HTTP Verb Authentication Bypass Scanner

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  # Exploit mixins should be called first  include Msf::Exploit::Remote::HttpClient  include Msf::Auxiliary::WmapScanDir  include Msf::Auxiliary::WmapScanFile  # Scanner mixin should be near last  include Msf::Auxiliary::Scanner  include Msf::Auxiliary::Report  def initialize(info = {})    super(update_info(info,      'Name'          => 'HTTP Verb Authentication Bypass Scanner',      'Description'   => %q{        This module test for authentication bypass using different HTTP verbs.      },      'Author'        => ['et [at] metasploit.com'],      'License'       => BSD_LICENSE))    register_options(      [        OptString.new('TARGETURI', [true,  "The path to test", '/'])      ])  end  def run_host(ip)    begin      test_verbs(ip)    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout    rescue ::Timeout::Error, ::Errno::EPIPE    end  end  def test_verbs(ip)    verbs = [ 'HEAD', 'TRACE', 'TRACK', 'Wmap', 'get', 'trace' ]    res = send_request_raw({      'uri'          => normalize_uri(target_uri.path),      'method'       => 'GET'    }, 10)    return if not res    if not res.headers['WWW-Authenticate']      print_status("#{full_uri} - Authentication not required [#{res.code}]")      return    end    auth_code = res.code    print_status("#{full_uri} - Authentication required: #{res.headers['WWW-Authenticate']} [#{auth_code}]")    report_note(      :host   => ip,      :proto  => 'tcp',      :sname  => (ssl ? 'https' : 'http'),      :port   => rport,      :type   => 'WWW_AUTHENTICATE',      :data   => "#{target_uri.path} Realm: #{res.headers['WWW-Authenticate']}",      :update => :unique_data    )    verbs.each do |tv|      resauth = send_request_raw({        'uri'          => normalize_uri(target_uri.path),        'method'       => tv      }, 10)      next if not resauth      print_status("#{full_uri} - Testing verb #{tv} [#{resauth.code}]")      if resauth.code != auth_code and resauth.code <= 302        print_good("#{full_uri} - Possible authentication bypass with verb #{tv} [#{resauth.code}]")        # Unable to use report_web_vuln as method is not in list of allowed methods.        report_note(          :host   => ip,          :proto  => 'tcp',          :sname  => (ssl ? 'https' : 'http'),          :port   => rport,          :type   => 'AUTH_BYPASS_VERB',          :data   => "#{target_uri.path} Verb: #{tv}",          :update => :unique_data        )      end    end  endend