+ Reply to Thread
Results 1 to 9 of 9

Thread: JBoss Default Authentication Share/Save - My123World.Com!

  1. 12-29-2010, 06:23 PM #1
    d4rkd4wn
    d4rkd4wn is offline
    Garage Member d4rkd4wn is on a distinguished road
    Join Date
    Aug 2010
    Location
    Mumbai
    Posts
    50
    Thanks
    46
    Thanked 15 Times in 6 Posts

    Lightbulb JBoss Default Authentication



    I was working on one application and found an interesting Google query while looking for exploitation technique, may be this is not new for you.
    The default configuration of JBoss does not restrict access to the console and web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.

    There you get thousand results..Click on any of the links
    and you will gain access to the backend application

    http://www.google.com.au/search?q=inurl:inspectMBean
    Reply With Quote Reply With Quote

  2. The Following 7 Users Say Thank You to d4rkd4wn For This Useful Post:

    "vinnu" (12-31-2010), abhaythehero (12-29-2010), AnArKI (12-30-2010), b0nd (12-30-2010), fb1h2s (12-31-2010), H@CK3R_ADI (08-29-2012), prashant_uniyal (12-29-2010)
  3. 12-29-2010, 09:13 PM #2
    prashant_uniyal
    prashant_uniyal is offline
    Security Analyst prashant_uniyal has a spectacular aura aboutprashant_uniyal has a spectacular aura about prashant_uniyal's Avatar
    Join Date
    Jul 2010
    Location
    localhost
    Posts
    498
    Blog Entries
    8
    Thanks
    248
    Thanked 104 Times in 55 Posts
    Awesome find bro
    The three great essentials to achieve anything worth while are: Hard work, Stick-to-itiveness, and Common sense. - Thomas A. Edison
    __________________________________________________ _____________________

    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    Reply With Quote Reply With Quote
  4. 12-30-2010, 12:44 AM #3
    ajaysinghnegi
    ajaysinghnegi is offline
    Garage Member ajaysinghnegi will become famous soon enough
    Join Date
    Jul 2010
    Location
    Universe
    Posts
    179
    Blog Entries
    1
    Thanks
    22
    Thanked 21 Times in 11 Posts
    Send a message via MSN to ajaysinghnegi Send a message via Yahoo to ajaysinghnegi
    great research bro
    Using No Way As Way Having No Limitation As Limitation.
    ____________________________________________

    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    Reply With Quote Reply With Quote
  5. 12-30-2010, 10:14 AM #4
    "vinnu"
    "vinnu" is offline
    Security Researcher "vinnu" is a jewel in the rough"vinnu" is a jewel in the rough"vinnu" is a jewel in the rough "vinnu"'s Avatar
    Join Date
    Jul 2010
    Posts
    244
    Blog Entries
    2
    Thanks
    178
    Thanked 140 Times in 72 Posts
    Similarly this will also help:

    inurl:jmx-console/HtmlAdaptor
    Reply With Quote Reply With Quote
  6. 12-30-2010, 01:56 PM #5
    "vinnu"
    "vinnu" is offline
    Security Researcher "vinnu" is a jewel in the rough"vinnu" is a jewel in the rough"vinnu" is a jewel in the rough "vinnu"'s Avatar
    Join Date
    Jul 2010
    Posts
    244
    Blog Entries
    2
    Thanks
    178
    Thanked 140 Times in 72 Posts
    JBOSS also has persistent XSS
    For examples check the following:

    http://app.airtel.in/jmx-console//Ht...loymentScanner
    Reply With Quote Reply With Quote

  7. The Following 4 Users Say Thank You to "vinnu" For This Useful Post:

    abhaythehero (12-30-2010), ajaysinghnegi (01-01-2011), d4rkd4wn (12-30-2010), [s] (12-30-2010)
  8. 12-30-2010, 05:03 PM #6
    [s]
    [s] is offline
    Security Researcher [s] will become famous soon enough [s]'s Avatar
    Join Date
    Nov 2010
    Posts
    187
    Blog Entries
    2
    Thanks
    62
    Thanked 53 Times in 30 Posts
    another APache TOMCAT Dork
    Code:
    http://www.google.com/#sclient=psy&hl=en&q=intitle:Example+JSP++inurl%3A%2Fjsp-examples%2F&aq=f&aqi=&aql=&oq=&gs_rfai=&psj=1&fp=83f87efc6f926f13
    Vinnu Bro where you added the redirect string :?
    Reply With Quote Reply With Quote

  9. The Following User Says Thank You to [s] For This Useful Post:

    d4rkd4wn (12-30-2010)
  10. 12-31-2010, 08:45 AM #7
    "vinnu"
    "vinnu" is offline
    Security Researcher "vinnu" is a jewel in the rough"vinnu" is a jewel in the rough"vinnu" is a jewel in the rough "vinnu"'s Avatar
    Join Date
    Jul 2010
    Posts
    244
    Blog Entries
    2
    Thanks
    178
    Thanked 140 Times in 72 Posts
    Well i did it because few months back airtel said that its webportals are unhackable, it was an open challenge for all hackers.

    A jsp shell can be easily loaded on it.

    At the same place where we can specify the url for jsp war application we can also inject scripts into it.

    U can do it in addURL() text box. The JBOSS has persistent XSS.

    ..."vinnu"
    Reply With Quote Reply With Quote

  11. The Following 2 Users Say Thank You to "vinnu" For This Useful Post:

    abhaythehero (12-31-2010), prashant_uniyal (12-31-2010)
  12. 12-31-2010, 12:23 PM #8
    fb1h2s
    fb1h2s is offline
    Security Researcher fb1h2s has a spectacular aura aboutfb1h2s has a spectacular aura aboutfb1h2s has a spectacular aura about fb1h2s's Avatar
    Join Date
    Jul 2010
    Location
    India
    Posts
    595
    Blog Entries
    23
    Thanks
    279
    Thanked 150 Times in 76 Posts
    Similarly you could use shodan also as jboss installed servers response witt "jboss" string .
    Hacking Is a Matter of Time Knowledge and Patience
    Reply With Quote Reply With Quote

  13. The Following 2 Users Say Thank You to fb1h2s For This Useful Post:

    abhaythehero (12-31-2010), prashant_uniyal (12-31-2010)
  14. 07-30-2012, 03:09 PM #9
    the_empty
    the_empty is offline
    InfoSec Consultant the_empty will become famous soon enough the_empty's Avatar
    Join Date
    Jul 2010
    Location
    the blue no-where
    Posts
    157
    Blog Entries
    1
    Thanks
    46
    Thanked 41 Times in 14 Posts
    as I recall, there was an auth bypass vulnerability as well where-in attacker could user "PUT" instead of "GET" and get access.

    also there is a paper which provides a good insight on how that can be exploited further. thanks to FB1 (for old times sake, I hope it reminds him of something)...

    http://www.nruns.com/_downloads/Whit...-a-Browser.pdf


    Regards,
    the_empty
    ACCESS is GOD
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Forum Rules