-22 02:49:54 -05:00
8ace041a23
TCP option for Lantronix Telnet Password Recovery
...
This commit adds a CHECK_TCP option to the Lantronix password
disclosure module. If set to true, a TCP port will be used to
check for the disclosure instead of the default UDP configuration.
2015-02-21 20:22:18 -05:00
f4e512e0ff
Should be an array
2015-02-20 21:56:49 -06:00
40c237f507
Fix #3982 , allow URIs to be user configurable
...
Fix #3982
2015-02-20 21:54:03 -06:00
ffa6550aec
Land #4787 , HD's new Zabbix and Chef LoginScanners
...
Lands the new LoginScanners HD wrote for Zabbix
and the Chef WebUI
2015-02-18 14:51:16 -06:00
804db0ff0c
add leixcal sorting to methods
...
lexical sort the new methods except for
msf module entrypoint methods which should always be at
the top
2015-02-18 14:50:33 -06:00
35511636cc
Land #4788 , splunk_web_login new version support
2015-02-18 11:54:54 -06:00
cc6899d783
Fix a stack trace on null response, thanks @jlee-r7
2015-02-18 00:38:55 -06:00
f4d8a25981
Add support for newer Splunk versions
2015-02-18 00:30:47 -06:00
2847507f03
Add a chef brute force module
2015-02-17 23:49:57 -06:00
27d5ab45b4
Add a zabbix brute force module
2015-02-17 22:56:08 -06:00
f0e69cb526
Fix two cosmetic typos in the axis/glassfish modules
2015-02-17 21:01:35 -06:00
fb06cb13cc
Land #4774 , Chromecast HTTP scanner
2015-02-17 13:11:25 -06:00
a8108cfc17
Be less stupid in the description
...
[See #4774 ]
2015-02-17 13:04:26 -06:00
14e764ff5a
Move to http subdirectory
...
After all, the wordpress scanners are all HTTP as well, and not under
some platform specific "wordpress" directory. Lots of other HTTP-ish
devices in there as well.
2015-02-17 12:53:18 -06:00
5e07b01a1f
Fix up description a tiny bit
2015-02-17 12:51:55 -06:00
787deb4b23
Change service name to something more appropriate
...
Technically, it's part of DIAL, but we don't want to confuse the user
even more.
2015-02-17 12:41:31 -06:00
e08206d192
Land #4768 , jvazquez-r7 reorganizes the SMB mixins
2015-02-17 10:36:19 -06:00
e16614abb9
Program a bit more defensively
...
Even though /setup/eureka_info should always be JSON...
2015-02-17 05:04:26 -06:00
ea4dd023ae
Add SSID to report_service info
2015-02-17 04:46:11 -06:00
e5d6af6b23
Gather info from /setup/eureka_info
...
Looks better with SSID.
2015-02-17 04:37:16 -06:00
b6f83937ef
Add chromecast_webserver scanner
2015-02-17 03:27:48 -06:00
22664e63ca
Increase default timeout
2015-02-16 19:07:55 +00:00
5fba54db99
Add addtional timing options
2015-02-16 19:07:55 +00:00
0372b08d83
Fix mixin usage on modules
2015-02-13 17:17:59 -06:00
b07ef333e9
Fix java_rmi_server include
2015-02-10 12:52:19 -06:00
1f4fdb5d18
Update from master
2015-02-10 10:47:17 -06:00
0a42ac947a
Land #4737 , fix Socket Context usages
2015-02-09 17:34:03 -06:00
7ee5fd9b32
Fix lotus_domino to use get_cookies correctly.
2015-02-09 17:29:44 -06:00
b1726fd609
Missing comma
2015-02-07 11:56:22 -06:00
8d982e3286
Pass the framework/module down into LoginScanner
2015-02-07 11:50:30 -06:00
c633c710bc
Mostly caps/grammar/spelling, GoodRanking on MBAM
2015-02-05 12:36:47 -06:00
54a5dd69a9
Land #4698 , WP GHOST scanner dead code removal
2015-02-02 16:54:09 -06:00
c8864c93d7
remove unused code
2015-02-02 20:04:10 +01:00
8740fd9015
Convert #find_all_by_X to #where
2015-01-31 21:07:50 -06:00
efd7a8c962
Land #4670 , dns_amp RA flag fix
2015-01-30 14:46:15 -06:00
7504358db3
code style and typos
2015-01-30 15:57:32 +01:00
9ce2dd9815
msftidy
2015-01-30 15:41:11 +01:00
a0eaf2f626
add wordpress ghost scanner module
2015-01-30 15:29:51 +01:00
42ef5716e8
Don't test ra flag to get upward referrals/additional RRs
2015-01-30 02:20:24 +01:00
2c05b1ee50
Use QUERYTYPE instead of hardcode ANY type
2015-01-29 22:54:06 +01:00
bae19405a7
Various grammar, spelling, word choice fixes
2015-01-26 11:00:07 -06:00
f3a2d6663f
Fix #4616 and Fix #3798 - Correctly use OptRegexp
...
