Metasploit Framework
This report summarizes scanner evidence for rapid7/metasploit-framework, a Ruby project with 39,126 GitHub stars. SynthScan examined 2,091,448 lines of code across 12630 source files, recording 6181 pattern matches distributed across 22 syntactic categories. The legacy adjusted pattern signal is 5.1 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 5335 finding(s).
Are imports declared and package/API names verified? 362 finding(s).
Are wrappers, guards, and repeated structures necessary? 1409 finding(s).
Which changes need focused human review? 6181 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 6181 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/password/md5_lookup.rb | 132 | # This class is basically an auxiliary module without relying on msfconsole | COMMENT |
| MEDIUM | tools/password/vxmaster.rb | 112 | # Create the master password list output file | COMMENT |
| MEDIUM | tools/exploit/metasm_shell.rb | 15 | # This file is part of Metasm, the Ruby assembly manipulation suite | COMMENT |
| MEDIUM | tools/dev/hash_cracker_validator.rb | 347 | # Create a john pot tempfile used by the pot-mode tests | COMMENT |
| MEDIUM | tools/dev/detect_dead_reference_links.rb | 298 | # Create the final list of URLs and paths | COMMENT |
| MEDIUM | tools/dev/msftidy.rb | 372 | if @source =~ /^# This file is part of the Metasploit Framework and may be subject to/ | CODE |
| MEDIUM | tools/modules/payload_lengths.rb | 50 | # Create the payload instance | COMMENT |
| MEDIUM | test/functional/framework/msfconsole_spec.rb | 33 | ## Create a framework object | COMMENT |
| MEDIUM | test/functional/framework/msfconsole_spec.rb | 113 | ## Create the rspec Test Case | COMMENT |
| MEDIUM | test/functional/meterpreter/meterpreter_java_spec.rb | 65 | # Initialize the exploit instance | COMMENT |
| MEDIUM⚡ | test/functional/meterpreter/java_meterpreter_specs.rb | 3 | ## This file is intended to be used in conjunction with a harness, | COMMENT |
| MEDIUM⚡ | …st/functional/meterpreter/windows_meterpreter_specs.rb | 3 | ## This file is intended to be used in conjunction with a harness, | COMMENT |
| MEDIUM | test/functional/meterpreter/meterpreter_php_spec.rb | 56 | # Initialize the exploit instance | COMMENT |
| MEDIUM | test/functional/meterpreter/meterpreter_spec_helper.rb | 47 | # Create a new file and write to it | COMMENT |
| MEDIUM | test/functional/meterpreter/meterpreter_win32_spec.rb | 75 | # Initialize the exploit instance | COMMENT |
| MEDIUM | plugins/ffautoregen.rb | 11 | # This class implements a single edit command. | COMMENT |
| MEDIUM | plugins/ffautoregen.rb | 34 | # This method handles the command. | COMMENT |
| MEDIUM | plugins/wiki.rb | 24 | # This class implements a command dispatcher that provides commands to | COMMENT |
| MEDIUM | plugins/wiki.rb | 84 | # Create a table options hash | COMMENT |
| MEDIUM | plugins/wiki.rb | 483 | # The following methods are added here to keep the initialize method | COMMENT |
| MEDIUM | plugins/sample.rb | 14 | # This class implements a sample console command dispatcher. | COMMENT |
| MEDIUM | plugins/sample.rb | 37 | # This method handles the sample command. | COMMENT |
| MEDIUM | plugins/fzuse.rb | 80 | # This method handles the fzuse command. | COMMENT |
| MEDIUM | plugins/nexpose.rb | 495 | # Create a temporary site | COMMENT |
| MEDIUM | plugins/msgrpc.rb | 15 | # This class implements the msfd plugin interface. | COMMENT |
| MEDIUM | plugins/pcap_log.rb | 2 | # This file is part of the Metasploit Framework and may be subject to | COMMENT |
| MEDIUM | plugins/db_tracker.rb | 13 | # This class implements a socket communication tracker | COMMENT |
| MEDIUM | plugins/ips_filter.rb | 14 | # This class implements a socket communication logger | COMMENT |
| MEDIUM | plugins/socket_logger.rb | 12 | # This class implements a socket communication logger | COMMENT |
| MEDIUM | plugins/msfd.rb | 12 | # This class implements the msfd plugin interface. | COMMENT |
| MEDIUM | …onsole/command_dispatcher/core_payload_options_spec.rb | 44 | # Initialize the class variable that cmd_set references for payload index lookup | COMMENT |
| MEDIUM | spec/lib/msf/core/mcp/tools/tool_helper_spec.rb | 6 | # Create a test class that includes the helper inside class << self, | COMMENT |
| MEDIUM | spec/api/metasploit_api_app_spec.rb | 12 | # Create a user so authentication is enforced (auth_initialized = true). | COMMENT |
| MEDIUM⚡ | docs/build.rb | 541 | # Create a new branch based on the commits from https://github.com/rapid7/metasploit-framework/wiki to move | COMMENT |
| MEDIUM⚡ | docs/build.rb | 549 | # Create a new folder and branch in the old metasploit wiki for where we'd like it to be inside of the metasploi | COMMENT |
| MEDIUM⚡ | docs/build.rb | 556 | # Create a new folder to move the wiki contents into | COMMENT |
| MEDIUM⚡ | docs/build.rb | 560 | # Create a new branch + commit | COMMENT |
| MEDIUM⚡ | docs/build.rb | 567 | # Create a new branch that can be used to create a pull request | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/event_manager.rb | 58 | # Create a hash to store the log info in (and throw default info in) | COMMENT |
| MEDIUM | scripts/meterpreter/event_manager.rb | 223 | # Create a directory for any local logging if the user desires | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/packetrecorder.rb | 61 | # Create a directory for the logs | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/packetrecorder.rb | 68 | # Create the log directory | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/netenum.rb | 32 | # Create a directory for the logs | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/netenum.rb | 35 | # Create the log directory | COMMENT |
| MEDIUM | scripts/meterpreter/vnc.rb | 96 | # Create the raw payload | COMMENT |
| MEDIUM | scripts/meterpreter/vnc.rb | 144 | # Create a host process | COMMENT |
| MEDIUM | scripts/meterpreter/process_memdump.rb | 93 | # Create a directory for the logs | COMMENT |
| MEDIUM | scripts/meterpreter/process_memdump.rb | 95 | # Create the log directory | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/winbf.rb | 135 | # Create a directory for the logs | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/winbf.rb | 138 | # Create the log directory | COMMENT |
| MEDIUM | scripts/meterpreter/virtualbox_sysenter_dos.rb | 50 | # Create a new thread on the shellcode pointer | COMMENT |
| MEDIUM | scripts/meterpreter/remotewinenum.rb | 29 | # Create a directory for the logs | COMMENT |
| MEDIUM | scripts/meterpreter/remotewinenum.rb | 32 | # Create the log directory | COMMENT |
| MEDIUM | scripts/meterpreter/metsvc.rb | 63 | # Create the persistent VBS | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/winenum.rb | 49 | # Create a directory for the logs | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/winenum.rb | 52 | # Create the log directory | COMMENT |
| MEDIUM | scripts/meterpreter/enum_firefox.rb | 19 | # Create a directory for the logs | COMMENT |
| MEDIUM | scripts/meterpreter/enum_firefox.rb | 35 | # Create the log | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/get_filezilla_creds.rb | 42 | # Create a directory for the logs | COMMENT |
| MEDIUM⚡ | scripts/meterpreter/get_filezilla_creds.rb | 44 | # Create the log directory | COMMENT |
| 838 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ules/exploit/linux/http/skyvern_ssti_cve_2025_49619.md | 61 | # - BROWSER_REMOTE_DEBUGGING_URL=http://host.docker.internal:9222/ | COMMENT |
| LOW | …ules/exploit/linux/http/skyvern_ssti_cve_2025_49619.md | 81 | # If you'd like to use Microsoft Azure OpenAI as your managed LLM service integration with Skyvern, use the environm | COMMENT |
| LOW | …ules/exploit/linux/http/skyvern_ssti_cve_2025_49619.md | 101 | # 4. In the Amazon Bedrock console, go to "Model Access" | COMMENT |
| LOW | …ules/exploit/linux/http/skyvern_ssti_cve_2025_49619.md | 121 | # - ENABLE_GROQ=true | COMMENT |
| LOW | …ules/exploit/linux/http/skyvern_ssti_cve_2025_49619.md | 161 | environment: {} | COMMENT |
| LOW | …ther/gladinet_storage_path_traversal_cve_2025_11371.md | 181 | filepath => Windows\System32\drivers\etc\hosts | COMMENT |
| LOW | …dules/auxiliary/gather/osticket_arbitrary_file_read.md | 981 | COMMENT | |
| LOW | …dules/auxiliary/gather/osticket_arbitrary_file_read.md | 1001 | # define('DBSSLKEY','/path/to/client.key'); | COMMENT |
| LOW | …xiliary/gather/gladinet_storage_access_ticket_forge.md | 301 | [*] Running automatic check ("set AutoCheck false" to disable) | COMMENT |
| LOW | …ation/modules/auxiliary/scanner/misc/clamav_control.md | 21 | # Default: no | COMMENT |
