Compare commits

...

5 Commits

Author SHA1 Message Date
Liz Rice
16103bfbcf Merge branch 'master' into fix-hunting-bugs 2020-09-04 12:15:52 +01:00
Liz Rice
129ac8d0eb Merge branch 'master' into fix-hunting-bugs 2020-09-04 12:02:12 +01:00
Liz Rice
19c00e9ee2 Merge branch 'master' into fix-hunting-bugs 2020-09-04 09:44:14 +01:00
Daniel Sagi
ab40d90b13 changed self.protocol in other places on etcd hunting. this is a typo, protocol is a property of events, not hunters 2020-08-21 05:46:28 -07:00
Daniel Sagi
45a92a9577 fixed etcd version hunting typo 2020-08-21 05:18:12 -07:00

View File

@@ -143,7 +143,7 @@ class EtcdRemoteAccess(Hunter):
logger.debug(f"Trying to check etcd version remotely at {self.event.host}")
try:
r = requests.get(
f"{self.protocol}://{self.event.host}:{ETCD_PORT}/version",
f"{self.event.protocol}://{self.event.host}:{ETCD_PORT}/version",
verify=False,
timeout=config.network_timeout,
)
@@ -167,10 +167,10 @@ class EtcdRemoteAccess(Hunter):
def execute(self):
if self.insecure_access(): # make a decision between http and https protocol
self.protocol = "http"
self.event.protocol = "http"
if self.version_disclosure():
self.publish_event(EtcdRemoteVersionDisclosureEvent(self.version_evidence))
if self.protocol == "http":
if self.event.protocol == "http":
self.publish_event(EtcdAccessEnabledWithoutAuthEvent(self.version_evidence))
if self.db_keys_disclosure():
self.publish_event(EtcdRemoteReadAccessEvent(self.keys_evidence))