Land rapid7#3568, @jhart-r7 regex fix for dir traversal

Tod Beardsley · Tod Beardsley · commit 8b2ff062c396 · 2014-07-24T15:43:43.000-05:00
diff --git a/modules/auxiliary/scanner/http/http_traversal.rb b/modules/auxiliary/scanner/http/http_traversal.rb
@@ -59,7 +59,7 @@ def initialize(info = {})
         OptString.new('PATH',    [true, 'Vulnerable path. Ex: /foo/index.php?pg=', '/']),
         OptString.new('DATA',    [false,'HTTP body data', '']),
         OptInt.new('DEPTH',      [true, 'Traversal depth', 5]),
-        OptRegexp.new('PATTERN', [true, 'Regexp pattern to determine directory traversal', '^HTTP/1.1 200 OK']),
+        OptRegexp.new('PATTERN', [true, 'Regexp pattern to determine directory traversal', '^HTTP/\\d\\.\\d 200']),
         OptPath.new(
           'FILELIST',
           [

Original file line number	Diff line number	Diff line change
`@@ -59,7 +59,7 @@ def initialize(info = {})`
`59`	`59`	`OptString.new('PATH', [true, 'Vulnerable path. Ex: /foo/index.php?pg=', '/']),`
`60`	`60`	`OptString.new('DATA', [false,'HTTP body data', '']),`
`61`	`61`	`OptInt.new('DEPTH', [true, 'Traversal depth', 5]),`
`62`		`- OptRegexp.new('PATTERN', [true, 'Regexp pattern to determine directory traversal', '^HTTP/1.1 200 OK']),`
	`62`	`+ OptRegexp.new('PATTERN', [true, 'Regexp pattern to determine directory traversal', '^HTTP/\\d\\.\\d 200']),`
`63`	`63`	`OptPath.new(`
`64`	`64`	`'FILELIST',`
`65`	`65`	`[`