| LOW | …ation/modules/auxiliary/scanner/misc/clamav_control.md | 41 | # Default: 10M | COMMENT |
| LOW | tools/password/cpassword_decrypt.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/password/cpassword_decrypt.rb | 21 | # mubix (domain/dc enumeration code) | COMMENT |
| LOW | tools/password/md5_lookup.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/password/halflm_second.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/password/hmac_sha1_crack.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/password/vxmaster.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/hardware/elm327_relay.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/hardware/elm327_relay.rb | 361 | COMMENT | |
| LOW | tools/exploit/metasm_shell.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/exploit/virustotal.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/dev/find_and_replace_dead_reference_links.rb | 1 | ## | COMMENT |
| LOW | tools/dev/pre-commit-hook.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/dev/msftidy_docs.rb | 61 | # are usually style issues that may be okay for people who aren't core | COMMENT |
| LOW | tools/dev/hash_cracker_validator.rb | 221 | creds_command << ' creds add user:mysql_probe hash:445ff82636a7ba59 jtr:mysql;' | COMMENT |
| LOW | tools/dev/generate_mitre_attack_technique_constants.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/dev/update_gitlab_versions.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/dev/update_gitlab_versions.rb | 121 | # | COMMENT |
| LOW | tools/dev/msfmcp_integration_test.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/dev/msfmcp_integration_test.rb | 21 | # | COMMENT |
| LOW | tools/dev/msfmcp_integration_test.rb | 681 | { session_id: 99_999, data: 'whoami' }) | COMMENT |
| LOW | tools/modules/missing_payload_tests.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/modules/module_commits.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/modules/verify_datastore.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/modules/file_pull_requests.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/modules/committer_count.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | tools/recon/makeiplist.rb | 1 | #!/usr/bin/env ruby | COMMENT |
| LOW | app/concerns/mdm/workspace/boundary_range.rb | 1 | module Mdm::Workspace::BoundaryRange | COMMENT |
| LOW | test/kubernetes/lucee/Chart.yaml | 1 | apiVersion: v2 | COMMENT |
| LOW | test/kubernetes/lucee/values.yaml | 41 | # allowPrivilegeEscalation: false | COMMENT |
| LOW | test/kubernetes/lucee/values.yaml | 81 | # - secretName: chart-example-tls | COMMENT |
| LOW | test/kubernetes/secrets/Chart.yaml | 1 | apiVersion: v2 | COMMENT |
| LOW | test/kubernetes/thinkphp/Chart.yaml | 1 | apiVersion: v2 | COMMENT |
| LOW | test/kubernetes/thinkphp/values.yaml | 21 | serviceAccount: | COMMENT |
| LOW | test/kubernetes/thinkphp/values.yaml | 41 | # capabilities: | COMMENT |
| LOW | test/kubernetes/thinkphp/values.yaml | 81 | # - chart-example.local | COMMENT |
| LOW | plugins/ffautoregen.rb | 1 | module Msf | COMMENT |
| LOW | plugins/wiki.rb | 1 | ## | COMMENT |
| LOW | plugins/wiki.rb | 21 | COMMENT | |
| LOW | plugins/wiki.rb | 61 | # arguments to the wiki method with a wiki_type of 'mediawiki' | COMMENT |
| LOW | plugins/wiki.rb | 421 | end | COMMENT |
| LOW | plugins/lab.rb | 541 | # | COMMENT |
| LOW | plugins/sample.rb | 1 | module Msf | COMMENT |
| LOW | plugins/sample.rb | 61 | COMMENT | |
| LOW | plugins/msgrpc.rb | 1 | # | COMMENT |
| LOW | plugins/wmap.rb | 1 | # | COMMENT |
| LOW | plugins/wmap.rb | 21 | # @!attribute njobs | COMMENT |
| LOW | plugins/token_adduser.rb | 1 | # | COMMENT |
| LOW | plugins/request.rb | 201 | # @option opts [String] :auth_username An optional username to use with | COMMENT |
| LOW | plugins/request.rb | 221 | # @param opt_parser [Rex::Parser::Arguments] the argument parser for the | COMMENT |
| 2710 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ules/exploit/linux/http/skyvern_ssti_cve_2025_49619.md | 62 | # ========================= | COMMENT |
| MEDIUM | …ules/exploit/linux/http/skyvern_ssti_cve_2025_49619.md | 64 | # ========================= | COMMENT |
| MEDIUM | …t/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.md | 25 | #------------------------------------------- | COMMENT |
| MEDIUM | …t/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.md | 28 | #------------------------------------------- | COMMENT |
| MEDIUM | …dules/auxiliary/gather/osticket_arbitrary_file_read.md | 965 | # ==================================================== | COMMENT |
| MEDIUM | …dules/auxiliary/gather/osticket_arbitrary_file_read.md | 984 | # --------------------------------------------------- | COMMENT |
| MEDIUM | …dules/auxiliary/gather/osticket_arbitrary_file_read.md | 1005 | # =================================================== | COMMENT |
| MEDIUM | tools/dev/msfmcp_integration_test.rb | 49 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/dev/msfmcp_integration_test.rb | 51 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/dev/msfmcp_integration_test.rb | 263 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/dev/msfmcp_integration_test.rb | 265 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/dev/msfmcp_integration_test.rb | 412 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/dev/msfmcp_integration_test.rb | 414 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/dev/msfmcp_integration_test.rb | 1079 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tools/dev/msfmcp_integration_test.rb | 1081 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | plugins/openvas.rb | 210 | #-------------------------- | COMMENT |
| MEDIUM⚡ | plugins/openvas.rb | 212 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 123 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 125 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 153 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 155 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 268 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 270 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 407 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 409 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 430 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 432 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 452 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 454 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 539 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 541 | #-------------------------- | COMMENT |
| MEDIUM | plugins/openvas.rb | 564 | #------------------------------ | COMMENT |
| MEDIUM | plugins/openvas.rb | 566 | #------------------------------ | COMMENT |
| MEDIUM | plugins/besecure.rb | 75 | #-------------------------- | COMMENT |
| MEDIUM | plugins/besecure.rb | 77 | #-------------------------- | COMMENT |
| MEDIUM | plugins/besecure.rb | 163 | #-------------------------- | COMMENT |
| MEDIUM | plugins/besecure.rb | 165 | #-------------------------- | COMMENT |
| MEDIUM | plugins/besecure.rb | 321 | #------------------------------ | COMMENT |
| MEDIUM | plugins/besecure.rb | 323 | #------------------------------ | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 47 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 49 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 347 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 349 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 467 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 469 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 560 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 566 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 748 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 750 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 914 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 916 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 1023 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/vuln_attempt_registration_spec.rb | 1025 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/exploit/remote/ms_icpr_spec.rb | 60 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/exploit/remote/ms_icpr_spec.rb | 77 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/exploit/remote/ms_icpr_spec.rb | 108 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/exploit/remote/ms_icpr_spec.rb | 132 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/exploit/remote/ms_icpr_spec.rb | 156 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/exploit/remote/ms_icpr_spec.rb | 189 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | spec/lib/msf/core/exploit/remote/ms_icpr_spec.rb | 229 | # ------------------------------------------------------------------------- | COMMENT |
