HTTP WebDAV Scanner

Detect webservers with WebDAV enabled This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Scanner', 'Description' = 'Detect webservers with WebDAV enabled', 'Author' = 'et', 'License' =...

HTTP WebDAV Internal IP Scanner

Detect webservers internal IPs though WebDAV This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Internal IP Scanner', 'Description' = 'Detect webservers internal IPs though WebDAV',...

HTTP Directory Scanner

This module identifies the existence of interesting directories in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'thread' class MetasploitModule 'HTTP Directory Scanner', 'Description...

HTTP Robots.txt Content Scanner

Detect robots.txt files and analyze its content This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Robots.txt Content Scanner', 'Description' = 'Detect robots.txt files and analyze its...

HTTP Subversion Scanner

Detect subversion directories and files and analyze its content. Only SVN Version 7 supported This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Subversion Scanner', 'Description' = 'Detect...

MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner

This module is based on et's HTTP Directory Scanner module, with one exception. Where authentication is required, it attempts to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS...

HTTP Interesting File Scanner

This module identifies the existence of interesting files in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Interesting File Scanner', 'Description' = %q This modu...

HTTP Previous Directory File Scanner

This module identifies files in the first parent directory with same name as the given directory path. Example: Test /backup/files/ will look for the following files /backup/files.ext . This module requires Metasploit: https://metasploit.com/download Current source:...

HTTP File Extension Scanner

This module identifies the existence of additional files by modifying the extension of an existing file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'pathname' class MetasploitModule 'HTTP File Extension...

HTTP WebDAV Website Content Scanner

Detect webservers disclosing its content though WebDAV This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Website Content Scanner', 'Description' = 'Detect webservers disclosing its...

HTTP Directory Brute Force Scanner

This module identifies the existence of interesting directories by brute forcing the name in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'enumerable' class MetasploitModule 'HTTP...

HTTP Copy File Scanner

This module identifies the existence of possible copies of a specific file in a given path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Copy File Scanner', 'Description' = %q This modu...

HTTP SSL Certificate Checker

This module will check the certificate of the specified web servers to ensure the subject and issuer match the supplied pattern and that the certificate is not expired. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

HTTP Blind XPATH 1.0 Injector

This module exploits blind XPATH 1.0 injections over HTTP GET requests. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Blind XPATH 1.0 Injector', 'Description' = %q This module exploits...

HTTP Verb Authentication Bypass Scanner

This module test for authentication bypass using different HTTP verbs. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Verb Authentication Bypass Scanner', 'Description' = %q This module...

Archive.org Stored Domain URLs

This module pulls and parses the URLs stored by Archive.org for the purpose of replaying during a web assessment. Finding unlinked and old pages. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/http' clas...

Audiotran 1.4.1 (PLS File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in Audiotran 1.4.1. An attacker must send the file to victim and the victim must open the file. Alternatively it may be possible to execute code remotely via an embedded PLS file within a browser, when the PLS extension is registered to Audiotran...

AOL 9.5 Phobos.Playlist Import() Stack-based Buffer Overflow

This module exploits a stack-based buffer overflow within Phobos.dll of AOL 9.5. By setting an overly long value to 'Import', an attacker can overrun a buffer and execute arbitrary code. NOTE: This ActiveX control is NOT marked safe for scripting or initialization. This module requires Metasploit...

NTP Monitor List Scanner

This module identifies NTP servers which permit "monlist" queries and obtains the recent clients list. The monlist feature allows remote attackers to cause a denial of service traffic amplification via spoofed requests. The more clients there are in the list, the greater the amplification. This...

MySQL yaSSL SSL Hello Message Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL 'MySQL yaSSL SSL Hello Message Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL 'MC' ,...

MySQL yaSSL CertDecoder::GetName Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.9.8 and earlier implementation bundled with MySQL. By sending a specially crafted client certificate, an attacker can execute arbitrary code. This vulnerability is present within the CertDecoder::GetName function inside...

MySQL yaSSL SSL Hello Message Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL 'MySQL yaSSL SSL Hello Message Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL 'MC' ,...

DB2 Probe Utility

This module queries a DB2 instance information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DB2 Probe Utility', 'Description' = 'This module queries a DB2 instance information.', 'Author' =...

HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a specially crafted CGI request to ovalarm.exe, an attacker can execute arbitrary code. This specific vulnerability is due to a call to "sprintfnew" in the "isWide" function within "ovalarm.exe". A...

Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow

This module exploits a stack buffer overflow in Oracle. When sending a specially crafted packet containing a long AUTHSESSKEY value to the TNS service, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

SSH Version Scanner

Detect SSH Version, and the server encryption This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'recog' require 'net/ssh/transport/session' class MetasploitModule 'SSH Version Scanner', 'Description' = 'Detect S...

FTP Version Scanner

Detect FTP Version. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FTP Version Scanner', 'Description' = 'Detect FTP Version.', 'Author' = 'hdm', 'License' = MSFLICENSE registeroptions...

