search

johndekroon / serializekiller

Mass scanner for the Java serialize bug
The Unlicense
148 stars 40 forks source link

Bug in header of weblogic scan? #1

Open kwwall opened 8 years ago

kwwall commented 8 years ago

At line 103, of serializekiller.py, it has "t3://us-l-breens:7001" as a substring of the header. I'm thinking that "us-l-breens" substring is a copy / paste error from Stephen Breens' script and that it should be either the host name or IP address that is being scanned for WebLogic Server.

johndekroon commented 8 years ago

I think you're right, I guess it should be a valid URL. However, this part is not relevant for the exploit: it still works with the wrong URL. We successfully exploited a server with the "us-l-breens" in place, although the hostname was different. With that in mind, I wonder what that part is actually used for?