| 378 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …xploit/linux/http/lucee_admin_imgprocess_file_write.md | 86 | at lucee.runtime.type.util.StructSupport.invalidKey(StructSupport.java:67) | CODE |
| CRITICAL | …xploit/linux/http/lucee_admin_imgprocess_file_write.md | 125 | at lucee.runtime.type.util.StructSupport.invalidKey(StructSupport.java:67) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 105 | at com.vmware.vsan.client.services.ProxygenController.invokeService(ProxygenController.java:130) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 106 | at com.vmware.vsan.client.services.ProxygenController.invokeServiceWithJson(ProxygenController.java:64) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 111 | at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 112 | at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 113 | at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocable | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 114 | at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappin | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 115 | at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHand | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 116 | at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 117 | at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 118 | at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 119 | at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 120 | at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 122 | at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 125 | at org.eclipse.equinox.http.servlet.internal.registration.EndpointRegistration.service(EndpointRegistration.java:153) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 126 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:50) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 127 | at com.vmware.o6jia.context.web.filter.WelcomeFileFilter.doFilter(WelcomeFileFilter.java:48) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 129 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 130 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 131 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 133 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 134 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 135 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 137 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 138 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 139 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 141 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 142 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 143 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 145 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 146 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 147 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 149 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 150 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 151 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 153 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 154 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 155 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 157 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 158 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 159 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 161 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 162 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 163 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 165 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 166 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 167 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 169 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 170 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 171 | at com.vmware.vise.security.SessionManagementFilter.doFilter(SessionManagementFilter.java:219) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 172 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 174 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 175 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 176 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 178 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 179 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 180 | at com.vmware.o6jia.context.web.filter.ContextPathAwareDelegatingFilter.doFilter(ContextPathAwareDelegatingFilter.java: | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 182 | at org.eclipse.equinox.http.servlet.internal.registration.FilterRegistration.doFilter(FilterRegistration.java:121) | CODE |
| CRITICAL⚡ | …s/exploit/linux/http/vmware_vcenter_vsan_health_rce.md | 183 | at org.eclipse.equinox.http.servlet.internal.servlet.FilterChainImpl.doFilter(FilterChainImpl.java:45) | CODE |
| 66 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/password/vxmaster.rb | 49 | def vxworks_pass_from_sum_refine(sum, bsum, pass) | CODE |
| LOW | tools/dev/find_release_notes.rb | 67 | def update_release_notes_entry(n) | CODE |
| LOW | tools/dev/find_release_notes.rb | 103 | def get_release_notes_from_module_name(n, input) | CODE |
| LOW | tools/dev/find_release_notes.rb | 111 | def get_release_notes_from_pr(n, pr) | CODE |
| LOW | tools/modules/file_pull_requests.rb | 90 | def get_pull_requests_from_commits(commits) | CODE |
| LOW | tools/modules/file_pull_requests.rb | 109 | def get_pull_request_from_commit(commit) | CODE |
| LOW | test/lib/regexr.rb | 30 | def find_strings_that_dont_exist_in_data(data, regexes = []) | CODE |
| LOW | test/lib/regexr.rb | 65 | def find_strings_that_exist_in_data_except(data, regexes = [], exceptions = []) | CODE |
| LOW | test/lib/msf_matchers.rb | 88 | def contain_no_failures_except(failures = [], exceptions = []) | CODE |
| LOW | test/functional/framework/msfconsole_spec.rb | 187 | def generate_java_meterpreter_session(input, output) | CODE |
| LOW | test/functional/framework/msfconsole_spec.rb | 191 | def generate_php_meterpreter_session(input, output) | CODE |
| LOW | test/functional/meterpreter/meterpreter_spec_helper.rb | 13 | def hlp_run_command_check_output(name, command, success_strings = [], fail_strings = [], fail_exception_strings | CODE |
| LOW⚡ | plugins/session_notifier.rb | 48 | def cmd_set_session_smtp_address(*args) | CODE |
| LOW⚡ | plugins/session_notifier.rb | 52 | def cmd_set_session_smtp_port(*args) | CODE |
| LOW⚡ | plugins/session_notifier.rb | 61 | def cmd_set_session_smtp_username(*args) | CODE |
| LOW⚡ | plugins/session_notifier.rb | 65 | def cmd_set_session_smtp_password(*args) | CODE |
| LOW⚡ | plugins/session_notifier.rb | 69 | def cmd_set_session_smtp_from(*args) | CODE |
| LOW⚡ | plugins/session_notifier.rb | 73 | def cmd_set_session_mobile_number(*args) | CODE |
| LOW⚡ | plugins/session_notifier.rb | 82 | def cmd_set_session_mobile_carrier(*args) | CODE |
| LOW⚡ | plugins/session_notifier.rb | 86 | def cmd_set_session_minimum_ip(*args) | CODE |
| LOW | plugins/session_notifier.rb | 97 | def cmd_set_session_maximum_ip(*args) | CODE |
| LOW | plugins/session_notifier.rb | 108 | def cmd_set_session_gotify_address(*args) | CODE |
| LOW | plugins/session_notifier.rb | 120 | def cmd_set_session_gotify_sslcert_path(*args) | CODE |
| LOW | plugins/session_notifier.rb | 131 | def cmd_set_session_dingtalk_webhook(*args) | CODE |
| LOW | plugins/session_notifier.rb | 142 | def cmd_set_session_serverjang_webhook(*args) | CODE |
| LOW | plugins/session_notifier.rb | 153 | def cmd_save_session_notifier_settings(*_args) | CODE |
| LOW | plugins/session_notifier.rb | 158 | def cmd_start_session_notifier(*_args) | CODE |
| LOW | plugins/session_notifier.rb | 192 | def cmd_stop_session_notifier(*_args) | CODE |
| LOW | plugins/session_notifier.rb | 197 | def cmd_restart_session_notifier(*args) | CODE |
| LOW | plugins/nessus.rb | 425 | def cmd_nessus_server_properties(*args) | CODE |
| LOW | plugins/nessus.rb | 709 | def cmd_nessus_report_host_details(*args) | CODE |
| LOW | plugins/nessus.rb | 776 | def cmd_nessus_report_download(*args) | CODE |
| LOW | plugins/nessus.rb | 808 | def cmd_nessus_report_host_ports(*args) | CODE |
| LOW | plugins/nessus.rb | 1106 | def cmd_nessus_db_scan_workspace(*args) | CODE |
| LOW | plugins/nessus.rb | 1231 | def cmd_nessus_scan_pause_all(*args) | CODE |
