Apache Axis Detection (HTTP)
🗓️ 06 Apr 2016 00:00:00Reported by Copyright (C) 2016 SCHUTZWERK GmbHType 
openvas🔗 plugins.openvas.org👁 125 Views
| Source | Link |
|---|---|
| axis | www.axis.apache.org/axis/ |
# SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH
# SPDX-FileCopyrightText: Reworked detection methods / pattern / code since 2016 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.111093");
script_version("2026-04-17T15:51:27+0000");
script_tag(name:"last_modification", value:"2026-04-17 15:51:27 +0000 (Fri, 17 Apr 2026)");
script_tag(name:"creation_date", value:"2016-04-06 07:12:12 +0200 (Wed, 06 Apr 2016)");
script_tag(name:"cvss_base", value:"0.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:N");
script_tag(name:"qod_type", value:"remote_banner");
script_name("Apache Axis Detection (HTTP)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2016 SCHUTZWERK GmbH");
script_family("Product detection");
script_dependencies("find_service.nasl", "no404.nasl", "webmirror.nasl", "DDI_Directory_Scanner.nasl", "global_settings.nasl");
script_exclude_keys("Settings/disable_cgi_scanning");
script_require_ports("Services/www", 8080);
script_tag(name:"summary", value:"HTTP based detection of the Apache Axis SOAP stack.");
script_xref(name:"URL", value:"https://axis.apache.org/axis/");
exit(0);
}
include("cpe.inc");
include("host_details.inc");
include("http_func.inc");
include("http_keepalive.inc");
include("list_array_func.inc");
include("port_service_func.inc");
port = http_get_port( default:8080 );
host = http_host_name( dont_add_port:TRUE );
foreach dir( make_list_unique(
"/axis", # Standard one
"/imcws", # SAP Business Objects 12 and/or 3com IMC (See CVE-2010-2103)
"/WebServiceImpl", # Computer Associates ARCserve D2D r15 Web Service (See CVE-2010-0219 / https://www.exploit-db.com/exploits/15869)
"/dswsbobje", # SAP BusinessObjects Enterprise XI 3.2 (See CVE-2010-0219)
"/BusinessProcessBI", # SAP BusinessObjects as well
"/ws", # Currently unknown
"/MicroStrategyWS", # Microstrategy Web 10.4 (See CVE-2020-11450)
"/Api", # VMware Smarts NCM
"/jboss-net", # JBoss.net Axis integration
"/tomcat", # Both for Tomcat, seen "in the wild"
"/tomcat/axis",
"/wssgs", # Both for JBuilder Apache Axis
"/tresearch",
"/infranetwebsvc", # Both for Oracle Communications Billing and Revenue Management Web Services Manager from:
"/BrmWebServices", # https://docs.oracle.com/cd/E16754_01/doc.75/e16724/wsm_deploy.htm
http_cgi_dirs( port:port, host:host ) ) ) {
found = FALSE;
install = dir;
if( dir == "/" )
dir = "";
if( dir == "/services" )
continue; # This would create a duplicated detection at / and /services
# nb: Version service
url = dir + "/services/Version?method=getVersion";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
# nb: Second check just to be safe
url2 = dir + "/services/non-existent";
req2 = http_get( item:url2, port:port );
buf2 = http_keepalive_send_recv( port:port, data:req2 );
# nb: Index page
url3 = dir + "/index.jsp";
buf3 = http_get_cache( item:url3, port:port );
# nb: Second index page as sometimes other services / URLs are not available or blocked
url4 = dir + "/";
buf4 = http_get_cache( item:url4, port:port );
if( "<h2>AXIS error</h2>" >< buf2 || "No service is available at this URL" >< buf2 ||
"<h1>Axis HTTP Servlet</h1>" >< buf2 ) {
conclUrl = " " + http_report_vuln_url( url:url2, port:port, url_only:TRUE );
found = TRUE;
}
if( "Apache Axis version:" >< buf ||
"The AXIS engine could not find a target service to invoke!" >< buf ||
"<h1>Axis HTTP Servlet</h1>" >< buf ) {
if( conclUrl )
conclUrl += '\n';
conclUrl += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE );
found = TRUE;