This patch fixes a problem with OptRegexp. The OptRegexp class is
always forcing the value to be converted to a string first, which
causes the EXCLUDE option in browser_autopwn to kick in and match
every found autopwn module, so it ignores all of them and you load
nothing (#4616 ).
It is important to understand that nil actually represents an option
not being set, which is a completely different behavior than having
an empty value (technically "" is still a value, and if there's a
value, it means the option is set). We need to watcher for these
scenarios.
I am restoring the #default method to avoid forcing a to_s, which should
fix the browser autopwn loading problem. And then I changed scraper.rb's
default value for datastore option PATTERN to a string, because still
fixes #3798 . The way I see it, #3798 is actually a module-specific issue.
Fix #4616
Fix #3798
2015-01-23 02:38:26 -06:00
a5e14d5869
Use checkcode status text when not obviously vulnerable, more consistent text
2015-01-20 13:55:48 -08:00
14fc8d4cd0
Only allow 401/403/404
2015-01-20 13:36:06 -08:00
d68b62cf21
Make canary value (URI) configurable
2015-01-15 13:12:32 -08:00
2dca18265e
Track and vprint canary value and code
2015-01-15 12:34:53 -08:00
3489ea540e
Make status code checking configurable
2015-01-15 12:22:16 -08:00
4641b02646
Base canary path from TARGET_URI
2015-01-15 12:05:10 -08:00
621cada2ac
Undo build_gc_call_data refactoring
2015-01-14 16:47:28 -06:00
1f6defda73
Use more correct check codes
2015-01-14 13:10:35 -08:00
b7eb4d24aa
Squash another rogue 5009
2015-01-13 10:36:43 -08:00
69f03f5c5d
Move ACPP default port into Rex
2015-01-12 19:43:57 -08:00
01a9fb1483
Spelling
2015-01-12 19:29:41 -08:00
a076a9ab89
report_vuln
2015-01-12 19:23:08 -08:00
d5cdfe73ed
Big style cleanup
2015-01-12 19:11:14 -08:00
9721993b8f
Allow blank password, remote more unused opts, print private
2015-01-12 18:43:54 -08:00
44059a6e34
Disable more unused options
2015-01-12 14:15:40 -08:00
ec506af8ea
Make ACPP login work
2015-01-12 14:01:23 -08:00
e9557ffe58
Simplify module in prep for some authbrute cleanups
2015-01-12 13:08:12 -08:00
97f5cbdf08
Add initial Airport ACPP login scanner
2015-01-12 13:08:12 -08:00
9e76e0b0d8
Simplify. Document. Handle edge cases
...
Simplify detection logic.
Document testing method better
Ensure that body doesn't include canary cookie name too
Use full_uri in prints when possible
2015-01-12 11:40:17 -08:00
d4843f46ed
Make auth checking optional and off by default
2015-01-11 12:15:57 -08:00
9491e4c977
Use send_request_raw; set realistic (and often necessary) Referer
2015-01-11 12:10:40 -08:00
b1ca1cc110
Add back TARGETURI because Exploit::Remote::HttpClient doesn't define one (...)
2015-01-09 13:20:18 -08:00
831ba8b470
Improve (mis)Fortune Cookie (CVE-2014-9222) scanner
2015-01-09 12:58:35 -08:00
ca765e2cc5
Refactor client mixin
2015-01-08 15:46:24 -06:00
3debcef00b
Fix call from aux module
2015-01-08 14:24:27 -06:00
c205ef28d4
Refactor build_gc_call
2015-01-08 14:01:04 -06:00
73e3cd19c3
Convert java_rmi_server aux mod to use new mixin
2015-01-08 00:29:50 -06:00
d59805568e
Do first module refactoring try
2015-01-07 19:06:09 -06:00
8c23e8c2e8
ruby 2.2 compatibility
...
Fix circular argument reference warnings for ruby 2.2
2015-01-07 12:00:50 +02:00
44dfa746eb
Resolve #4513 - Change #inspect to #to_s
...
Resolve #4513
2015-01-05 11:50:51 -06:00
d3050de862
Remove references to Redmine in code
...