| LOW | plugins/nessus.rb | 1347 | def cmd_nessus_scan_resume_all(*args) | CODE |
| LOW | plugins/nessus.rb | 1518 | def cmd_nessus_scan_export_status(*args) | CODE |
| LOW | plugins/nessus.rb | 1625 | def cmd_nessus_plugin_details(*args) | CODE |
| LOW | plugins/payloads_manager.rb | 468 | def archived_payload_source_path(payload_path, context: nil, require_exists: true) | CODE |
| LOW | plugins/payloads_manager.rb | 485 | def fetch_to_archive_with_redirects(uri, requested_name = nil, limit = 5, max_size = MAX_FETCH_SIZE) | CODE |
| LOW | plugins/nexpose.rb | 240 | def cmd_nexpose_report_templates(*_args) | CODE |
| LOW⚡ | plugins/openvas.rb | 213 | def cmd_openvas_target_create(*args) | CODE |
| LOW | plugins/openvas.rb | 230 | def cmd_openvas_target_delete(*args) | CODE |
| LOW | plugins/openvas.rb | 392 | def cmd_openvas_task_resume_or_start(*args) | CODE |
| LOW | plugins/openvas.rb | 482 | def cmd_openvas_report_delete(*args) | CODE |
| LOW | plugins/openvas.rb | 498 | def cmd_openvas_report_download(*args) | CODE |
| LOW | plugins/openvas.rb | 520 | def cmd_openvas_report_import(*args) | CODE |
| LOW | plugins/aggregator.rb | 268 | def cmd_aggregator_cable_remove(*args) | CODE |
| LOW | plugins/aggregator.rb | 282 | def cmd_aggregator_session_park(*args) | CODE |
| LOW | plugins/aggregator.rb | 305 | def cmd_aggregator_default_forward(*_args) | CODE |
| LOW | plugins/aggregator.rb | 311 | def cmd_aggregator_session_forward(*args) | CODE |
| LOW | plugins/aggregator.rb | 333 | def cmd_aggregator_disconnect(*_args) | CODE |
| LOW | plugins/besecure.rb | 228 | def cmd_besecure_report_download(*args) | CODE |
| LOW | plugins/besecure.rb | 295 | def cmd_besecure_report_import(*args) | CODE |
| LOW | spec/acceptance/meterpreter_spec.rb | 166 | def get_file_attachment_contents(path) | CODE |
| LOW | spec/acceptance/command_shell_spec.rb | 169 | def get_file_attachment_contents(path) | CODE |
| LOW | …hared/contexts/msf/simple/framework/modules/loading.rb | 47 | def derive_ancestor_reference_names(options={}) | CODE |
| LOW | …hared/contexts/msf/simple/framework/modules/loading.rb | 84 | def expect_to_load_module_ancestor(options={}) | CODE |
| LOW | …hared/contexts/msf/simple/framework/modules/loading.rb | 106 | def expect_to_load_module_ancestors(options={}) | CODE |
| LOW | spec/support/matchers/match_table.rb | 22 | def with_whitespace_highlighted(string) | CODE |
| 864 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/modules/exploits/test/egghunter.rb | 76 | # just return otherwise | COMMENT |
| MEDIUM⚡ | test/functional/meterpreter/java_meterpreter_specs.rb | 3 | ## This file is intended to be used in conjunction with a harness, | COMMENT |
| MEDIUM⚡ | test/functional/meterpreter/java_meterpreter_specs.rb | 3 | ## This file is intended to be used in conjunction with a harness, | COMMENT |
| MEDIUM⚡ | …st/functional/meterpreter/windows_meterpreter_specs.rb | 3 | ## This file is intended to be used in conjunction with a harness, | COMMENT |
| MEDIUM⚡ | …st/functional/meterpreter/windows_meterpreter_specs.rb | 3 | ## This file is intended to be used in conjunction with a harness, | COMMENT |
| LOW | plugins/lab.rb | 103 | # then you are probably specifying a full path so let's just use normal file completion | COMMENT |
| LOW | plugins/alias.rb | 233 | # don't mess around, just return false in this case, prevents wasted processing | COMMENT |
| LOW | plugins/alias.rb | 245 | # don't mess around, just return false if we match | COMMENT |
| MEDIUM | …/support/acceptance/protocol_session_shared_context.rb | 68 | # Run the given block in a test harness that handles asserting module results, | COMMENT |
| MEDIUM | spec/support/acceptance/countdown.rb | 3 | # A utility class which can be used in conjunction with Timeout mechanisms | COMMENT |
| MEDIUM | spec/support/matchers/query_the_database.rb | 9 | # * <tt>with</tt> - Used in conjunction with <tt>when_calling</tt> to pass parameters to the method to examine. | COMMENT |
| LOW | spec/lib/msf/core/rhosts_walker_spec.rb | 33 | # Slice the datastore options that we care about, ignoring other values that just add noise such as VERBOSE/WORKSP | COMMENT |
| MEDIUM | …stdapi/net/socket_subsystem/tcp_server_channel_spec.rb | 8 | # Uses a harness replicating the Queue-based implementation to avoid needing | COMMENT |
| MEDIUM | scripts/meterpreter/scraper.rb | 33 | # Some of this script was developed in conjunction with _MAX_ (max[at]remote-exploit.org) | COMMENT |
| MEDIUM | lib/msf/ui/console/module_action_commands.rb | 11 | # A mixin to enable the ModuleCommandDispatcher to leverage module ACTIONs as commands. | COMMENT |
| MEDIUM | lib/msf/ui/console/command_dispatcher/modules.rb | 1820 | # copying module names in conjunction with the `use <paste-buffer>` command | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher/common.rb | 102 | # For short lists, just set it directly | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher/session.rb | 238 | # then you are probably specifying a full path so let's just use normal file completion | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher/resource.rb | 92 | # then you are probably specifying a full path so let's just use normal file completion | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher/dns.rb | 95 | # Hard to auto-complete a rule with any meaningful value; just return | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher/db.rb | 324 | # help methods, just use it's "-h" so we don't have to recreating | COMMENT |
| MEDIUM | lib/msf/core/exploit.rb | 307 | # Allow all exploits to leverage context keyed encoding | COMMENT |
| LOW | lib/msf/core/payload_set.rb | 298 | # the payload set we simply create an instance of the class and do some | COMMENT |
| MEDIUM | lib/msf/core/exploit_event.rb | 4 | # notifications about events pertaining to exploitation. | COMMENT |
| MEDIUM | lib/msf/core/exploit/seh.rb | 9 | # robust fashion using the Rex::Exploitation::Seh class. | COMMENT |
| LOW | lib/msf/core/exploit/remote/tincd_exploit_client.rb | 246 | # modified decrypt routine, simply use the cipher as is. | COMMENT |
| LOW | lib/msf/core/exploit/remote/browser_autopwn2.rb | 76 | # again, it will just return whatever's been stored in the @browser_profile_prefix instance variable. | COMMENT |
| LOW | lib/msf/core/exploit/remote/socket_server.rb | 140 | # payload. In that case, just use the address of the interface | COMMENT |
| MEDIUM | lib/msf/core/exploit/remote/jndi_injection.rb | 4 | # This is a mixin containing methods to facilitate exploiting JNDI injection flaws (such as Log4Shell) by using a | COMMENT |
| LOW | lib/msf/core/exploit/remote/unirpc.rb | 50 | # so just use secure mode to cover all bases | COMMENT |
| LOW | lib/msf/core/exploit/remote/http_client.rb | 849 | # Otherwise just return the signature string for compatibility | COMMENT |
| LOW | lib/msf/core/exploit/remote/http_client.rb | 979 | # Otherwise just return the signature string for compatibility | COMMENT |
| MEDIUM | lib/msf/core/exploit/remote/telnet.rb | 82 | # This hash is defined in order help facilitate easy debug printing | COMMENT |
| LOW | lib/msf/core/exploit/remote/http/exchange.rb | 15 | # If we already built the exchange builds array, then just return it. | COMMENT |
| LOW | lib/msf/core/exploit/remote/http/exchange.rb | 147 | # If we reach here we couldn't find the Exchange Server version, so just return nil to indicate this. | COMMENT |
| LOW | lib/msf/core/post/file.rb | 980 | # just use append to finish the rest | COMMENT |
| LOW | lib/msf/core/post/windows/cli_parse.rb | 146 | if ma = /^error:.*/i.match(results) # if line starts with Error: just pass to regular parser | CODE |
| MEDIUM | lib/msf/core/post/windows/task_scheduler.rb | 97 | # elevate privileges if the session is not already running under | COMMENT |
| MEDIUM | lib/msf/core/post/windows/task_scheduler.rb | 138 | # elevate privileges if the session is not already running under | COMMENT |
| MEDIUM | lib/msf/core/post/windows/task_scheduler.rb | 214 | # will also try to elevate privileges if the session is not already | COMMENT |
| MEDIUM | lib/msf/core/module/platform.rb | 269 | # utilize this as a catch-all. | COMMENT |
| MEDIUM | lib/msf/core/payload/php.rb | 25 | # Canonicalize the list of disabled functions to facilitate choosing a | COMMENT |
| MEDIUM | lib/msf/core/payload/single.rb | 22 | # used in conjunction with a stager. When a stager is used, generate will | COMMENT |
| LOW | lib/msf/core/payload/linux/reverse_tcp_x86.rb | 102 | # If the lower byte will be the same, just set the upper byte | COMMENT |
