Exploit Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
33023
Проверка EDB
  1. Пройдено
Автор
D. MATSCHEKO
Тип уязвимости
REMOTE
Платформа
MULTIPLE
CVE
cve-2009-0580
Дата публикации
2009-06-03
Код:
source: https://www.securityfocus.com/bid/35196/info

Apache Tomcat is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists.

Attackers may exploit this weakness to discern valid usernames. This may aid them in brute-force password cracking or other attacks.

The following are vulnerable:

Tomcat 4.1.x (prior to 4.1.40)
Tomcat 5.5x (prior to 5.5.28)
Tomcat 6.0.x (prior to 6.0.20) 

The following example POST data is available:

POST /j_security_check HTTP/1.1
Host: www.example.com

j_username=tomcat&j_password=%
 
Источник
www.exploit-db.com

Похожие темы