Finger Service User Enumerator

Identify valid users through the finger service using a variety of tricks This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Finger Service User Enumerator', 'Description' = 'Identify valid users...

HTTP Version Detection

Display version information about each system. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Version Detection', 'Description' = 'Display version information about each system.', 'Author...

MySQL Server Version Enumeration

Enumerates the version of MySQL servers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MySQL Server Version Enumeration', 'Description' = %q Enumerates the version of MySQL servers. , 'Author...

Telnet Service Banner Detection

Detect telnet services This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Telnet Service Banner Detection', 'Description' = 'Detect telnet services', 'Author' = 'hdm', 'License' = MSFLICENSE...

HP OmniInet.exe MSG_PROTOCOL Buffer Overflow

This module exploits a stack-based buffer overflow in the Hewlett-Packard OmniInet NT Service. By sending a specially crafted MSGPROTOCOL 0x010b packet, a remote attacker may be able to execute arbitrary code with elevated privileges. This service is installed with HP OpenView Data Protector, HP...

HP OmniInet.exe MSG_PROTOCOL Buffer Overflow

This module exploits a stack-based buffer overflow in the Hewlett-Packard OmniInet NT Service. By sending a specially crafted MSGPROTOCOL 0x010b packet, a remote attacker may be able to execute arbitrary code with elevated privileges. This service is installed with HP OpenView Data Protector, HP...

BigAnt Server 2.52 USV Buffer Overflow

This exploits a stack buffer overflow in the BigAnt Messaging Service, part of the BigAnt Server product suite. This module was tested successfully against version 2.52. NOTE: The AntServer service does not restart, you only get one shot. This module requires Metasploit:...

NetTransport Download Manager 2.90.510 Buffer Overflow

This exploits a stack buffer overflow in NetTransport Download Manager, part of the NetXfer suite. This module was tested successfully against version 2.90.510. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption

A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database, and Microsoft Desktop Engine MSDE without the updates supplied in MS09-00...

ARP Sweep Local Network Discovery

Enumerate alive Hosts in local network using ARP requests. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ARP Sweep Local Network Discovery', 'Description' = %q Enumerate alive Hosts in local...

MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow

This module exploits a stack buffer overflow in the NetApi32 NetpManageIPCConnect function using the Workstation service in Windows 2000 SP4 and Windows XP SP2. In order to exploit this vulnerability, you must specify the name of a valid Windows DOMAIN. It may be possible to satisfy this conditio...

Single Static Bit

Static value for specific bit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework NOTE: this encoder currently has only be tested using bit 5 set to on. The decoder has been tested with all possible values, but the decode...

Alt-N SecurityGateway username Buffer Overflow

Alt-N SecurityGateway is prone to a buffer overflow condition. This is due to insufficient bounds checking on the "username" parameter. Successful exploitation could result in code execution with SYSTEM level privileges. NOTE: This service doesn't restart, you'll only get one shot. However, it...

SunRPC Portmap Program Enumerator

This module calls the target portmap service and enumerates all program entries and their running port numbers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SunRPC Portmap Program Enumerator...

Media Jukebox 8.0.400 Buffer Overflow (SEH)

This module exploits a stack buffer overflow in Media Jukebox 8.0.400 by creating a specially crafted m3u or pls file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Media Jukebox 8.0.400 Buff...

MySQL Enumeration Module

This module allows for simple enumeration of MySQL Database Server provided proper credentials to connect remotely. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MySQL Enumeration Module',...

NetBIOS Information Discovery

Discover host information through NetBIOS This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NetBIOS Information Discovery', 'Description' = 'Discover host information through NetBIOS', 'Author' =...

MySQL SQL Generic Query

This module allows for simple SQL statements to be executed against a MySQL instance given the appropriate credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MySQL SQL Generic Query',...

IBM Tivoli Storage Manager Express RCA Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express Remote Client Agent service. By sending a "dicuGetIdentify" request packet containing a long NodeName parameter, an attacker can execute arbitrary code. NOTE: this exploit first connects to the CAD service to...

IBM Tivoli Storage Manager Express CAD Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service. By sending a "ping" packet containing a long string, an attacker can execute arbitrary code. NOTE: the dsmcad.exe service must be in a particular state CadWaitingStatus = 1 in order for the...

IBM Tivoli Storage Manager Express CAD Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service 5.3.3. By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

ProShow Gold v4.0.2549 (PSH File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in ProShow Gold v4.0.2549. An attacker must send the file to victim and the victim must open the file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Sun Java JRE AWT setDiffICM Buffer Overflow

This module exploits a flaw in the setDiffICM function in the Sun JVM. The payload is serialized and passed to the applet via PARAM tags. It must be a native payload. The effected Java versions are JDK and JRE 6 Update 16 and earlier, JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.223 and...