| LOW | lib/msf/core/payload/windows/prepend_migrate.rb | 178 | # and so we can just set ebx to the size of the payload | COMMENT |
| LOW | lib/msf/core/payload/windows/prepend_migrate.rb | 352 | # and so we can just set r8 to the size of the payload | COMMENT |
| LOW | lib/msf/core/exe/segment_injector.rb | 57 | # if there is no entry point, just return after we bail or spawn shellcode | COMMENT |
| LOW | lib/msf/core/rpc/json/v1_0/rpc_command.rb | 112 | # modified; otherwise, the object will simply pass-through. | COMMENT |
| LOW | lib/msf/core/modules/loader/base.rb | 134 | # read_module_content is responsible for calling {#load_error}, so just return here. | COMMENT |
| MEDIUM | lib/msf/util/document_generator/document_normalizer.rb | 279 | !mod.kind_of?(Msf::Exploit::FILEFORMAT) && # Definitely not a file format | CODE |
| LOW | lib/msf/base/sessions/meterpreter.rb | 655 | # otherwise just use the base for the session type tied to this handler. | COMMENT |
| LOW | lib/msf/base/sessions/meterpreter.rb | 669 | # otherwise just use the base for the session type tied to this handler. | COMMENT |
| LOW | lib/rex/transformer.rb | 49 | # If the src instance's class is supported, just add it to the dst | COMMENT |
| LOW | …ex/post/hwbridge/ui/console/command_dispatcher/core.rb | 417 | [ # We can just use Meterpreters script path | CODE |
| LOW | lib/rex/post/meterpreter/client_core.rb | 120 | # binaries, we end up with a case where this fails. So here we just return the | COMMENT |
| LOW | …post/meterpreter/ui/console/command_dispatcher/kiwi.rb | 618 | # Otherwise, just add a blank value | COMMENT |
| MEDIUM | …erpreter/ui/console/command_dispatcher/priv/elevate.rb | 77 | # Attempt to elevate the meterpreter to that of local system. | COMMENT |
| LOW | …x/post/meterpreter/extensions/powershell/powershell.rb | 41 | # if it's a script, then we'll just use execute_string | COMMENT |
| MEDIUM | lib/rex/post/meterpreter/extensions/priv/priv.rb | 56 | # Attempt to elevate the meterpreter to Local SYSTEM | COMMENT |
| MEDIUM | lib/rex/post/meterpreter/extensions/priv/priv.rb | 66 | # We only need the elevate DLL for when we're invoking the TokenDup or | COMMENT |
| 150 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/dev/detect_dead_reference_links.rb | 101 | # Check if the URL is valid | COMMENT |
| LOW | test/ldap/samba-ad-setup.sh | 11 | # Check if samba is setup | COMMENT |
| LOW | plugins/nessus.rb | 309 | # Check if config file exists and load it | COMMENT |
| LOW | plugins/wmap.rb | 784 | # Check if an exclusion regex has been defined | COMMENT |
| LOW | scripts/meterpreter/process_memdump.rb | 111 | # Check if Allocated | COMMENT |
| LOW | scripts/meterpreter/virusscan_bypass.rb | 201 | # Set registry to run executable at startup | COMMENT |
| LOW⚡ | scripts/meterpreter/service_manager.rb | 60 | # Check if sufficient privileges are present for certain actions | COMMENT |
| LOW | scripts/meterpreter/hashdump.rb | 154 | #Check if hashes exist (if 20, then we've got a hash) | COMMENT |
| LOW | scripts/meterpreter/hostsedit.rb | 40 | #Set path to the hosts file | COMMENT |
| LOW | lib/msf/ui/console/driver.rb | 75 | # Check if files have been modified and force immediate loading if so. | COMMENT |
| LOW⚡ | lib/msf/ui/console/driver.rb | 668 | # Check if we want to write the log to file | COMMENT |
| LOW⚡ | lib/msf/ui/console/driver.rb | 676 | # Check if we want to write the log file to a directory | COMMENT |
| LOW⚡ | lib/msf/ui/console/driver.rb | 684 | # Check if the subdirectory exists | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher.rb | 111 | # Check if the item is negative, as this will not always be a range | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher/auxiliary.rb | 64 | # Check if this is a scanner module or doesn't target remote hosts | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher/core.rb | 2266 | # Check if we need to append the default filename if user provided an output directory | COMMENT |
| LOW | lib/msf/ui/console/command_dispatcher/db.rb | 2302 | # Check if the stderr text includes 'root', this only happens if the scan requires root privileges | COMMENT |
| LOW | lib/msf/core/plugin_manager.rb | 77 | # Add it to the list of plugins | COMMENT |
| LOW | lib/msf/core/opt_meterpreter_debug_logging.rb | 48 | # Check if we log to rpath | COMMENT |
| LOW | lib/msf/core/exploit/laravel_crypto_killer.rb | 16 | # Check if cipher is valid | COMMENT |
| LOW | lib/msf/core/exploit/file_dropper.rb | 123 | # Check if file_rm method is available (local exploit, mixin support, module support) | COMMENT |
| LOW | lib/msf/core/exploit/file_dropper.rb | 135 | # Check if dir_rm method is available (local exploit, mixin support, module support) | COMMENT |
| LOW | lib/msf/core/exploit/file_dropper.rb | 278 | # Check if the path being removed is the same as the working directory | COMMENT |
| LOW | lib/msf/core/exploit/java.rb | 154 | # Check if the keystore exists from previous run. If it does, delete it. | COMMENT |
| LOW | lib/msf/core/exploit/remote/tincd_exploit_client.rb | 264 | # Check if we already received a newline, meaning we got an | COMMENT |
| LOW | lib/msf/core/exploit/remote/browser_autopwn2.rb | 689 | # Check if target is on our whitelist | COMMENT |
| LOW | …f/core/exploit/remote/http/gitlab/form/authenticate.rb | 32 | # Check if a valid gitlab cookie is returned | COMMENT |
| LOW | lib/msf/core/exploit/remote/http/wordpress/login.rb | 19 | # Check if a valid wordpress cookie is returned | COMMENT |
| LOW | …/remote/http/manage_engine_adaudit_plus/target_info.rb | 248 | # Check if the GPOWatcherData endpoint is available | COMMENT |
| LOW | …xploit/remote/http/manage_engine_adaudit_plus/login.rb | 49 | # Check if we have an initial adapcsrf cookie with the expected format | COMMENT |
| LOW | …xploit/remote/http/manage_engine_adaudit_plus/login.rb | 117 | # Check if we are actually logged in by visiting the home page. | COMMENT |
| LOW | lib/msf/core/exploit/remote/http/nagios_xi/login.rb | 124 | # Check if we are perhaps dealing with a Nagios XI app that hasn't been fully installed yet | COMMENT |
| LOW | lib/msf/core/exploit/remote/http/nagios_xi/login.rb | 236 | # Check if we need to sign the license agreement | COMMENT |
| LOW | lib/msf/core/post/hardware/zigbee/utils.rb | 53 | # Verify if a device has been specified. | COMMENT |
| LOW | lib/msf/core/post/hardware/zigbee/utils.rb | 156 | # Check if we are dealing with a beacon frame | COMMENT |
| LOW | lib/msf/core/post/windows/packrat.rb | 219 | # Check if the applications's base folder exists in user's directory on the remote computer. | COMMENT |
| LOW | lib/msf/core/post/windows/accounts.rb | 69 | # Check if host is an Active Directory domain controller | COMMENT |
| LOW | lib/msf/core/post/windows/services.rb | 288 | # Check if the specified Windows service exists. | COMMENT |
| LOW | lib/msf/core/module/failure.rb | 86 | # Check if RHOST is a valid IP address to avoid ActiveRecord issues on validation | COMMENT |
| LOW | lib/msf/core/module_manager/reloading.rb | 41 | # Check if the namespace module has a loader | COMMENT |
| LOW | lib/msf/core/payload/android.rb | 100 | # Set not_after to a random time 2~ years before the first bad date. | COMMENT |
| LOW | lib/msf/core/payload/windows/reverse_tcp.rb | 152 | # Check if a bind port was specified | COMMENT |
| LOW | lib/msf/core/payload/windows/prepend_migrate.rb | 105 | # Check if we can find block_api in the payload | COMMENT |
| LOW | lib/msf/core/payload/windows/prepend_migrate.rb | 282 | # Check if we can find block_api in the payload | COMMENT |
| LOW | lib/msf/core/mcp/rpc_manager.rb | 274 | # Check if the managed child process is still alive. | COMMENT |
| LOW | lib/msf/core/mcp/security/rate_limiter.rb | 20 | # Check if request is allowed, consume token if yes | COMMENT |
| LOW | lib/msf/core/db_manager/connection.rb | 124 | # Check if we are actually connected to the proper DB | COMMENT |
| LOW | lib/msf/core/db_manager/host.rb | 79 | # Set host_id to the ID of the host entry in the database that was found. | COMMENT |
| LOW | …eb_services/authentication/strategies/user_password.rb | 18 | # Check if request contains valid data and should be authenticated. | COMMENT |
| LOW | …re/web_services/authentication/strategies/api_token.rb | 10 | # Check if request contains valid data and should be authenticated. | COMMENT |
| LOW | lib/msf/core/auxiliary/auth_brute.rb | 298 | # Set noconn to indicate that in this case, each_user_pass | COMMENT |
| LOW | lib/msf/core/auxiliary/gladinet.rb | 34 | # Check if content contains a machineKey | COMMENT |
