Jboss verb tampering

Hi Friends,
Few days back I attempted verb tampering to bypass authentication in JBoss administrative console.
for example:
1) http://xxx/jmx-console/
2) http://xxx/web-console/
3) http://xxx/admin-console/

Verb tampering refers to the technique, where a attacker uses different HTTP methods ( TRACE, TRACK, PUT, HEAD) other than regular ones (GET, POST) to access a internal page or bypass authentication and visit restricted web-pages.

Setting the context:

JBOSS is a application server mostly used for java web-applications. I am showing how to bypass JBOSS authentication mechanism to access pages which are only accessible after login.

Google Dork:
intitle:”jboss management console” “application server” version inurl:”web-console”

intitle:”JBoss Management Console – Server Information” “application server” inurl:”web-console” OR inurl:”jmx-console”

Google above mentioned strings and some vulnerable websites links show up, which can be potential target of 'JBOSS verb tampering' attack...

Setting remote login / SSH in Backtrack

Here are the steps you need to follow in order to set up SSH in Backtrack.

Step1) Check the status of SSh service and then start SSH service using command

                                      "service ssh status"
                                      "Service ssh start"



Step2)   type "sshd-generate"




It will then generate Public/private RSA Key pair and DSA keys as well.

Step3) Login to the remote machine from where you want to initiate a SSh session and run program "putty"
. Putty is available free here.

Step4) Run the putty and enter the IP address of Backtrack machine.



Click on Open and a login windows would open:



Provide the login name and password and now you can carry out all opeartions in CLI mode remotely.