See #4400 . This should be all of them, except for, of course, the module
that targets Redmine itself.
Note that this also updates the README.md with more current information
as well.
2014-12-19 17:27:08 -06:00
8d2bd74d31
Add preliminary module to cover 'Misfortune Cookie', CVE-2014-9222
2014-12-18 17:21:26 -08:00
6b0a98b69c
Resolve #4408 - bad uncaught nil get_once
2014-12-17 14:02:42 -06:00
f6af86a06d
Land #4402 , ms12_020_check NilClass fix
2014-12-16 15:34:25 -06:00
2604746fb7
Land #4361 , Kippo detector
2014-12-15 14:54:48 -06:00
8394cc13a8
Perform final cleanup of detect_kippo
2014-12-15 14:38:38 -06:00
c611249723
Take full advantage of the check command
2014-12-15 12:50:59 -06:00
9edb2b4fab
Fix #4378 - Do exception handling
...
Fix #4378
2014-12-15 12:37:36 -06:00
eb47ca593e
update desc to include domain admin information
2014-12-13 13:01:41 -06:00
2e94280cba
mv bmc to scanner/http
2014-12-13 12:58:16 -06:00
8dd5da9d64
added blog post reference
2014-12-12 18:53:26 -08:00
f676b72767
Add Kademlia scanner, lands #4210
2014-12-12 16:40:58 -06:00
338cce02c9
Downcase the service name for consistency
2014-12-12 16:40:42 -06:00
f5374d1552
Added report_service method for database support, added port number in the print_status output, removed arbitrary comments, fixed some spacing. Ready for another review from msf devs
2014-12-12 11:57:35 -08:00
b1f7682713
Make msftidy happy
2014-12-12 12:59:00 -06:00
493034ad10
Land #3305 , @claudijd Cisco SSL VPN Privilege Escalation exploit
2014-12-12 12:57:00 -06:00
0f27c63720
fix msftidy warnings
2014-12-12 13:16:21 +01:00
65b316cd8c
Land #4372
2014-12-11 18:48:16 -08:00
544f75e7be
fix invalid URI scheme, closes #4362
2014-12-11 23:34:10 +01:00
de88908493
code style
2014-12-11 23:30:20 +01:00
47c38ed04e
Merge pull request #4364 from todb-r7/bug/bruteforce-speed-3904
...
Modules should respect bruteforce_speed again
2014-12-11 13:19:42 -06:00
51762e1194
Explicitly include the HTTP Login scanner
...
This should be the last commit that fixes #3904 .
2014-12-11 11:08:08 -06:00
b533f74024
Add a bruteforce_speed option to all LoginScanners
2014-12-11 11:06:32 -06:00
7afa87f168
screwed up formatting. updated indention at the end. ok seriously, going to bed now
2014-12-11 01:05:56 -08:00
291166e1ff
forgot to run through msftidy.rb. made a few minor corrections
2014-12-11 00:47:39 -08:00
a1624c15ae
Addressed some recommendations made by wvu-r7. Need to remove some comments, add reporting, etc.
2014-12-11 00:40:20 -08:00
22c9db5818
added detect_kippo.rb
2014-12-10 19:37:35 -08:00
e89a399f95
Merge remote-tracking branch 'upstream/master' into add_cisco_ssl_vpn_priv_esc
2014-12-09 20:55:01 -05:00
09617f990b
Implement BRUTEFORCE_SPEED respect (telnet)
...
This implements just for telnet, but assuming this strategy is kosher,
it's not too painful to add for the rest of the LoginScanner using the
old defaults used by `AuthBrute`.
See #3904 , @dmaloney-r7 or @jlee-r7
2014-12-09 15:40:43 -06:00
916503390d
use get_data
2014-12-08 22:49:02 +01:00
fb9724e89d
fix heartbleed cert parsing, fix #4309
2014-12-08 21:58:38 +01:00
85e0d72711
Land #4229 , @tatehansen's module for CVE-2014-7992
2014-12-04 17:20:49 -08:00
f0cfcd4faf
Update dlsw_leak_capture name and print_
...