| LOW | lib/msf/core/auxiliary/gladinet.rb | 75 | # Check if target is a Gladinet CentreStack/Triofox installation | COMMENT |
| LOW | lib/msf/core/auxiliary/cnpilot.rb | 43 | # Check if App is Cambium cnPilot | COMMENT |
| LOW | lib/msf/core/auxiliary/epmp.rb | 43 | # Check if App is Cambium ePMP 1000 | COMMENT |
| LOW | lib/msf/util/exe/common.rb | 65 | # Check if it exists now | COMMENT |
| LOW | lib/msf/base/sessions/command_shell.rb | 421 | # Check if src exists | COMMENT |
| LOW | lib/msf/base/sessions/command_shell.rb | 431 | # Write file to local machine | COMMENT |
| LOW | …ex/post/hwbridge/ui/console/command_dispatcher/core.rb | 570 | # Insert the module into the list of extensions | COMMENT |
| LOW | lib/rex/post/meterpreter/packet.rb | 781 | # Insert it into the list of TLVs | COMMENT |
| 220 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tools/dev/msfmcp_integration_test.rb | 743 | # Step 2: wait for the run to complete (uuid appears in :results). | COMMENT |
| LOW⚡ | tools/dev/msfmcp_integration_test.rb | 752 | # Step 3: poll the run's result text for the 'session N opened' line. | COMMENT |
| LOW⚡ | tools/dev/msfmcp_integration_test.rb | 803 | # Step 5: send the type-appropriate probe command. | COMMENT |
| LOW⚡ | tools/dev/msfmcp_integration_test.rb | 810 | # Step 6: poll session_read for the expected output (or, for DB/SMB/LDAP | COMMENT |
| LOW | tools/dev/msfmcp_integration_test.rb | 725 | # Step 1: launch the exploit. | COMMENT |
| LOW | tools/dev/msfmcp_integration_test.rb | 791 | # Step 4: confirm the session is in msf_session_list, and capture its | COMMENT |
| LOW | …mework.wiki/How-to-write-a-HTTP-LoginScanner-Module.md | 5 | ## Step 1: Set up your target environment | COMMENT |
| LOW | …mework.wiki/How-to-write-a-HTTP-LoginScanner-Module.md | 9 | ## Step 2: Set up a client | COMMENT |
| LOW | …mework.wiki/How-to-write-a-HTTP-LoginScanner-Module.md | 72 | ## Step 3: Start with a LoginScanner template | COMMENT |
| LOW | …mework.wiki/How-to-write-a-HTTP-LoginScanner-Module.md | 236 | ## Step 4: Write the auxiliary module | COMMENT |
| LOW | …ework.wiki/How-to-use-a-reverse-shell-in-Metasploit.md | 91 | ### Step 1: Generate the executable payload | COMMENT |
| LOW | …ework.wiki/How-to-use-a-reverse-shell-in-Metasploit.md | 105 | ### Step 2: Copy the executable payload to box B | COMMENT |
| LOW | …ework.wiki/How-to-use-a-reverse-shell-in-Metasploit.md | 109 | ### Step 3: Set up the payload handler on box A | COMMENT |
| LOW | …ework.wiki/How-to-use-a-reverse-shell-in-Metasploit.md | 128 | ### Step 4: Double-click on the malicious executable | COMMENT |
| LOW | …ework.wiki/How-to-use-a-reverse-shell-in-Metasploit.md | 132 | ### Step 5: View the meterpreter/payload session on box A | COMMENT |
| LOW | …sploit-framework.wiki/Using-ReflectiveDLL-Injection.md | 9 | ### Step 1 - Make your DLL | COMMENT |
| LOW | …sploit-framework.wiki/Using-ReflectiveDLL-Injection.md | 93 | ## Step 4: Adding the framework module | COMMENT |
| LOW | …cs/metasploit-framework.wiki/kerberos/kerberoasting.md | 52 | ### Step 1: Harvest hashes with `auxiliary/gather/kerberoast` | COMMENT |
| LOW | …cs/metasploit-framework.wiki/kerberos/kerberoasting.md | 94 | ### Step 2: Crack the hash with `auxiliary/analyze/crack_windows` | COMMENT |
| LOW | …cs/metasploit-framework.wiki/kerberos/kerberoasting.md | 130 | ### Step 3: View the recovered credentials | COMMENT |
| LOW | lib/msf/core/exploit.rb | 57 | # NOTE: This class relies on the array-like interface of Struct classes to | COMMENT |
| LOW | lib/msf/core/exploit/remote/ftp.rb | 411 | # NOTE: This function always waits for a response from the server. | COMMENT |
| LOW | lib/metasploit/framework/ftp/client.rb | 136 | # NOTE: This function always waits for a response from the server. | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 509 | # Step 2: get the current app server configuration variables, such as the current auth method used | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 519 | # Step 3: start the fake CAM server / exploit server | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 539 | # Step 4: send the server config update packet, and ignore what it sends back | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 546 | # Step 5: send the CAM auth request and obtain the authentication object | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 628 | # Step 7: add the commands into the process object | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 635 | # Step 8: register the Process object with a random name | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 640 | # Step 9: execute the Process! | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 645 | # Step 10: restore the auth method and enjoy the shell! | COMMENT |
| LOW | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 409 | # Step 1: fetch the available applications / servers from the Admin server | COMMENT |
| LOW | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 594 | # Step 6: create a Process object | COMMENT |
| LOW | …les/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb | 405 | # Step 1 - Make T3 connection to start IIOP connection process, and read response. | COMMENT |
| LOW | …les/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb | 413 | # Step 2 - Send first GIOP LocateRequest packet | COMMENT |
| LOW | …les/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb | 513 | # Step 3 - Make a rebindAny request | COMMENT |
| LOW | …les/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb | 582 | # Step 4 - rebind_any Request Again??? | COMMENT |
| LOW | …les/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb | 613 | # Step 5 - Send second GIOP LocateRequest packet | COMMENT |
| LOW | …les/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb | 626 | # Step 6 - Resolve packet #1 with wls_key_1 | COMMENT |
| LOW | …les/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb | 657 | # Step 7 - Resolve packet #2 with wls_key_2 | COMMENT |
| LOW | …les/exploits/multi/browser/firefox_webidl_injection.rb | 116 | // Step 2: load the chrome-level window up with a data URI, which | COMMENT |
| LOW | modules/exploits/multi/http/cacti_pollers_sqli_rce.rb | 115 | # Step 1 - Check if the target is Cacti and get the version | COMMENT |
| LOW | modules/exploits/multi/http/cacti_pollers_sqli_rce.rb | 140 | # Step 2 - Login | COMMENT |
| LOW | modules/exploits/multi/http/cacti_pollers_sqli_rce.rb | 152 | # Step 3 - Check if the user has enough permissions to reach `pollers.php` | COMMENT |
| LOW | modules/exploits/multi/http/cacti_pollers_sqli_rce.rb | 166 | # Step 4 - Check if it is vulnerable to SQLi | COMMENT |
| LOW | …xploits/multi/http/opmanager_sumpdu_deserialization.rb | 146 | # Step 1: Establish a valid HTTP session | COMMENT |
| LOW | …xploits/multi/http/opmanager_sumpdu_deserialization.rb | 174 | # Step 2: Add the requestHandler to the HTTP session | COMMENT |
| LOW | …xploits/multi/http/opmanager_sumpdu_deserialization.rb | 192 | # Step 3: Exploit the deserialization vulnerability to run commands | COMMENT |
| LOW | modules/exploits/multi/http/cacti_package_import_rce.rb | 103 | # Step 1 - Check if the target is Cacti and get the version | COMMENT |
| LOW | modules/exploits/multi/http/cacti_package_import_rce.rb | 128 | # Step 2 - Login | COMMENT |
| LOW | modules/exploits/multi/http/cacti_package_import_rce.rb | 140 | # Step 3 - Check if the user has enough permissions to reach `package_import.php` | COMMENT |
| LOW | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 180 | # Step 1 : Start HTTP server for XSL file serving | COMMENT |
| LOW⚡ | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 194 | # Step 2: Get CSRF token | COMMENT |
| LOW⚡ | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 202 | # Step 3: Smuggle payload | COMMENT |
| LOW⚡ | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 208 | # Step 4: Send exploit request | COMMENT |
| LOW⚡ | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 212 | # Step 5: Wait for XSLT file download | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 59 | # Step 1: Retrieve PHPSESSID | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 80 | # Step 2: Attempt File Upload | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 106 | # Step 3: Verify File in Directory Listing | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 129 | # Step 1: Detect the OS | COMMENT |
| 50 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tion/modules/exploit/multi/http/wp_acf_extended_rce.md | 74 | --admin_email='admin@example.com' \ | CODE |
