GitHub PullRequestReviewCommentEvent at 2014-03-27 15:06:03
Repository: metasploit-framework
Actor: wvu-r7
Payload: {"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/11026711","id":11026711,"diff_hunk":"@@ -143,9 +145,28 @@ def bypass_auth(url)\n     }, 20)\n \n     if (res and res.code == 200)\n-      print_good(\"#{rhost}:#{rport} Got authentication bypass via HTTP verb tampering\")\n+      print_good(\"#{rhost}:#{rport} Got authentication bypass via HTTP verb tampering (length: #{res.headers['Content-length']})\")\n     else\n       print_status(\"#{rhost}:#{rport} Could not get authentication bypass via HTTP verb tampering\")\n     end\n   end\n+\n+  def check_urlprefixes()\n+    # \"/urlprefix outputs the list of URL prefixes that are handled in the ABAP part of the SAP Web AS. This is how the message server finds out which URLs must be forwarded where.\" (SAP help) -> this disclose custom URLs that are also checked for authentication\n+    res = send_request_cgi({\n+      'uri'       => \"/sap/public/icf_info/urlprefix\",\n+      'method'    => 'GET',\n+      'ctype'     => 'text/plain',\n+    }, 20)\n+    if (res and res.code == 200)","path":"modules/auxiliary/scanner/sap/sap_icm_urlscan.rb","position":45,"original_position":45,"commit_id":"48634ea609e3774cf4c0b930d02de0cde7301300","original_commit_id":"48634ea609e3774cf4c0b930d02de0cde7301300","user":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars.githubusercontent.com/u/4551878?","gravatar_id":"2d5dd279072808fb5d0e7e0b4632c303","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"body":"No parens and use ```&&``` instead of ```and```.","created_at":"2014-03-27T15:06:03Z","updated_at":"2014-03-27T15:06:03Z","html_url":"https://github.com/rapid7/metasploit-framework/pull/3148#discussion_r11026711","pull_request_url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/3148","_links":{"self":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/comments/11026711"},"html":{"href":"https://github.com/rapid7/metasploit-framework/pull/3148#discussion_r11026711"},"pull_request":{"href":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/3148"}}}}