Scan for OSGi Consoles
Switch branches/tags
Nothing to show
Clone or download
rvrsh3ll
rvrsh3ll Add task done
Latest commit dcc464f Nov 10, 2018
Permalink
Failed to load latest commit information.
.gitattributes Initial commit Nov 8, 2018
LICENSE Initial commit Nov 8, 2018
OSGiScanner.py Add task done Nov 9, 2018
README.md Update README.md Nov 8, 2018
ShodanResult.png Initial Commit Nov 8, 2018
requirements.txt Initial Commit Nov 8, 2018

README.md

OSGiScanner

OSGiScanner is a simple Python 2.7 tool written to aid Penetration Testers in finding OSGi consoles.

OSGi consoles commonly have the default username and password combination of admin:admin.

Once a Tester has gained access to an OSGi console, they may be able to execute groovy script via the script console or deploy malicous bundle packages.

I've previously documented both attack types:

Leveraging Adobe Live Cycle

Shelling Apache Felix With Java Bundles

To find OSGi consoles, we simply search for the "/system/console" directory. The web request typically requires Basic auth and we can use the fingerprint 'WWW-Authenticate: Basic realm="OSGi Management Console"' to detect such a console.

On Shodan, you can may find these consoles inside your target range by using the basic auth fingerprint as a search term. alt text

Next, execute OSGi scanner against that host or range of hosts to discover more potential targets.

Example usage

python OSGiScanner.py --cidr 10.10.1.0/24 --port 80 --outfile myscan.log

OR an example using SSL

python OSGiScanner.py --cidr 10.10.1.0/24 --port 443

OR an example using SSL on different port

python OSGiScanner.py --cidr 10.10.1.0/24 --port 9443 --ssl