| LOW | …t/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.md | 62 | --admin_email='admin@example.com' \ | CODE |
| LOW | …loit/multi/http/wp_king_addons_privilege_escalation.md | 85 | wp core install --path='/var/www/html' --url='http://localhost:5556' --title='Exploit Market' --admin_user='admin' --adm | CODE |
| LOW | …entation/modules/exploit/multi/http/flowise_mcp_rce.md | 37 | -d '{"user":{"name":"Admin","email":"admin@example.com","credential":"Password123!"}}' | CODE |
| LOW | …ion/modules/exploit/multi/http/wp_ai_engine_mcp_rce.md | 94 | docker exec wp-ai-engine-lab wp core install --path='/var/www/html' --url='http://localhost:5555' --title='Exploit Marke | CODE |
| LOW | …ation/modules/auxiliary/admin/kerberos/forge_ticket.md | 36 | 6. Do: `set USER fake_user` | CODE |
| LOW | …t/smb/shares/readonly/my_directory/accessible_file.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | …t/smb/shares/readonly/my_directory/accessible_file.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | …t/smb/shares/modifiable/recursive/admin_root/readme.md | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | …t/smb/shares/modifiable/recursive/admin_root/readme.md | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliq | CODE |
| LOW | test/kubernetes/secrets/templates/dockerconfigjson.yaml | 8 | '{"auths":{"https://index.docker.io/v1/":{"username":"username","password":"password","email":"admin@example.com","a | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 19 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 19 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 58 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 58 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 81 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 81 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 104 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 104 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 130 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 130 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 156 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 156 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 182 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 182 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 207 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 207 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 232 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 232 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 258 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 258 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 285 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 285 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 312 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 312 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 339 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 339 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 368 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/lint/module_enforce_notes_spec.rb | 368 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …ubocop/cop/lint/module_disclosure_date_present_spec.rb | 19 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …ubocop/cop/lint/module_disclosure_date_present_spec.rb | 19 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …ubocop/cop/lint/module_disclosure_date_present_spec.rb | 40 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …ubocop/cop/lint/module_disclosure_date_present_spec.rb | 40 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 27 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 27 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 48 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 48 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 68 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 68 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 90 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 90 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 105 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 105 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 123 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 123 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 143 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | …rubocop/cop/lint/module_disclosure_date_format_spec.rb | 143 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/layout/module_hash_on_new_line_spec.rb | 23 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/layout/module_hash_on_new_line_spec.rb | 23 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| LOW | spec/rubocop/cop/layout/module_hash_on_new_line_spec.rb | 43 | 'Description' => 'Lorem ipsum dolor sit amet', | CODE |
| 135 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tools/dev/msfmcp_integration_test.rb | 743 | # Step 2: wait for the run to complete (uuid appears in :results). | COMMENT |
| LOW⚡ | tools/dev/msfmcp_integration_test.rb | 752 | # Step 3: poll the run's result text for the 'session N opened' line. | COMMENT |
| LOW⚡ | tools/dev/msfmcp_integration_test.rb | 803 | # Step 5: send the type-appropriate probe command. | COMMENT |
| LOW⚡ | tools/dev/msfmcp_integration_test.rb | 810 | # Step 6: poll session_read for the expected output (or, for DB/SMB/LDAP | COMMENT |
| LOW | tools/dev/msfmcp_integration_test.rb | 725 | # Step 1: launch the exploit. | COMMENT |
| LOW | tools/dev/msfmcp_integration_test.rb | 791 | # Step 4: confirm the session is in msf_session_list, and capture its | COMMENT |
| LOW | lib/msf/core/exploit/remote/http_client.rb | 865 | # This section handles a few simple cases of pattern matching and service | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 509 | # Step 2: get the current app server configuration variables, such as the current auth method used | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 519 | # Step 3: start the fake CAM server / exploit server | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 539 | # Step 4: send the server config update packet, and ignore what it sends back | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 546 | # Step 5: send the CAM auth request and obtain the authentication object | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 628 | # Step 7: add the commands into the process object | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 635 | # Step 8: register the Process object with a random name | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 640 | # Step 9: execute the Process! | COMMENT |
| LOW⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 645 | # Step 10: restore the auth method and enjoy the shell! | COMMENT |
| LOW | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 409 | # Step 1: fetch the available applications / servers from the Admin server | COMMENT |
| LOW | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 594 | # Step 6: create a Process object | COMMENT |
| LOW | …les/exploits/multi/browser/firefox_webidl_injection.rb | 116 | // Step 2: load the chrome-level window up with a data URI, which | COMMENT |
| LOW | …xploits/multi/http/opmanager_sumpdu_deserialization.rb | 146 | # Step 1: Establish a valid HTTP session | COMMENT |
| LOW | …xploits/multi/http/opmanager_sumpdu_deserialization.rb | 174 | # Step 2: Add the requestHandler to the HTTP session | COMMENT |
| LOW | …xploits/multi/http/opmanager_sumpdu_deserialization.rb | 192 | # Step 3: Exploit the deserialization vulnerability to run commands | COMMENT |
| LOW | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 180 | # Step 1 : Start HTTP server for XSL file serving | COMMENT |
| LOW⚡ | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 194 | # Step 2: Get CSRF token | COMMENT |
| LOW⚡ | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 202 | # Step 3: Smuggle payload | COMMENT |
| LOW⚡ | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 208 | # Step 4: Send exploit request | COMMENT |
| LOW⚡ | …ts/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb | 212 | # Step 5: Wait for XSLT file download | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 59 | # Step 1: Retrieve PHPSESSID | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 80 | # Step 2: Attempt File Upload | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 106 | # Step 3: Verify File in Directory Listing | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 129 | # Step 1: Detect the OS | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 154 | # Step 2: Retrieve the actual uploaded filename | COMMENT |
| LOW | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 171 | # Step 3: Execute the detection script | COMMENT |
