2 min
API
How to generate reports through the API
Nexpose provides a number of api methods for report management. Through the API
you can create/update a report configuration, generate a report on the fly, and
view the status of the generation requests.
A report configuration, in particular, is a configuration for a type of report.
With a configuration, a user can specify the template, format, and content for a
report. In order to create a configuration via the API a user must generate a
ReportSaveRequest.
ReportSaveRequest - The report save
0 min
Nexpose
Nexpose Reporting with the Java API Client
Nexpose reporting just got easier!
Now you can manage and generate Nexpose reports though an interactive
application that leverages the Nexpose Java API client.
Here is a list of the options that are currently supported.
1. List Reports
2. Generate Reports
3. Delete Reports
4. Delete Report Configurations (and all associated reports)
5. View Report Configuration
6. View Report History
Attached is a copy of the application and the source code so you can easily
modify and extend its func
5 min
Javascript
Creating a bunch of users at once using the Nexpose API
I would like to take the time to share an example of how you can use the Nexpose
API to create a batch of users at one time with the use of a CSV file. Sounds
too good to be true right?
I swear to you that this is not a mirage. In fact I am prepared to put my money
where my mouth is and post a code example with Rapid7's very own Open Source
Java API client. This will allow you to do the following:
* Interactively specify a CSV file to Create Update and even remove existing
users * Please s
0 min
IT Ops
Focus on the first input element in jQuery
Just in case you want to focus on the first element in a form, here is how to do
it through one simple jQuery sector:
$('#form-id :input:enabled:visible:first').focus();
Once you select the right form (#form-id), it’s time to specify any input
elements including text areas (:input) which are editable (:enabled), visible
(:visible), and first in the form (:first).
4 min
IT Ops
How do I know if my Heroku app is slow?
So you’ve written a nice new Heroku app and have tested it thoroughly – it seems
really fast – yay!!! And what do I mean by thoroughly… so you tried out all the
functionality, everything works as you’ve expected, and the response time seems
A-ok!
Well at least it seems ok when there’s one request at a time…. but you wonder
what happens when you go live and the floodgates open… what is the response time
going to be like then and how will you know what your users are experiencing?
Thanks for Swe
2 min
Authentication
Free Scanner for MySQL Authentication Bypass CVE-2012-2122
The MySQL authentication bypass vulnerability (CVE-2012-2122) - explained in
detail in HD Moore's blog post - was the cause for much concern when it was
first discovered. In response, we've created a new vulnerability scanner for
CVE-2012-2122 called ScanNow, which enables you to check your network for
vulnerability to this security issue. The best thing: it's simple to use,
completely free, and scans unlimited IPs for this vulnerability!
This vulnerability allows an attacker to bypass authenti
4 min
Nexpose
Nexpose Community Edition Lab | Scanning & Reports
In the previous blog post, we walked through creating a virtual machine and
installing Nexpose Community for use in a small lab environment. In this post,
we'll highlight key features of Nexpose, run Discovery and Vulnerability scans
and finally generate a report to assist with remediating those pesky
vulnerabilities.
To log into your Nexpose Console, open your browser and navigate to:
https://localhost:3780 , then input the credentials you
specified during the inst
1 min
Metasploit
Webcast: Decrease Your Risk of a Data Breach - Effective Security Programs with Metasploit
Thanks for the many CISOs and security engineers who attended our recent
webcast, in which I presented some practical advice on how to leverage
Metasploit to conduct regular security reviews that address current attack
vectors. While Metasploit is often used for penetration testing projects, this
presentation focuses on leveraging Metasploit for ongoing security assessments
that can be achieved with a small security team to reduce the risk of a data
breach.
This webcast is now available for o
2 min
Metasploit
Weekly Metasploit Update: HP, PHP, and More!
Stupid PHP Tricks
This week's Metasloit update is a cautionary tale about running unaudited PHP
applications as part of your infrastructure. Metasploit community contributor
Brendan Coles has discovered and written Metasploit
modules for two similar root-level vulnerabilities one for OpenFiler
and one for WAN Emulator
(a
1 min
Metasploit
Current User psexec
At DEF CON this year I talked about some of the post exploitation capabilities
within Metasploit and demo'd a cool technique I developed with Jabra on a
pentest a year or so ago (I later found out that Mubix had come up with
basically the same idea - great minds think alike). It is essentially this: use
a session's current token to create a remote service on a victim machine.
It takes advantage of a feature in Windows that most people take completely for
granted. Given that you are already logg
3 min
Networking
Weekly Metasploit Update: SAP, MSSQL, DNS, and More!
Zone Transfers for All
This week, Metasploit community contributor bonsaiviking
fixed up the DNS library that Metasploit uses
so we won't choke on some types of zone transfer responses. Turns out, this is a
two-year old bug, but DNS servers that actually offer zone transfers are so rare
any more that this this bug didn't manifest enough to get squashed.
This brings me to a larger point -- with older vulnerabilities like these,
sometimes the hardest part for us
3 min
Metasploit
Mobile Pwning: Using Metasploit on iOS
Have you ever wanted to run an exploit but found yourself away from your desk?
Wouldn't it be awesome if you could launch a full version of the Metasploit
Framework from your phone or tablet? As you might have guessed, now you can.
With an adventurous spirit and a few commands, you can be running the Metasploit
Framework on your iPad or iPhone in just a few short minutes.
Warning: To install Metasploit, you'll need root access to your device – which
is accomplished by following your favorite ja
7 min
Adobe Flash Player Exploit CVE-2012-1535 Now Available for Metasploit
Edit: Aug 26 2012.
Recently, a new Adobe Flash vulnerability (CVE-2012-1535
) was being
exploited in the wild as a zero-day in limited targeted attacks, in the form of
a Word document. The Metasploit team managed to get our hands on the malware
sample, and began our voodoo ritual in order to make this exploit available in
the Metasploit Framework. Although Adobe officially has already released a
patch (APSB12-18
3 min
Metasploit
Weekly Metasploit Update: Trusted Path Switcheroo, Stack Cookie Bypass, and More
Another week, another fifteen new modules for Metasploit. I continue to be
amazed by the productivity of our open source exploit developer community.
Thanks so much for your hard work and effort, folks!
New Module for Trusted Path Switcheroo
As I was going over this week's new modules, one that jumped out at me was Wei
"sinn3r" Chen's implementation of a general Trusted Path insertion attack,
Windows Service Trusted Path Privilege Escalation. I don't recall running into
this attack scenario bef
5 min
The Stack Cookies Bypass on CVE-2012-0549
In this blog post we would like to share some details about the Oracle AutoVue
exploit for CVE-2012-0549 which we've recently added to the Metasploit
Framework. This module exploits a buffer overflow flaw, discovered by Brian
Gorenc.
The problem arises when you call the SetMarkupMode function from the AutoVue
control (clsid B6FCC215-D303-11D1-BC6C-0000C078797F) with a long sMarkup
parameter. The buffer overflow, even when triggered through an API from the
AutoVue control, happens in AvMarkupX