}
# <title>Apache-Axis</title>
# *snip*
# <h1 align="center">Apache-AXIS</h1>
#
# <p>Hello! <em>Welcome</em> to Apache-Axis.</p>
#
# <p>What do you want to do today?</p>
#
# or (in multiple lines and with tabs):
#
# <h1 align="center">Apache-AXIS</h1>
#
# <p>
# Hello! <em>Welcome</em> to Apache-Axis.
# </p>
#
# <p>What do you want to do today?</p>
#
# and in one example one line of the above was just (all others were the same):
#
# Hello! Welcome to Apache-Axis.<p/>What do you want to do today?
#
# And this one was from a jboss-net installation:
# <title>Apache-Axis (JBoss.net)</title>
# *snip*
# <h1 align="center"><img src="images/jboss-net.png" alt="JBoss.net"/><img src="images/axis.jpg" alt="Apache Axis"/></h1>
#
# <p>Hello! <em>Welcome</em> to JBoss.net (Apache-Axis).</p>
#
# <p>What do you want to do today?</p>
#
if( "<title>Apache-Axis</title>" >< buf3 || "Apache-AXIS</h1>" >< buf3 ||
"<title>Apache-Axis (JBoss.net)</title>" >< buf3 ||
buf3 =~ "Hello!.+Welcome.+to (Apache-Axis|JBoss\.net \(Apache-Axis\))\..+What do you want to do today\?" ) {
if( conclUrl )
conclUrl += '\n';
conclUrl += " " + http_report_vuln_url( url:url3, port:port, url_only:TRUE );
found = TRUE;
}
if( "<title>Apache-Axis</title>" >< buf4 || "Apache-AXIS</h1>" >< buf4 ||
"<title>Apache-Axis (JBoss.net)</title>" >< buf4 ||
buf4 =~ "Hello!.+Welcome.+to (Apache-Axis|JBoss\.net \(Apache-Axis\))\..+What do you want to do today\?" ) {
if( conclUrl )
conclUrl += '\n';
conclUrl += " " + http_report_vuln_url( url:url4, port:port, url_only:TRUE );
found = TRUE;
}
if( found ) {
version = "unknown";
# All are over two lines, the first was in a single line while the second had additional
# content in front:
# <getVersionReturn xsi:type="xsd:string">Apache Axis version: 1.0
# Built on Nov 06, 2002 (07:19:53 PST)</getVersionReturn>
#
# *snip*http://schemas.xmlsoap.org/soap/encoding/"><getVersionReturn xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">Apache Axis version: 1.4
# Built on Apr 22, 2006 (06:55:48 PDT)</getVersionReturn>
#
# and this one was from a jboss-net installation:
# <getVersionResponse xsi:type="xsd:string">Apache Axis version: #axisVersion#
# Built on #today#</getVersionResponse>
ver = eregmatch( string:buf, pattern:"Apache Axis version: ([0-9.]+)" );
if( ! isnull( ver[1] ) ) {
version = ver[1];
if( url >!< conclUrl ) {
if( conclUrl )
conclUrl += '\n';
conclUrl += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE );
}
}
url = dir + "/servlet/AxisServlet";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
if( "<h2>And now... Some Services</h2>" >< buf ) {
extra += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE ) + ' lists available web services\n';
}
# Second try to get exposed web services
url = dir + "/services";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
if( "<h2>And now... Some Services</h2>" >< buf ) {
extra += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE ) + ' lists available web services\n';
}
url = dir + "/happyaxis.jsp";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
if( "<title>Axis Happiness Page</title>" >< buf || "Examining webapp configuration" >< buf ) {
extra += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE ) + ' exposes the system configuration\n';
set_kb_item( name:"apache/axis/happiness_page/detected", value:TRUE );
set_kb_item( name:"apache/axis/happiness_page/http/detected", value:TRUE );
set_kb_item( name:"apache/axis/happiness_page/http/" + host + "/" + port + "/urls", value:url );
}
url = dir + "/services/AdminService?wsdl";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
if( "AdminServiceResponse" >< buf || "AdminServiceRequest" >< buf ) {
extra += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE ) + ' exposes the AdminService\n';
# If version wasn't identified yet try to get it from this service
if( version == "unknown" ) {
ver = eregmatch( string:buf, pattern:"Apache Axis version: ([0-9.]+)" );
if( ! isnull( ver[1] ) ) {
version = ver[1];
if( conclUrl )
conclUrl += '\n';
conclUrl += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE );
}
}
}
url = dir + "/EchoHeaders.jws?wsdl";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
if( "whoamiResponse" >< buf || "echoResponse" >< buf ) {
extra += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE ) + ' exposes the EchoHeaders default webservice\n';
# If version wasn't identified yet try to get it from this service
if( version == "unknown" ) {
ver = eregmatch( string:buf, pattern:"Apache Axis version: ([0-9.]+)" );
if( ! isnull( ver[1] ) ) {
version = ver[1];
if( conclUrl )
conclUrl += '\n';
conclUrl += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE );
}
}
}
url = dir + "/SOAPMonitor";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
if( "SOAPMonitorApplet.class" >< buf ) {
extra += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE ) + ' exposes the SOAPMonitor Page\n';
}
url = dir + "/servlet/AdminServlet";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
if( "<title>Axis</title>" >< buf || "Server is running" >< buf ) {
extra += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE ) + ' exposes the AdminServlet\n';
}
url = dir + "/servlet/MyServlet";
req = http_get( item:url, port:port );
buf = http_keepalive_send_recv( port:port, data:req );
if( "<title>Axis</title>" >< buf || "Server is running" >< buf ) {
extra += " " + http_report_vuln_url( url:url, port:port, url_only:TRUE ) + ' exposes the MyServlet\n';
}
set_kb_item( name:"apache/axis/detected", value:TRUE );
set_kb_item( name:"apache/axis/http/detected", value:TRUE );
cpe = build_cpe( value:version, exp:"([0-9.]+)", base:"cpe:/a:apache:axis:" );
if( ! cpe )
cpe = "cpe:/a:apache:axis";
register_product( cpe:cpe, location:install, port:port, service:"www" );
log_message( data:build_detection_report( app:"Apache Axis",
version:version,
install:install,
cpe:cpe,
concluded:ver[0],
concludedUrl:conclUrl,
extra:chomp( extra ) ),
port:port );
}
}
exit( 0 );
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Apr 2026 00:00Current
7.2High risk
Vulners AI Score7.2