1113a5e109
Merge pull request #21252 from zeroSteiner/feat/adcs/api-consolidation
...
Feat/adcs/api consolidation
2026-04-13 15:52:55 -05:00
a90ec1071c
Merge pull request #21075 from Chocapikk/avideo-catname-sqli
...
Add AVideo catName blind SQLi credential dump (CVE-2026-28501)
2026-04-09 16:22:45 -05:00
657310042b
Remove extra OID definitions
2026-04-09 10:37:05 -04:00
b7e7de2fa4
Update the specs so they pass again
2026-04-09 10:37:05 -04:00
9cedb4a069
Refactor the method name to namespace it to icpr
2026-04-09 10:37:05 -04:00
4d02f92fab
Consolidate the attribute creation
2026-04-09 10:37:05 -04:00
dac67e6ee6
Update the specs
2026-04-09 10:37:05 -04:00
a0852387fc
Merge pull request #20752 from bwatters-r7/feature/certificate-web-enrollment
...
Add Authenticating Web Enrollment module for AD/CS
2026-04-06 15:27:28 -04:00
06edc3d08f
change minor syntax and raise exception for rsa keylength mismatch
2026-04-06 13:12:47 -05:00
d10341befd
Fixes for different paths to create_csr and build_csr
2026-04-02 16:23:34 -05:00
222e1a28ab
Fix: Address Copilot review feedback on blind extraction and calibration
...
- Widen blind_dump_data bisection range from 0..127 to 0..255 for
binary-safe byte extraction, use Encoding::BINARY for chr output
- Revert read_from_file to positional param (binary = false) to stay
consistent with MSSQL/PostgreSQL implementations
- Add elapsed <= 0 guard and .clamp on calibrated benchmark iterations
- Add unit specs for blind_detect_length and blind_dump_data covering
zero-length, ASCII, long strings, and high bytes (>127)
- Fix rubocop: remove leading blank line, use single-quoted strings
2026-03-26 15:53:51 +01:00
20d795d91e
Fix: Address PR review feedback
...
Module changes (cgranleese-r7):
- Remove VERBOSE from DefaultOptions
- Make COUNT required with default 0
- Simplify COUNT usage since it's now always present
Specs (bwatters-r7):
- Expand mysqli_common_spec.rb with tests for version, current_database,
current_user, enum_database_names, enum_table_names, enum_table_columns,
sleep_call, hex_encode_strings, hex/base64 encoders, time_blind_payload,
and blind_detect_length binary search
- Expand mysqli_time_based_spec.rb with tests for IF/sleep payload
generation, SqliDelay usage, test_vulnerable, and Common inheritance
- Add mysqli_benchmark_based_blind_spec.rb with tests for BENCHMARK
multiplication payload, calibrated iterations, SHA1 seed randomization,
test_vulnerable, and calibrate
2026-03-23 01:58:29 +01:00
09bb0337d1
Merge pull request #20997 from Nayeraneru/OptTD
...
Introduce OptTimedelta
2026-03-17 18:41:42 -04:00
c882d91155
Merge pull request #21025 from Hemang360/cookie-jar-doc-fix
...
Fix HttpCookie integer conversion and cookie jar docs
2026-03-13 00:08:13 +00:00
34cc1a663c
Also remove ms_icpr_spec that had the same tests as the other spec file removed before
2026-03-05 15:44:20 -06:00
4b363017ef
minor change for CI
2026-03-03 06:24:42 +02:00
b2500442fe
Fix cookie jar documentation examples and add test
2026-02-27 15:01:16 +05:30
e6452f5879
hashing adjustment
2026-02-24 03:15:08 +02:00
8fb5e4fcad
Update spec/lib/msf/core/exploit/http/wordpress/version_spec.rb
...
