Hands-On Web Penetration Testing with Metasploit

Performing a vulnerability assessment on JBoss AS

If we find a JBoss AS instance on a machine and we need to perform a vulnerability assessment, we can always use Metasploit for this. Metasploit has a module for this called auxiliary/scanner/http/jboss_vulnscan, which we can use to perform vulnerability scanning on JBoss AS. The module checks for a few vulnerabilities, such as authentication bypass, a default password, and accessible JMX-console functions. The following are the steps we can observe to carry out a vulnerability assessment on JBoss AS:

1. To use jboss_vulnscan, we type the following command in msfconsole:

use auxiliary/scanner/http/jboss_vulnscanshow options

The following screenshot shows the output of the preceding command: ...