search

dreadlocked / Drupalgeddon2

Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)
579 stars 173 forks source link

Drupal v8.x detected as v6.x? #45

Closed WTPRabbit closed 6 years ago

WTPRabbit commented 6 years ago

First of all- great tool, thanks! I'm getting a weird result when checking a site that runs Drupal v8.x:

screen shot 2018-09-04 at 15 09 29

Drupalgeddon result-

[*] --==[::#Drupalggedon2::]==--

[i] Target : https://xxxxx/

[+] Found : https://xxxxx/CHANGELOG.txt (HTTP Response: 200) [!] WARNING: Could be a false-positive [1-1], as the file could be reported to be missing [!] WARNING: Unable to detect keyword 'drupal.org' [+] Found : https://xxxxx/core/CHANGELOG.txt (HTTP Response: 200) [+] Found : https://xxxxx/includes/bootstrap.inc (HTTP Response: 200) [+] Found : https://xxxxx/core/includes/bootstrap.inc (HTTP Response: 403) [+] Found : https://xxxxx/includes/database.inc (HTTP Response: 200) [+] Drupal?: v6.x [-] Unsupported Drupal version (6.x)

I've tried running the customizable script, returns an error: "drupalgeddon2-customizable-beta.rb:69:in `+': no implicit conversion of nil into String (TypeError)"

Any ideas?

g0tmi1k commented 6 years ago

@WTPRabbit could you update and try again?

I'm also not use how you use drupalgeddon2-customizable-beta.rb (or if you edited it all).