Skip to content

Commit d4843f4

Browse files
committed
Make auth checking optional and off by default
1 parent 9491e4c commit d4843f4

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

modules/auxiliary/scanner/http/allegro_rompager_misfortune_cookie.rb

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@ def initialize(info = {})
4040
OptString.new('TARGETURI', [true, 'URI to test', '/'])
4141
], Exploit::Remote::HttpClient
4242
)
43+
44+
register_advanced_options(
45+
[
46+
OptBool.new('REQUIRE_AUTH', [true, 'Require that the tested URI require authentication', false])
47+
], self.class
48+
)
4349
end
4450

4551
def check_host(_ip)
@@ -98,7 +104,9 @@ def requires_auth?
98104
end
99105

100106
def test_misfortune
101-
return Exploit::CheckCode::Unknown unless requires_auth?
107+
if datastore['REQUIRE_AUTH']
108+
return Exploit::CheckCode::Unknown unless requires_auth?
109+
end
102110

103111
# find a usable canary URI (one that 401/404s already)
104112
unless canary = find_canary_uri

0 commit comments

Comments
 (0)