Hands-On Web Penetration Testing with Metasploit

Struts 2 exploitation using Metasploit

Now that we have exploited the vulnerabilities of Struts 2 manually and understood the concepts clearly, we'll see how easy it is to exploit the same vulnerability using Metasploit. Using Metasploit makes exploitation much easier. We can search for all the available modules on Struts by performing the following steps:

1. Search for struts in the Metasploit console, as shown:

2. The following is a demo web application that is running Apache Struts. This application is vulnerable to the S2-013 vulnerability (CVE-2013-1966). Let's look at how we can exploit this vulnerability using Metasploit:

3. We load the ...