WebExploitationFramework/wXf — Issue #30: Version Checking for Web Exploits
Author: mubix
Created: 2011-10-18 01:56:38+00:00
State: open

Basically this is an array of URLs and file hashes (MD5/SHA1) of default files that are accessible unauthenticated that will verify if the application is vulnerable to the exploit being used. For example if a module includes the datastore item 'VERCHECK' or 'VERIFY' then what wXf will do is request those URLs specified in the module. Once pulled down in to a tmp directory or memory if that's possible, it will then MD5/SHA1 the files and present the user with a confidence level based on the number of files that were verified to be there with the same hash. 2 points goes for a file that is both there and has the same hash, 1 for the fact that the file is there. Then just take the number of array items * 2 and divide it by the returned points. XYZ verification step gave a 75% confidence the target has the vulnerable version of this application.

With this you are also giving the user a totally new item to consider. Say if the verification step comes back at 99% confidence but the exploit doesn't work. One could safely say that a WAF or other item got in the way of the exploit so further testing is probably needed.