This makes it more obvious exactly what is being scanned for
2014-12-04 17:20:01 -08:00
52851d59c0
Update GATEWAY to GATEWAY_PROBE_HOST, add GATEWAY_PROBE_PORT
2014-12-04 13:26:16 -08:00
6bd56ac225
Update any modules that deregistered NETMASK
2014-12-04 13:22:06 -08:00
3aecd3a10e
added DLSw v1 and v2 check, added check for \x00 in leak segment
2014-12-03 23:27:11 -07:00
3a978e1147
Land #4280 , frontpage_login improvements
2014-12-02 14:56:57 -06:00
0ab2e99419
Delete version from title
2014-12-01 10:24:12 -06:00
f4e20284a4
Change mixin include order
2014-12-01 10:22:20 -06:00
d85aabfed9
Use vprint by default
2014-12-01 10:20:12 -06:00
e0cb0f7966
Fix description
2014-12-01 10:19:14 -06:00
fa07b466d6
Use single quote and minor cosmetic changes
2014-12-01 09:57:29 -06:00
d5888a7f6f
Fix module options
2014-12-01 09:55:36 -06:00
47acf3487d
Do minor cleanup
...
* Prepend peer
* Use print_good when file downloaded
2014-12-01 09:53:00 -06:00
e4b3ee2811
Changed the module name.
2014-12-01 01:00:14 -02:00
ecbce679a8
Remove timeout on line 59.
2014-12-01 00:51:12 -02:00
f3957ea428
FILEPATH changed from false to true.
2014-12-01 00:48:47 -02:00
97ee975235
Deleted checking on line 48.
2014-12-01 00:46:58 -02:00
84ce573227
Deleted line 61 which returns the server status code.
2014-12-01 00:39:05 -02:00
6f6274735f
Update frontpage_login.rb
...
Vhost is now used if specified.
Added X-Vermeer-Content-Type header, which seems to be required for the RPC service otherwise server responds with:
method=
status=
status=262147
osstatus=0
msg=No "CONTENT_TYPE" on CGI environment.
osmsg=
2014-11-28 17:21:47 +00:00
d75ffc36da
Changed the description of FILEPATH
2014-11-27 00:50:34 -02:00
f8dc366f42
Add CVE-2014-7816 Directory Traversal for WildFly 8 Application
2014-11-27 00:13:29 -02:00
79b2b5e231
RPORT is required by UDPScanner; deregister instead
2014-11-26 07:39:14 -08:00
d4e5cd25e1
Report credentials for new login level 15
2014-11-25 16:35:16 -06:00
dc253efa19
Use Rex::Text.rand_text*
2014-11-25 16:35:06 -06:00
f20afff1a8
Do return instead of abort
2014-11-25 16:34:57 -06:00
d876efaa0f
Delete ssh_socket attribute
2014-11-25 16:34:47 -06:00
5091bc76ad
Do minor cleanup
2014-11-25 16:34:22 -06:00
c92a26e967
Update from upstream master
2014-11-25 16:30:45 -06:00
0ed356f71c
Move Kademlia stuff to a more OO model, etc, per reviews
...
All of the work is done in rex. The msf mixin just prevents the
desire to call rex directly from the module
2014-11-24 14:03:43 -08:00
77b1f2d2f0
Fixup for release
...
Fixes the grammar on the SMTP enumeration module and the Cisco CDP
module, and adds a more informative description and reference for the
CDP module introduced on PR #4061 .
2014-11-24 10:50:43 -06:00
e9750e2df8
Minor style/usability cleanups
2014-11-24 06:57:31 -08:00
57419bb0fc
Fix #4253 - Print access level for snmp_login
...
Fix #4253 - module should print the access level
2014-11-22 23:09:15 -06:00
9828598cb7
removing timeout method and option
2014-11-22 00:28:56 -07:00
57b04f96a7
working with DLSw protocol check
2014-11-21 23:54:00 -07:00
b9a274f869
improving DLSw detection
2014-11-21 18:58:02 -07:00
3ac1f7d4fb
Land #4242 , @Meatballs1 fix for sap_service_discovery report_note
...
* I cannot reproduce @Meatballs1 issue
* But I noticed report_note should :update with :unique_data
* Fixed the :update
2014-11-21 10:16:08 -06:00
e30ee9fee2
Update with :unique_data
2014-11-21 10:14:39 -06:00
99a23ada5c
Module cleanup, error handling, and reporting
2014-11-20 16:18:20 -06:00
e255db9429
Partial commit
2014-11-20 13:49:36 -08:00
94e5ba13a4
YARD and spec cleanup
2014-11-20 13:28:01 -08:00
Brandon Perry
wchen-r7
Christian Mehlmauer
Roberto Soares
William Vu
Nate Power
Tod Beardsley
root
Brent Cook
Zach Grace
jvazquez-r7
Denis Kolegov
Meatballs
Sven Vetsch
root
root
aushack
David Maloney
Jon Hart
HD Moore
RageLtMan
Christian Catalan
Guillaume Delacour
dmooray
Andrew Morris
Jonathan Claudius
tate
Tiago Sintra