7858d63036
Typo
2015-07-02 15:34:44 -05:00
43d47ad83e
Port BAPv2 to Auxiliary
2015-07-02 15:29:24 -05:00
6e31b9ef53
Initialize and rename the BES mutex
2015-07-02 15:11:03 -05:00
c5c7de0091
Rework browser profiles, get back to functional mode
2015-07-02 14:58:43 -05:00
c0969d4497
Fix module.uuid references
2015-07-02 13:45:38 -05:00
0e7f610836
Finish browser profile rework in BES
2015-07-02 12:58:21 -05:00
b9a8308138
Replace BAP profiles with a framework-instance hash
2015-07-02 12:53:24 -05:00
e549580ad2
Linux doesn't like the uppercase
2015-06-18 00:40:47 -05:00
188b15b17f
Fix the symbol vs string prob
2015-06-05 16:18:56 -05:00
ecdeeea5c6
Make sure super is called
2015-06-05 11:11:40 -05:00
7f4b51f0ff
Fix nil bug
2015-05-23 02:08:51 -05:00
60b0be8e3f
Fix a lot of bugs
2015-05-23 01:59:29 -05:00
2d310a473b
Do some documentation
2015-05-14 23:32:11 -05:00
a2ebfe2bf8
Make parse_rank a little bit smarter
2015-05-13 18:05:10 -05:00
a7e265b07e
Proper cleanup for notes
2015-05-13 13:46:06 -05:00
2e2b536e8f
Update
2015-05-08 00:28:46 -05:00
35f564d03e
I just shaved off 8 seconds, oh yeah
2015-04-30 00:32:33 -05:00
62e3f5e56a
Small cleanup
2015-04-29 23:15:56 -05:00
a34531ba5d
Msgpack cannot handle symbols, so we're forced to strings
2015-04-29 23:14:52 -05:00
ca32db3e23
Merge branch 'upstream-master' into BAPv2
2015-04-29 18:53:37 -05:00
f3e026db6c
Profile sharing works for the first time
2015-04-29 18:45:08 -05:00
c18c5c7b6e
Actually take apart profiling?
2015-04-29 11:06:00 -05:00
943fc18092
Take apart browser profiling
2015-04-29 11:04:54 -05:00
9cebe769c2
Change plan
2015-04-29 01:29:24 -05:00
39663a7e18
Some progress
2015-04-29 01:19:39 -05:00
4224008709
Delete print_debug/vprint_debug
2015-04-21 11:14:03 -05:00
51dd88114b
Fix grammer in comments
2015-04-13 13:21:41 +05:00
8f03cadb92
Forgot to remove print_debug
2015-03-25 16:08:47 -05:00
3c4da5c3ff
Update BES rspec
2015-03-24 00:10:18 -05:00
2900f57afd
It looks like this works
2015-03-23 16:46:53 -05:00
e520ace1f1
Stash
2015-03-23 14:21:46 -05:00
156520338d
Making some changes to how BES handles ActiveX
2015-03-23 12:21:27 -05:00
f3494d9019
Correct grammar in BES
2015-03-07 16:04:06 -06:00
8ce1db5081
Fix #4783 , raise exception if the payload arch is incompatible
...
Fix #4783
2015-02-17 21:47:17 -06:00
457598eb02
print_error about unknown request.uri
2015-01-27 20:21:18 -06:00
acf02647fb
Add a check for Custom404
2015-01-27 20:18:10 -06:00
66703bfe5a
Allow custom 404 as an option for BrowserExploitServer
...
When something fails, the target is given a hardcoded 404 message
generated by the framework. But the user (attacker) now can configure
this. When the Custom404 option is set, the mixin will actually
redirect (302) to that URL.
There are several scenarios that can trigger a 404 by BES (custom or
default):
* When the browser doesn't allow javascript
* When the browser directly visits the exploit URL, which is forbidden.
If this actually happens, it probably means the attacker gave the
wrong URL.
* The attacker doesn't allow the browser auto-recovery to retry the
URL.
* If some browser requirements aren't met.
* The browser attempts to go to access a resource not set up by the
mixin.
2015-01-27 18:53:02 -06:00
ee922d141c
Fix #4646 - get_module_resource should check nil before using get_resource
...
Fix #4646 . The get_module_resource needs to check nil first before
using the get_resource method (from HttpServer)
2015-01-27 00:21:43 -06:00
e974d272f0
Remove stray line comment that ruined things when minified.
2014-12-23 00:22:50 -06:00
9202c4f2a1
No mercy for os_flavor
2014-12-10 11:46:21 -06:00
a584a5982f
Clarify about how BES uses os_flavor
...
We don't. We don't use os_flavor anymore because it is no longer
implemented. We get the information from os_name instead.
2014-12-09 12:21:59 -06:00
a65ee6cf30
Land #3373 , recog
...
Conflicts:
Gemfile
Gemfile.lock
data/js/detect/os.js
lib/msf/core/exploit/remote/browser_exploit_server.rb
modules/exploits/android/browser/webview_addjavascriptinterface.rb
2014-10-03 18:05:58 -05:00
6571213f1c
Remove un-truthy doc string.
2014-10-01 23:41:02 -05:00
5a8eca8946
Adds a :vuln_test option to BES, just like in BAP.
...
I needed this to run a custom JS check for the Android
webview vuln when the exploit is served straight
through BES. The check already existed when using BAP,
so I tried to preserve that syntax, and also added a
:vuln_test_error as an optional error message.
This commit also does some mild refactoring of un-
useful behavior in BES.
2014-10-01 23:34:31 -05:00
5cb016c1b1
Use Match constant in BES as well
2014-10-01 16:17:13 -05:00
b96a7ed1d0
Install a global object in firefox payloads, bump jsobfu.
2014-09-24 16:05:00 -05:00
d9e6f2896f
Add the JSObfu mixin to a lot of places.
2014-09-21 23:45:59 -05:00
e1cfc74c32
Move jsobfu to a mixin
2014-09-21 00:39:04 -05:00
cd037466a6
upate doc
2014-09-20 23:40:47 -05:00
9191af6241
Update js_obfuscate
2014-09-20 23:38:35 -05:00
HD Moore