Skip to content

Commit 664c955

Browse files
authored
Merge pull request #20629 from h00die/no_4_space_options
Clean up 2 aux docs
2 parents 2d5f10d + 976c208 commit 664c955

File tree

2 files changed

+44
-16
lines changed

2 files changed

+44
-16
lines changed

documentation/modules/auxiliary/dos/http/metasploit_httphandler_dos.md

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,20 @@
1414

1515
### DOSTYPE
1616

17-
GENTLE: *Current sessions will continue to work, but not future ones*
18-
A lack of input sanitation permits an attacker to submit a request that will be added to the resources and will be used as regex rule it is possible then to make a valid regex rule that captures all the new handler requests. The sessions that were established previously will continue to work.
17+
#### GENTLE
1918

20-
SOFT: *No past or future sessions will work*
21-
A lack of input sanitation and lack of exception handling causes Metasploit to behave abnormally when looking an appropriate resource for the request, by submitting an invalid regex as a resource. This means that no request, current or future will get served an answer.
19+
*Current sessions will continue to work, but not future ones*
20+
A lack of input sanitation permits an attacker to submit a request that will be added to the resources and will be used as regex rule it is possible then to make a valid regex rule that captures all the new handler requests. The sessions that were established previously will continue to work.
2221

23-
HARD: *ReDOS or Catastrophic Regex Backtracking*
24-
A lack of input sanitization on paths added as resources allows an attacker to execute a catastrophic regex backtracking operation causing a Denial of Service by CPU consumption.
22+
#### SOFT
23+
24+
*No past or future sessions will work*
25+
A lack of input sanitation and lack of exception handling causes Metasploit to behave abnormally when looking an appropriate resource for the request, by submitting an invalid regex as a resource. This means that no request, current or future will get served an answer.
26+
27+
#### HARD
28+
29+
*ReDOS or Catastrophic Regex Backtracking*
30+
A lack of input sanitization on paths added as resources allows an attacker to execute a catastrophic regex backtracking operation causing a Denial of Service by CPU consumption.
2531

2632
## Scenarios
2733

documentation/modules/auxiliary/gather/office365userenum.md

Lines changed: 32 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,39 @@ Office365's implementation of ActiveSync is vulnerable.
2828

2929
## Options
3030

31-
LOGFILE = Output file to use for verbose logging.
32-
OUTPUT = Output file for results.
33-
PASSWORD = Password to use during enumeration. Note this must exist
34-
but does not necessarily need to be valid. If it is
35-
found to be valid for an account it will be reported.
36-
THREADS = Number of concurrent requests to use during enumeration.
37-
TIMEOUT = HTTP request timeout to use during enumeration.
38-
URL = URL of Office365 ActiveSync service.
39-
USERS = Input fie containing candidate usernames, one per line.
40-
VERBOSE = Enable/Disable DEBUG logging
31+
### LOGFILE
4132

33+
Output file to use for verbose logging.
34+
35+
### OUTPUT
36+
37+
Output file for results.
38+
39+
### PASSWORD
40+
41+
Password to use during enumeration. Note this must exist
42+
but does not necessarily need to be valid. If it is
43+
found to be valid for an account it will be reported.
44+
45+
### THREADS
46+
47+
Number of concurrent requests to use during enumeration.
48+
49+
### TIMEOUT
50+
51+
HTTP request timeout to use during enumeration.
52+
53+
### URL
54+
55+
URL of Office365 ActiveSync service.
56+
57+
### USERS
58+
59+
Input fie containing candidate usernames, one per line.
60+
61+
### VERBOSE
62+
63+
Enable/Disable DEBUG logging
4264

4365
## Scenarios
4466

0 commit comments

Comments
 (0)