Scan for OSGi Consoles
Switch branches/tags
Nothing to show
Clone or download
rvrsh3ll Add task done
Latest commit dcc464f Nov 10, 2018
Failed to load latest commit information.
.gitattributes Initial commit Nov 8, 2018
LICENSE Initial commit Nov 8, 2018 Add task done Nov 9, 2018 Update Nov 8, 2018
ShodanResult.png Initial Commit Nov 8, 2018
requirements.txt Initial Commit Nov 8, 2018


OSGiScanner is a simple Python 2.7 tool written to aid Penetration Testers in finding OSGi consoles.

OSGi consoles commonly have the default username and password combination of admin:admin.

Once a Tester has gained access to an OSGi console, they may be able to execute groovy script via the script console or deploy malicous bundle packages.

I've previously documented both attack types:

Leveraging Adobe Live Cycle

Shelling Apache Felix With Java Bundles

To find OSGi consoles, we simply search for the "/system/console" directory. The web request typically requires Basic auth and we can use the fingerprint 'WWW-Authenticate: Basic realm="OSGi Management Console"' to detect such a console.

On Shodan, you can may find these consoles inside your target range by using the basic auth fingerprint as a search term. alt text

Next, execute OSGi scanner against that host or range of hosts to discover more potential targets.

Example usage

python --cidr --port 80 --outfile myscan.log

OR an example using SSL

python --cidr --port 443

OR an example using SSL on different port

python --cidr --port 9443 --ssl