1. 10 May, 2018 2 commits
  2. 09 May, 2018 4 commits
  3. 08 May, 2018 7 commits
  4. 07 May, 2018 6 commits
  5. 06 May, 2018 5 commits
  6. 03 May, 2018 1 commit
  7. 28 Apr, 2018 1 commit
  8. 27 Feb, 2018 1 commit
  9. 24 Feb, 2018 1 commit
  10. 22 Feb, 2018 1 commit
  11. 05 Feb, 2018 1 commit
  12. 28 Jan, 2018 2 commits
  13. 14 Jan, 2018 2 commits
  14. 14 Nov, 2017 1 commit
  15. 10 Nov, 2017 1 commit
    • Rom-0 exploit - check error (#342) · f8f7d65e
      The HTTP HEAD method in general doesn't return the content of the body, unless it is a redirection page, so line `and len(response.text) > 500:` will never be true if second line of check `response = http_request(method="HEAD", url=url)` get a response.
      
      As result, devices seem no vulnerable when actually it is.
      
      Data:
      ```
      HEAD /rom-0 HTTP/1.1
      Host: 192.168.254.254
      Connection: keep-alive
      Accept-Encoding: gzip, deflate
      Accept: */*
      User-Agent: python-requests/2.18.4
      
      
      HTTP/1.1 200 OK
      Content-Type: application/octet-stream
      Date: Sat, 01 Jan 2000 00:18:54 GMT
      Last-Modified: Wed, 01 Jan 1930 00:18:54 GMT
      Content-Length: 16384
      Server: RomPager/4.07 UPnP/1.0
      EXT:
      ```
      
      My suggestion is just to check whether content type doesn't return "text/html" as value, so it correct this issue and keep the previous false positive fixed.
      
      `and "html" not in response.headers['Content-Type']:`
      or
      `and response.headers['Content-Type'] == "application/octet-stream":
      
      That'is it.
      Alex Hilgert authored
  16. 25 Oct, 2017 3 commits
  17. 24 Oct, 2017 1 commit