gdssecurity / gwt-penetration-testing-toolset Goto Github PK

I noticed that on some gwt application, methods can't be enumerated. any reasons? (It's not an authentication issue, i already check).

thks

Hi,

the following RPC call is used on a webpage running GWT 2.5.1:

7|0|12|https://example.com/|{HASH}|net.customware.gwt.dispatch.client.standard.StandardDispatchService|execute|net.customware.gwt.dispatch.shared.Action|{CUSTOM_CLASSNAME}/951153625|java.util.Date/3385151746|test|java.util.HashSet/3273092938|java.lang.Integer/3438268394|{VERY_LONG_SESSION_STRING}|en|1|2|3|4|1|5|6|7|UUaJ_8A|7|UWQmkMA|7|UUfTlsA|7|UWLc$cA|200|8|9|1|10|52|11|12|

Using the gwtparse.py tool to parse this call leads to the following error:

Traceback (most recent call last):
  File "gwtparse.py", line 87, in <module>
    gwt.deserialize( options.rpc_request )
  File "/opt/gwt-pentest/gwtparse/GWTParser.py", line 716, in deserialize
    self._parse()
  File "/opt/gwt-pentest/gwtparse/GWTParser.py", line 701, in _parse
    self._parse_value(param.typename)
  File "/opt/gwt-pentest/gwtparse/GWTParser.py", line 663, in _parse_value
    self._parse_read_object(data_type)
  File "/opt/gwt-pentest/gwtparse/GWTParser.py", line 509, in _parse_read_object
    if self._nextval_is_an_integer( prev_index ):
  File "/opt/gwt-pentest/gwtparse/GWTParser.py", line 136, in _nextval_is_an_integer
    if int(self.indices[0]) == int(self.indices[1]):
ValueError: invalid literal for int() with base 10: 'UUaJ_8A'

Just a quick and dirty hack to "solve" HTTPS issues with self-signed certs.

Simply add the following two lines to gwtenum.py:

import ssl
ssl._create_default_https_context = ssl._create_unverified_context

Happy hacking!

Hi,

Although it seems that the {HEX} file is downloaded and analysed correctly, gwtenum.py fails to enumerate any endpoints. Are you aware of any changes introduced in v7 that may be causing this? Do you think it would be easy to address? Thanks!

/cc @mwielgoszewski

1st issue
I believe the lines:
if options.proxy:
handlers.append( urllib2.ProxyHandler( {'http':'http://'+options.proxy}) )

fail to work if the site is https. changing the above to
if options.proxy:
handlers.append( urllib2.ProxyHandler( {'https':'https://'+options.proxy}) )

i was able to make the request work through burp. I'm guessing if urllib2 is using an https handler it will ignore a proxyhanlder set using http.

2nd issue=
The help instructs to use "http://proxy.com" while the if statement is only expecting a domain:port.

Both issues could be fixed by changing the if options.proxy section to:

if options.proxy:
if url.startswith( "https://" ):
handlers.append( urllib2.ProxyHandler( {'https':'https://'+options.proxy}) )
if url.startswith( "http://" ):
handlers.append( urllib2.ProxyHandler( {'http':'http://'+options.proxy}) )

and changing the help for proxy example to -p "site.com:8080"

never mind, I missed on peeping in the script. Please let us know if there are any plans to incorporate the AD option.