respect ssl_version in crawler
#16353
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When utilizing `Anemone` to crawl pages using `Rex` sockets Framework common `SSL` settings can pull from standardized options. This change enables more fine grained user control and avoids issues with missing or deprecated SSL versions in newer Ruby versions.
its0x08
approved these changes
Mar 17, 2022
jmartin-tech
force-pushed
the
http-use-ssl-version
branch
from
31c1434
to
9f8c6b1
Compare
jmartin-tech
force-pushed
the
http-use-ssl-version
branch
from
9f8c6b1
to
ebaf584
Compare
gwillcox-r7
reviewed
Mar 21, 2022
| @@ -110,7 +110,7 @@ def connect | |||
| opts[:target].port, | |||
| {}, | |||
| opts[:target].ssl, | |||
| 'SSLv23', | |||
| 'Auto', | |||
There was a problem hiding this comment.
Any reason this is not @opts[:ssl_version] like in lib/anemone/rex_http.rb?
There was a problem hiding this comment.
Notice this object expects opts[:target] to contain the targeting details, lib/msf/core/auxiliary/web/target.rb does not have an ssl_version method to access, by using Auto this provide the most compatibility with whatever OpenSSL version Ruby provides.
There was a problem hiding this comment.
Makes sense to me, considering this resolved, though we probably aught to come back to this at some point and look at how we can make this fall in line with the ssl_version standard code other modules and libraries are using. I'll leave this open for passerby's in case we do decide to make a run through this at some point, might be easier for them to find this when searching for code cases.
For those interested, @jmartin-r7 also noted that Auxiliary::Web::Target is not actually used in the framework directly and is actually used in Pro code which might be part of the reason for this discrepancy.
|
Before patch: |
|
After patch: Seems to be working well :) |
Release NotesA bug has been fixed in the Anemone library and in the HTTP crawler libraries and related module to allow pulling and setting of |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When utilizing
Anemoneto crawl pages usingRexsocketsFramework common
SSLsettings can pull from standardized options.This change enables more fine grained user control and avoids issues
with missing or deprecated SSL versions in newer Ruby versions.
Prior to this change SSL attempts fail on Ruby 3:
This is due to an error that is no noted or logged:
Verification
List the steps needed to make sure this thing works
msfconsoleuse http/crawlerset RHOST <known http IP or hostname>such ashttp.comset RPORT <known http port>typically80set SSL trueset RHOST <known https IP or hostname>such asmetasploit.comset RPORT <known https port>typically443