From LOW to PWNED [3] JBoss/Tomcat server-status
来源:互联网 发布:软件测试流程规范化 编辑:程序博客网 时间:2024/06/05 19:11
http://carnal0wnage.attackresearch.com/2012/04/from-low-to-pwned-3-jbosstomcat-server.html
Several (tm) months back I did my talk on "From LOW to PWNED" at hashdays and BSides Atlanta.
The slides were published here and the video from hashdays is here, no video for BSides ATL.
I consistently violate presentation zen and I try to make my slides usable after the talk but I decided to do a few blog posts covering the topics I put in the talk anyway.
Post [3] JBoss/Tomcat server-status
There have been some posts/exploits/modules on hitting up unprotected jboss and tomcat servers.
http://www.nruns.com/_downloads/Whitepaper-Hacking-jBoss-using-a-Browser.pdf
http://carnal0wnage.attackresearch.com/2009/11/hacking-unprotected-jboss-jmx-console.html
http://www.notsosecure.com/folder2/2009/10/27/hacking-jboss-with-jmx-console/
http://goohackle.com/jboss-security-vulnerability-jmx-management-console/
http://www.metasploit.com/modules/exploit/multi/http/jboss_maindeployer
http://www.metasploit.com/modules/exploit/multi/http/tomcat_mgr_deploy
Sometimes even though the deployer functionality is password protected the sever-status may not be.
/web-console/status?full=true
/manager/status/all
LOW?
This can be useful to find:
- Lists of applications
- Recent URL's accessed
- sometimes with sessionids
- Find hidden services/apps
- Enabled servlets
- owned stuff :-)
- From LOW to PWNED [3] JBoss/Tomcat server-status
- From LOW to PWNED [6] SharePoint
- From LOW to PWNED [12] Trace.axd
- From LOW to PWNED [10] Honorable Mention: FCKeditor
- From LOW to PWNED [8] Honorable Mention: Log File Injection
- From LOW to PWNED [11] Honorable Mention: Open NFS
- Could not load project* from super dev mode server when deployed to weblogic/jboss/tomcat?
- How to set jboss.server.log.dir in JBoss
- the status code returned from the server was:500
- The status code returned from the server was: 500
- Beginning JBoss® Seam: From Novice to Professional
- jboss tomcat
- tomcat jboss
- Jboss & Tomcat
- Tomcat和jboss 热部署调试Web应用,不重启Server
- Tomcat和jboss 热部署调试Web应用,不重启Server
- Tomcat移植到JBoss的错误:Unable to initialize TldLocationsCache
- server's jumpping from 193 to 194
- Understanding Ajax vulnerabilities
- constructor的执行顺序
- mutex ----只有等到主进程解锁后,子线程才能运行
- windows 下保存shell文件为可以在Linux下运行的格式
- javascript验证身份证完全方法.
- From LOW to PWNED [3] JBoss/Tomcat server-status
- Xcode 4.3 Three20 安装 320
- Flex创建AIR项目
- Basic drag and drop in WinForms
- 后缀数组
- Q_SIGNALS,Q_SLOTS, Q_EMIT
- 你不明白的压力—选择创业,就是选择生死
- 每一个孩子都是天才,每一个天才都与众不同——《地球上的星星》观后感
- MySQL锁表研究