Comments (5)
What version of Tomcat did you install? I think I've only tested against older versions like 5.5.
I like the idea of adding making the body a list instead of a string. It should be straight forward to change in in the schema.py, mkcred.py and then in the check_success method.
I'd be fine with not making the body text required as long as any supplied success criteria is "required" for that credential. So if you supplied both body and status, then we'd need to check both. So in your tomcat example, status and one of the body strings would need to match. But if you had a success like the code below, it would only check the status.
success:
status: 200
How does that sound?
from changeme.
Yes I agree, if you add these two criteria, it has to check both.
I will try to do it soon and push you a pull request.
For the tomcat version, I have installed this one: 6.0.48.
from changeme.
Want to add the body string that matches your install of Tomcat?
from changeme.
Thanks for merging my pull request.
I think to avoid false positive, it's better to match only the reponse code 200 without matching strings. If you prefer to match strings, you can add it, but more tests with other instances has to be done. For me, the response code is sufficient.
I let you close this issue if you agree.
from changeme.
@AlessandroZ can you verify this bug is fixed with the master branch?
from changeme.
Related Issues (20)
- paramiko.ssh_exception.SSHException: Error reading SSH protocol banner
- Problem with lxml
- Not working
- Selenium PhantomJS driver is deprecated HOT 2
- User agent header evaluation order corner case HOT 1
- Did n't find tomcat credentials HOT 9
- Error Cannot Allocate Memory HOT 5
- Issue while adding default credential detection for Aruba's ClearPass HOT 6
- delete this HOT 1
- --shodan_query flag use cases HOT 1
- Option to disable screenshots
- Option to stop bruteforcing after at least one valid creds pair for each target was found HOT 3
- stucks on big input file HOT 4
- add to ssh.yml new crediantial , but, ssh credential not found HOT 2
- Adding RabbitMQ scanning capability HOT 1
- no module named cerberus HOT 1
- ImportError: No module named cerberus HOT 3
- Docker image is out of date
- Add custom ports to specific services
- pyodbc ... error HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from changeme.