Map

Thursday, 7 April 2016

Jboss verb tampering


Hi Friends,
Few days back I attempted verb tampering to bypass authentication in JBoss administrative console.
for example:
1) http://xxx/jmx-console/
2) http://xxx/web-console/
3) http://xxx/admin-console/

Verb tampering refers to the technique, where a attacker uses different HTTP methods ( TRACE, TRACK, PUT, HEAD) other than regular ones (GET, POST) to access a internal page or bypass authentication and visit restricted web-pages.

Setting the context:

JBOSS is a application server mostly used for java web-applications. I am showing how to bypass JBOSS authentication mechanism to access pages which are only accessible after login.

Google Dork:
intitle:”jboss management console” “application server” version inurl:”web-console”

intitle:”JBoss Management Console – Server Information” “application server” inurl:”web-console” OR inurl:”jmx-console”

Google above mentioned strings and some vulnerable websites links show up, which can be potential target of 'JBOSS verb tampering' attack...

No comments:

Post a Comment