Skip to content

Commit e531dbc

Browse files
committed
Fix bug causing all logins to appear valid
The headers we were looking for were a little too loose and were incorrectly identifying all responses as successful login attempts
1 parent 0f0270b commit e531dbc

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

modules/auxiliary/scanner/http/owa_login.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@ def try_user_pass(opts)
232232
# No password change required moving on.
233233
# Check for valid login but no mailbox setup
234234
print_good("server type: #{res.headers["X-FEServer"]}")
235-
if res.headers['location'] =~ /owa/
235+
if res.headers['location'] =~ /owa/ and res.headers['location'] !~ /reason/
236236
print_good("#{msg} SUCCESSFUL LOGIN. #{elapsed_time} '#{user}' : '#{pass}'")
237237
report_cred(
238238
ip: res.peerinfo['addr'],

0 commit comments

Comments
 (0)