Add new spring4shell module to detect Spring4Shell #275
Conversation
Codecov Report
@@ Coverage Diff @@
## master #275 +/- ##
==========================================
- Coverage 73.74% 73.49% -0.25%
==========================================
Files 85 87 +2
Lines 8637 8703 +66
==========================================
+ Hits 6369 6396 +27
- Misses 2268 2307 +39
Continue to review full report at Codecov.
|
wapitiCore/attack/mod_spring.py
Outdated
| logging.info(spring4shell_file_request) | ||
|
|
||
| # need to wait again and then we can check if file was created | ||
| await asyncio.sleep(10) |
There was a problem hiding this comment.
Oulah :)
Si je comprends bien, ça fait que chaque tentative de requête génère une attente fixe de 10s ?
Si oui, ça fait cette tentative sur toutes les pages de l'appli ciblée ? Ou juste la racine ?
There was a problem hiding this comment.
partout oui... si le payload fonctionne, il y a plusieurs secondes à attendre avant que le fichier soit accessible.. mais si ça fonctionne une fois on termine le module
bretfourbe
force-pushed
the
spring
branch
2 times, most recently
from
0f2f881
to
e38067c
Compare
| logging.info(spring4shell_file_request) | ||
|
|
||
| # need to wait again and then we can check if file was created | ||
| await asyncio.sleep(10) |
There was a problem hiding this comment.
J'ai regardé et apparemment les autres scripts d'attaque mettent aussi un timer à genre 12 secondes :(.
| ) | ||
|
|
||
| # need to wait here and make a first request | ||
| await asyncio.sleep(10) |
bretfourbe
changed the title
|
@bretfourbe : il faudra refactorer le tout pour passer à ton approche non intrusive, via des paramètres en Query Parameters |
|
@its0x08 I think the PR is "dangerous" as is based on the 10s delay imposed :) Let's wait for refactoring to review it again? |
|
Ok |
New module to detect Spring4Shell
