diff --git a/README.md b/README.md
index 86b7251..80e2df9 100644
--- a/README.md
+++ b/README.md
@@ -141,6 +141,7 @@ Apache Wicket Arbitrary Resource Access (CVE-2015-2080)
* Apache Axis2 - Web Service Enumeration
* Apache Axis2 - Admin Console Weak Password
* Apache Axis2 - Local File Include Vulnerability (OSVDB 59001)
+ * Apache Axis2 - Happy Axis
## How to install ?
@@ -173,6 +174,7 @@ Apache Wicket Arbitrary Resource Access (CVE-2015-2080)
* Added check for Oracle Glassfish version
* Added check for Oracle Weblogic version
* Added check Apache Struts OGNL Console
+ * Added check for Happy Axis
### Version 1.2.3dev (26 Feb, 2015):
diff --git a/src/main/java/burp/j2ee/issues/impl/ApacheAxis.java b/src/main/java/burp/j2ee/issues/impl/ApacheAxis.java
index b9abdbb..c847be2 100644
--- a/src/main/java/burp/j2ee/issues/impl/ApacheAxis.java
+++ b/src/main/java/burp/j2ee/issues/impl/ApacheAxis.java
@@ -35,6 +35,14 @@ public class ApacheAxis implements IModule {
+ "the Apache Axis2 console. It was possible to enumerate the registered "
+ "Web Services";
+ private static final String TITLE_HAPPY_AXIS = "Happy Axis Page Available";
+ private static final String DESCRIPTION_HAPPY_AXIS = "J2EEscan identified "
+ + "the Happy Axise page available. This test resources allows to detect if some "
+ + "external libreries/dependencies are missing
The test page also could contains"
+ + "internal system information, such as internal classpaths, env variables and internal system properties"
+ + "
References:
"
+ + "http://axis.apache.org/axis/java/install.html#Validate_Axis_with_happyaxis";
+
private static final String TITLE_AXIS_ADMIN_CONSOLE = "Apache Axis2 - Admin Console";
private static final String DESCRIPTION_AXIS_ADMIN_CONSOLE = "J2EEscan identified "
+ "the Apache Axis2 administration console";
@@ -55,13 +63,25 @@ public class ApacheAxis implements IModule {
private static final List AXIS_PATHS = Arrays.asList(
"/axis2/",
- "/dswsbobje/" //SAP BusinessObjects path
+ "/axis/",
+ "/dswsbobje/", // SAP BusinessObjects path
+ "/jboss-net/" // JBoss
+ );
+
+ private static final List HAPPY_AXIS_PATHS = Arrays.asList(
+ "/dswsbobje/happyaxis.jsp", // SAP BusinessObjects path
+ "/jboss-net/happyaxis.jsp", // JBoss
+ "/happyaxis.jsp",
+ "/axis2/axis2-web/HappyAxis.jsp",
+ "/axis2-web/HappyAxis.jsp",
+ "/axis/happyaxis.jsp"
);
private static final String AXIS_SERVICES_PATH = "/services/listServices";
private static final String AXIS_ADMIN_PATH = "/axis2-admin/";
private static final byte[] GREP_STRING_AXIS_SERVICE_PAGE = "List Services".getBytes();
+ private static final byte[] GREP_STRING_HAPPY_AXIS = "Axis Happiness Page".getBytes();
private static final byte[] GREP_STRING_AXIS_XML = "> credentials;
WeakPassword wp = new WeakPassword();
credentials = wp.getCredentials();
-
List listOfPwd = new ArrayList<>();
for (Map.Entry credential : credentials) {
@@ -145,6 +164,52 @@ public List scan(IBurpExtenderCallbacks callbacks, IHttpRequestRespo
String protocol = url.getProtocol();
Boolean isSSL = (protocol.equals("https"));
+ /**
+ * Test for Happy Axis
+ * http://axis.apache.org/axis/java/install.html#Validate_Axis_with_happyaxis
+ *
+ *
+ */
+ for (String HAPPY_AXIS_PATH : HAPPY_AXIS_PATHS) {
+
+ try {
+
+ // Test for happy axies
+ URL happyAxisUrlToTest = new URL(protocol, url.getHost(), url.getPort(), HAPPY_AXIS_PATH);
+ byte[] happyAxisTest = helpers.buildHttpRequest(happyAxisUrlToTest);
+ byte[] happyAxisResponse = callbacks.makeHttpRequest(url.getHost(),
+ url.getPort(), isSSL, happyAxisTest);
+ IResponseInfo happyAxisInfo = helpers.analyzeResponse(happyAxisResponse);
+
+ if (happyAxisInfo.getStatusCode() == 200) {
+
+ String happyAxisResp = helpers.bytesToString(happyAxisResponse);
+ String happyAxisRespBody = happyAxisResp.substring(happyAxisInfo.getBodyOffset());
+
+ // look for matches of our active check grep string
+ List matchHappyAxis = getMatches(helpers.stringToBytes(happyAxisRespBody),
+ GREP_STRING_HAPPY_AXIS, helpers);
+
+ if ((matchHappyAxis.size() > 0)) {
+ stdout.println("Happy Axis detected " + happyAxisUrlToTest.toString());
+
+ issues.add(new CustomScanIssue(
+ baseRequestResponse.getHttpService(),
+ happyAxisUrlToTest,
+ new CustomHttpRequestResponse(happyAxisTest, happyAxisResponse, baseRequestResponse.getHttpService()),
+ TITLE_HAPPY_AXIS,
+ DESCRIPTION_HAPPY_AXIS,
+ "Restrict access to Happy Axis debug page",
+ Risk.Medium,
+ Confidence.Certain
+ ));
+ }
+ }
+ } catch (MalformedURLException ex) {
+ stderr.println("Malformed URL Exception " + ex);
+ }
+ }
+
for (String AXIS_PATH : AXIS_PATHS) {
try {
@@ -298,4 +363,4 @@ public List scan(IBurpExtenderCallbacks callbacks, IHttpRequestRespo
return issues;
}
-}
+}
\ No newline at end of file