Glassfish LoginScanner update

This is an update for the Glassfish login module. Mainly it covers:

- New auth support for Glassfish 4
- Uses LoginScanner
- Can automatically switch from HTTP to HTTPS
- Updated information about the "authentication bypass"
- Other minor fixes

Targets tested during the update (Windows 2003, Windows 7, and Ubuntu):

* GlassFish Server Open Source Edition 4.0
* Oracle GlassFish Server 3.1
* Sun GlassFish Enterprise Server v2.1.1

Yes, it is a little annoying they sort of have different names.

## Verification steps for the latest version ##

**Setting up Glassfish:**

- [x] Windows is the easiest to set up, so get a Windows VM up and ready. Windows 2003 SP2 or Win 7 should be fine.
- [x] Download and install JDK8: http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html
- [x] Download Glassfish 4: http://download.java.net/glassfish/4.0/release/glassfish-4.0.zip
- [x] Extract glassfish-4.0.zip
- [x] In command prompt, go to directory glassfish4\bin\
- [x] Run ```asadmin```, which is the admin console.
- [x] Enter ```start-domain domain1```
- [x] Make sure that there's a port listening at 4848

If you prefer to set up your own domain (but you don't really have to), in asadmin, do this:

1. ```create-domain --adminport=4848 domain2```
2. You will be asked to set the username and password
3. ```start-domain domain2``` to start the domain.

To shut down a domain, here's how:

```stop-domain domain1```

**Test the module with Secure Admin off**

By default, Secure Admin is off, so you cannot login remotely. Let's test this and make sure the module is aware of this condition:

- [x] Start msfconsole
- [x] ```use auxiliary/scanner/http/glassfish_login```
- [x] Set the appropriate options (rhosts, username, and password)
- [x] ```Run```
- [ ] Make sure you see the message: "Secure Admin must be enabled to access the DAS remotely."

**Test the module with Secure Admin on**

- [x] On the Glassfish box, open a browser, and then go to: http://localhost:4848
- [x] Look at the menu on the left, those are the "Common Tasks". You should see an item that says "server (Admin Server)", click on that.
- [x] You should see a button that says "Enable Secure Admin", click on that. If your Glassfish does not have a password, it will ask you to set that first before enabling Secure Admin.
- [x] On the attack's box, use the browser to verify you can login remotely
- [x] Run the glassfish_login module with the correct username/password, you should see a successful login attempt message
- [x] Run the glassfish_login module with a bad password, you should NOT see the same successful login message

## Verification on an older version of Glassfish ##

If you want to verify on an older version, you can download them here:
https://glassfish.java.net/download-archive.html

Note that there's only 3.1.2.2 and 2.1.1. Version 3 ships with Java and is easier to install. Version 2 involves more manual work.

Since 2.1.1 involves more manual work, if you need the installation doc, you can get it here:
https://glassfish.java.net/downloads/v2.1.1-final.html

## Demo ##

```
msf auxiliary(glassfish_login) > run

[*] Sending a request to /common/index.jsf...
[*] Glassfish is asking us to use HTTPS
[*] SSL option automatically set to: true
[*] SSL version option automatically set to: TLS1
[*] Sending a request to /common/index.jsf...
[*] Checking if Glassfish requires a password...
[*] Glassfish is protected with a password
[+] 192.168.1.123:4848 GLASSFISH - Success: 'admin:yoyoyo'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
(It applies to other descriptions)