Video dimostrativo visto in classe:
Tutorial: Find and Exploit a Vulnerability (Nessus and Python)
This video shows how to use the Nessus vulnerability scanner to scan for a vulnerability, then exploit the flaw using a Python script I wrote as that uses the vulnerability "DD-WRT HTTP Daemon Metacharacter Injection Remote Code Execution" for a Proof-of-Concept DoS (denial of service) attack. The script uses the vulnerability to force the router to reboot, in essence creating DoS for all users who rely on the router for network access.
The vulnerability itself is a flaw which allows any attacker who is connected to the router to run a command of his choosing using "/cgi-bin/;[command]" appended to the URL. The attacker can also use this vulnerability to force the router to spawn a remote shell on a port of his choosing, then connect to it using a client such as Putty. Free root access. It's pretty bad.
The vulnerability itself is a flaw which allows any attacker who is connected to the router to run a command of his choosing using "/cgi-bin/;[command]" appended to the URL. The attacker can also use this vulnerability to force the router to spawn a remote shell on a port of his choosing, then connect to it using a client such as Putty. Free root access. It's pretty bad.
Vulnerabilità del router:
Produttore del router:
Commenti