- 09 May, 2018 4 commits
-
-
Marcin Bury authored
-
Marcin Bury authored
-
Marcin Bury authored
-
Martino Lessio authored
-
- 08 May, 2018 7 commits
-
-
lucyoa authored
-
lucyoa authored
-
lucyoa authored
-
lucyoa authored
-
lucyoa authored
-
* Adding travis * Fixing .travis.yml
Marcin Bury authored -
Marcin Bury authored
-
- 07 May, 2018 6 commits
-
-
Marcin Bury authored
-
Marcin Bury authored
-
Marcin Bury authored
-
Marcin Bury authored
-
Marcin Bury authored
-
DIR-300 B1 with firmware 2.02 may have '\nuser' after admin password.
Maccheroni authored
-
- 06 May, 2018 5 commits
-
-
Marcin Bury authored
-
Marcin Bury authored
-
Marcin Bury authored
-
Marcin Bury authored
-
* Bump v3.0.0 * Adding Slack invitation link
Marcin Bury authored
-
- 03 May, 2018 1 commit
-
-
lucyoa authored
-
- 28 Apr, 2018 1 commit
-
-
Marcin Bury authored
-
- 27 Feb, 2018 1 commit
-
-
Introduce `Exploit.validate_setup` method in order to check whether Exploit's setup is correct. In most case scanarios we will check if `Exploit.target` is not `None`. When exploit need custom validation logic please overwrite `validate_setup`.
Mariusz Kupidura authored
-
- 24 Feb, 2018 1 commit
-
-
Mariusz Kupidura authored
-
- 22 Feb, 2018 1 commit
-
-
Mariusz Kupidura authored
-
- 05 Feb, 2018 1 commit
-
-
LGTM
Mariusz Kupidura authored
-
- 28 Jan, 2018 2 commits
-
-
CentOS installation instructions were not complete
Pablo Hinojosa authored -
Add juniper defaults
Alexey Mozzhakov authored
-
- 14 Jan, 2018 2 commits
- 14 Nov, 2017 1 commit
-
-
* Router detected as vulnerable while its not #305 * Fixed typo error * Check status code instead of string
Alex Hilgert authored
-
- 10 Nov, 2017 1 commit
-
-
The HTTP HEAD method in general doesn't return the content of the body, unless it is a redirection page, so line `and len(response.text) > 500:` will never be true if second line of check `response = http_request(method="HEAD", url=url)` get a response. As result, devices seem no vulnerable when actually it is. Data: ``` HEAD /rom-0 HTTP/1.1 Host: 192.168.254.254 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: */* User-Agent: python-requests/2.18.4 HTTP/1.1 200 OK Content-Type: application/octet-stream Date: Sat, 01 Jan 2000 00:18:54 GMT Last-Modified: Wed, 01 Jan 1930 00:18:54 GMT Content-Length: 16384 Server: RomPager/4.07 UPnP/1.0 EXT: ``` My suggestion is just to check whether content type doesn't return "text/html" as value, so it correct this issue and keep the previous false positive fixed. `and "html" not in response.headers['Content-Type']:` or `and response.headers['Content-Type'] == "application/octet-stream": That'is it.
Alex Hilgert authored
-
- 25 Oct, 2017 3 commits
-
-
lucyoa authored
-
* Create multi_hedwig_cgi_exec.py * update to proper format * remove whitespace * remove u
Austin authored -
* Fixing payloads * Pep fixes
Marcin Bury authored
-
- 24 Oct, 2017 1 commit
-
-
fwkz authored
-
- 23 Oct, 2017 1 commit
-
-
* Adding timeouts * Adding exceptions * Fixing E741
Marcin Bury authored
-
- 21 Oct, 2017 1 commit
-
-
* Move tests to tests/ directory * Remove unused `tox.ini` file * Add flake8 compliance * Add `lint` target to `tests` target in the Makefile
Mariusz Kupidura authored
-