|
| 1 | +## Description |
| 2 | + |
| 3 | +Checks if an HTTP proxy is open. False positives are avoided by verifying the HTTP return code and matching a pattern. The CONNECT method is verified only by the return code. HTTP headers are shown regarding the use of proxies or load balancers. |
| 4 | + |
| 5 | +## Verification Steps |
| 6 | + |
| 7 | +1. Do: ```use auxiliary/scanner/http/open_proxy``` |
| 8 | +2. Do: ```set RHOSTS [IP]``` |
| 9 | +3. Do: ```set RPORT [PORT]``` |
| 10 | +4. Do: ```run``` |
| 11 | + |
| 12 | +## Scenarios |
| 13 | + |
| 14 | +### Running the scanner : |
| 15 | + |
| 16 | +``` |
| 17 | +msf > use auxiliary/scanner/http/open_proxy |
| 18 | +msf auxiliary(open_proxy) > show options |
| 19 | +
|
| 20 | +Module options (auxiliary/scanner/http/open_proxy): |
| 21 | +
|
| 22 | + Name Current Setting Required Description |
| 23 | + ---- --------------- -------- ----------- |
| 24 | + CHECKURL http://www.google.com yes The web site to test via alleged web proxy |
| 25 | + MULTIPORTS false no Multiple ports will be used: 80, 443, 1080, 3128, 8000, 8080, 8123 |
| 26 | + Proxies no A proxy chain of format type:host:port[,type:host:port][...] |
| 27 | + RHOSTS yes The target address range or CIDR identifier |
| 28 | + RPORT 8080 yes The target port (TCP) |
| 29 | + SSL false no Negotiate SSL/TLS for outgoing connections |
| 30 | + THREADS 1 yes The number of concurrent threads |
| 31 | + VALIDCODES 200,302 yes Valid HTTP code for a successfully request |
| 32 | + VALIDPATTERN <TITLE>302 Moved</TITLE> yes Valid pattern match (case-sensitive into the headers and HTML body) for a successfully request |
| 33 | + VERIFYCONNECT false no Enable CONNECT HTTP method check |
| 34 | + VHOST no HTTP server virtual host |
| 35 | +
|
| 36 | +msf auxiliary(open_proxy) > set RHOSTS 192.168.1.200-210 |
| 37 | +RHOSTS => 192.168.1.200-210 |
| 38 | +msf auxiliary(open_proxy) > set RPORT 8888 |
| 39 | +RPORT => 8888 |
| 40 | +msf auxiliary(open_proxy) > set THREADS 11 |
| 41 | +THREADS => 11 |
| 42 | +msf auxiliary(open_proxy) > run |
| 43 | +
|
| 44 | +[*] 192.168.1.201:8888 is a potentially OPEN proxy [200] (n/a) |
| 45 | +[*] Scanned 02 of 11 hosts (018% complete) |
| 46 | +[*] Scanned 03 of 11 hosts (027% complete) |
| 47 | +[*] Scanned 04 of 11 hosts (036% complete) |
| 48 | +[*] Scanned 05 of 11 hosts (045% complete) |
| 49 | +[*] Scanned 11 of 11 hosts (100% complete) |
| 50 | +[*] Auxiliary module execution completed |
| 51 | +msf auxiliary(open_proxy) > |
| 52 | +``` |
0 commit comments