Co-authored-by: msutovsky-r7 <martin_sutovsky@rapid7.com >
2026-02-24 02:52:46 +02:00
d069cba900
Update Wordpress Mixin to log services
2026-02-23 13:31:32 +01:00
ce2e23ccef
add OptTimedelta datastore option and remove Kerberos-specific clock skew parsing
2026-02-20 22:28:05 +02:00
674934d6d9
fixed: entry cache spec
2026-02-06 17:11:09 +05:30
7134f7ab06
added: negative caching for LDAP lookup misses
2026-01-25 10:13:32 +05:30
8342493b3b
Merge branch 'rapid7:master' into feature/kerberos-clock-skew
2025-12-28 23:16:27 +05:30
34ceae4e2c
Add autocheck report_vuln logic
2025-12-22 13:09:32 +00:00
c49a376280
added: Option to adjust kerberos clock (issue-> #20587 )
...
- Added KrbClockSkew advanced option and parser to offset Kerberos timestamps
- Propagate skew through Kerberos client/authenticators (LDAP/SMB/HTTP/WinRM/MSSQL) and scanners
- Updated docs for new option and extended kerberos client specs for clock skew handling
- Clean up kerberos client error handling/style per rubocop
2025-12-08 01:47:51 +05:30
c843e36402
Merge pull request #20469 from adfoster-r7/improve-kerberos-file-load-error-messages
...
Improve Kerberos file load error messages
2025-08-15 12:51:52 +01:00
bebb43f8f6
Improve kerberos file load error messages
2025-08-15 12:38:45 +01:00
f9a804d649
persistence libraries
2025-07-11 17:35:06 -04:00
a93d20ccfe
Add some basic tests
2025-07-08 15:01:54 -04:00
630c2c03bc
Update certs command, pkcs12 matching and specs
...
- use the `status`, certificate's `not_before`/`not_after` and check if the TLS
OID is present to filter pkcs12 before using them with PKInit
- add the `activate`, `deactivate` and `export` capabilities to the
certs command
- add specs
2025-04-02 18:23:14 +02:00
d47ec03ca7
Refactor CMS data structures used in pkinit functionality
2025-03-14 10:42:32 +11:00
7bab1c1980
Fix specs and add algorithm argument
2024-11-18 17:17:58 +01:00
a6fd6defcb
Escape LDAP query strings
2024-06-18 17:47:56 -04:00
7cdea94000
Convert ldap modules to use the new ldap session type
2024-05-15 15:12:51 +01:00
e693b9588c
Update ldap modules to support an ldap session
2024-05-15 15:12:51 +01:00
6d915dbb55
Fix unit tests
2024-04-24 15:54:57 +10:00
48221e594d
Land #18704 , Leverage the module metadata cache in the module_sets
2024-02-02 14:16:46 +00:00
2cf045d3c4
Leverage the module metadata cache in the module_sets
2024-01-15 14:56:46 +00:00
ec8ee2814a
fix spelling in spec folder
2024-01-07 13:42:50 -05:00
9f126a4d24
Land #18446 , Make DomainControllerRhost optional
...
This PR makes the DomainControllerRhosts option optional,
even when auth is set to kerberos. This change requires
rapid7/rex-socket#64 which was released in the rex-socket 1.5.5 gem.
2023-12-05 17:47:45 -05:00
f000c39b4a
Update to mark DomainControllerRhost as optional
2023-12-05 16:23:35 -05:00
2ea1f43f12
Unit test for new kerberos client pre-auth behaviour
2023-11-27 17:10:19 +11:00
6e9facbefb
Merge pull request #18419 from smashery/dcsync_kerberos
...
DCSync using Kerberos Pass-the-Ticket
2023-10-30 09:41:22 -04:00
2a699b89fa
Changes from code review
2023-10-30 12:51:55 +11:00
5087e0ffe3
Land #18197 , Ldap login scanner module
...
Adds a new login scanner module for LDAP
2023-10-02 10:56:56 -04:00
c1a44c8b7f
Land #18359 , Forge ticket fix
2023-09-18 13:05:25 +01:00
483e8175ca
Update unit tests
2023-09-13 14:11:18 +10:00
1af852b240
Add remote ldap specs
2023-09-11 16:33:01 +01:00
235c142274
Merge remote-tracking branch 'origin/flask_unsign' into flask_unsign
2023-09-11 10:27:00 -04:00
Brendan