| LOW⚡ | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 183 | # Step 4: Choose payload based on OS | COMMENT |
| LOW⚡ | …dules/exploits/multi/http/clinic_pms_fileupload_rce.rb | 192 | # Step 5: Upload the payload | COMMENT |
| LOW⚡ | …ploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb | 531 | # Step 0: Setup heap | COMMENT |
| LOW⚡ | …ploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb | 534 | # Step 1: Reverse FL order | COMMENT |
| LOW⚡ | …ploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb | 537 | # Step 2: Put fake pointer and make FL order back to normal | COMMENT |
| LOW⚡ | …ploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb | 540 | # Step 3: Trigger overflow | COMMENT |
| LOW⚡ | …ploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb | 543 | # Step 4: Allocate at arbitrary address and change zend_mm_heap | COMMENT |
| LOW | …s/linux/http/optergy_bms_backdoor_rce_cve_2019_7276.rb | 87 | # Step 1: get the challenge and compute the response answer for the backdoor execution | COMMENT |
| LOW | …s/linux/http/optergy_bms_backdoor_rce_cve_2019_7276.rb | 109 | # Step 2: execute payload (RCE) using the backdoor and challenge response obtained from step 1. | COMMENT |
| LOW⚡ | modules/exploits/linux/persistence/docker_image.rb | 88 | # Step 1: Prepare payload | COMMENT |
| LOW⚡ | modules/exploits/linux/persistence/docker_image.rb | 94 | # Step 2: Prepare entrypoint script (loops indefinitely) | COMMENT |
| LOW⚡ | modules/exploits/linux/persistence/docker_image.rb | 115 | # Step 3: Pull Alpine image | COMMENT |
| LOW⚡ | modules/exploits/linux/persistence/docker_image.rb | 118 | # Step 4: Create a temporary container (stopped) to copy files in | COMMENT |
| LOW⚡ | modules/exploits/linux/persistence/docker_image.rb | 137 | # Step 5: Start container with internal entrypoint | COMMENT |
| LOW⚡ | modules/exploits/linux/persistence/docker_image.rb | 141 | # Step 6: Add cleanup commands for RC | COMMENT |
| LOW⚡ | modules/exploits/linux/persistence/docker_image.rb | 146 | # Step 7: Clean up host temp files | COMMENT |
| LOW⚡ | modules/exploits/linux/persistence/docker_image.rb | 150 | # Step 8: Stop tmp image | COMMENT |
| LOW⚡ | …indows/local/cve_2020_0787_bits_arbitrary_file_move.rb | 196 | # Step 1: Check target environment is correct. | COMMENT |
| LOW⚡ | …indows/local/cve_2020_0787_bits_arbitrary_file_move.rb | 206 | # Step 2: Generate the malicious DLL and upload it to a temp location. | COMMENT |
| LOW | …indows/local/cve_2020_0787_bits_arbitrary_file_move.rb | 227 | # Step 3: Load the main DLL that will trigger the exploit and conduct the arbitrary file copy. | COMMENT |
| LOW | …indows/local/cve_2020_0787_bits_arbitrary_file_move.rb | 242 | # Step 4: Execute `usoclient StartInteractiveScan` to trigger the payload | COMMENT |
| LOW⚡ | …/exploits/windows/local/cve_2022_26904_superprofile.rb | 195 | # Step 1: Check target environment is correct. | COMMENT |
| LOW⚡ | …/exploits/windows/local/cve_2022_26904_superprofile.rb | 202 | # Step 2: Generate the malicious DLL and upload it to a temp location. | COMMENT |
| LOW | …/exploits/windows/local/cve_2022_26904_superprofile.rb | 218 | # Step 3: Load the main DLL that will trigger the exploit and conduct the arbitrary file copy. | COMMENT |
| LOW⚡ | modules/exploits/windows/smb/ms17_010_eternalblue.rb | 1180 | # Step 0: pre-calculate what we can | COMMENT |
| LOW⚡ | modules/exploits/windows/smb/ms17_010_eternalblue.rb | 1185 | # Step 1: Connect to IPC$ share | COMMENT |
| LOW⚡ | modules/exploits/windows/smb/ms17_010_eternalblue.rb | 1215 | # Step 2: Create a large SMB1 buffer | COMMENT |
| LOW⚡ | modules/exploits/windows/smb/ms17_010_eternalblue.rb | 1219 | # Step 3: Groom the pool with payload packets, and open/close SMB1 packets | COMMENT |
| 7 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | documentation/modules/auxiliary/gather/leakix_search.md | 22 | 1. Do: `set LEAKIX_APIKEY <your-api-key>` | CODE |
| HIGH | …t/meterpreter/ui/console/command_dispatcher/android.rb | 587 | print_error("e.g. wlan_geolocate -a YOUR_API_KEY") | CODE |
| HIGH | data/wordlists/flask_secret_keys.txt | 11643 | ENTER-YOUR-API-KEY-HERE | CODE |
| HIGH⚡ | data/wordlists/flask_secret_keys.txt | 31031 | your_api_key | CODE |
| HIGH⚡ | data/wordlists/flask_secret_keys.txt | 31032 | yourapikey | CODE |
| HIGH⚡ | data/wordlists/flask_secret_keys.txt | 31035 | <YOUR_API_KEY> | CODE |
| HIGH⚡ | data/wordlists/flask_secret_keys.txt | 31035 | <YOUR_API_KEY> | CODE |
| HIGH⚡ | data/wordlists/flask_secret_keys.txt | 31036 | {{YOURAPIKEY}} | CODE |
| HIGH⚡ | data/wordlists/flask_secret_keys.txt | 31038 | YOUR_API_KEY | CODE |
| HIGH⚡ | data/wordlists/flask_secret_keys.txt | 31043 | YOUR-API-KEY-HERE | CODE |
| HIGH | data/wordlists/flask_secret_keys.txt | 31172 | <YOUR-SECRET-HERE> | CODE |
| HIGH | data/wordlists/flask_secret_keys.txt | 31174 | YOUR-SECRET-HERE | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/hardware/killerbee_msfrelay.py | 88 | except Exception as e: | CODE |
| LOW | lib/msf/core/exploit/remote/http/splunk/helpers.rb | 67 | except Exception as e: | CODE |
| LOW | …re/modules/external/python/metasploit/login_scanner.py | 37 | except Exception as e: | CODE |
| LOW | …re/modules/external/python/metasploit/probe_scanner.py | 49 | except Exception as e: | CODE |
| LOW | …re/modules/external/python/metasploit/probe_scanner.py | 96 | except Exception: | CODE |
| MEDIUM | lib/telephony/modem.rb | 43 | print("Error opening serial port #{@serialport} : #{e.class} #{e} #{e.backtrace}\r\n") | CODE |
| MEDIUM | lib/telephony/modem.rb | 66 | print("Error sending command to modem: #{e.class} #{e} #{e.backtrace}\r\n") | CODE |
| MEDIUM | lib/telephony/modem.rb | 97 | print("Error reading from modem: #{e.class} #{e} #{e.backtrace}\r\n") | CODE |
| MEDIUM | lib/telephony/modem.rb | 118 | print( "Error switching to command state: FAILED\r\n" ) | CODE |
| MEDIUM | lib/telephony/modem.rb | 134 | print( "Error switching to data state: FAILED\r\n" ) | CODE |
| LOW | modules/auxiliary/gather/office365userenum.py | 169 | except Exception as e: | STRING |
| LOW | modules/auxiliary/gather/office365userenum.py | 218 | except Exception as e: | STRING |
| LOW | modules/auxiliary/gather/mikrotik_winbox_fileread.py | 128 | except Exception as e: | CODE |
| LOW | modules/auxiliary/gather/mikrotik_winbox_fileread.py | 140 | except Exception as e: | CODE |
| LOW | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 100 | except Exception as e: | STRING |
| LOW | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 156 | except Exception as e: | STRING |
| MEDIUM | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 89 | def get_rsa_from_server(target, timeout=5): | CODE |
| MEDIUM | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 133 | def oracle(target, pms, cke_2nd_prefix, cipher_handshake=ch_def, messageflow=Fal | CODE |
| LOW | modules/auxiliary/scanner/http/rdp_web_login.py | 107 | except Exception as exc: | STRING |
| MEDIUM | modules/auxiliary/scanner/http/rdp_web_login.py | 68 | def parse_ntlm_t1(message): | CODE |
| LOW | modules/auxiliary/scanner/http/rpyc_rce.py | 54 | except Exception as e: | STRING |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 147 | except Exception as e: | STRING |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 169 | except Exception as e: | STRING |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 187 | except Exception as e: | STRING |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 207 | except Exception as e: | STRING |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 256 | except Exception as e: | STRING |
| LOW | modules/auxiliary/scanner/smb/impacket/_msf_impacket.py | 51 | except Exception as e: | CODE |
| LOW | modules/auxiliary/scanner/smb/impacket/_msf_impacket.py | 75 | except Exception as e: | CODE |
| LOW | modules/auxiliary/scanner/smb/impacket/_msf_impacket.py | 96 | except Exception as e: | CODE |
| MEDIUM | modules/auxiliary/scanner/smb/impacket/_msf_impacket.py | 42 | def do_get(self, src_path): | CODE |
| MEDIUM | modules/auxiliary/scanner/smb/impacket/_msf_impacket.py | 56 | def do_put(self, s): | CODE |
| LOW | data/exploits/CVE-2026-31431/CVE-2026-31431.py | 31 | except Exception: | CODE |
| LOW | data/exploits/CVE-2026-31431/CVE-2026-31431.py | 209 | except Exception as e: | CODE |
| LOW | data/exploits/CVE-2026-31431/CVE-2026-31431.py | 235 | except Exception as e: | CODE |
| LOW | data/exploits/CVE-2026-31431/CVE-2026-31431.py | 286 | except Exception as e: | CODE |
| LOW | data/exploits/CVE-2021-38648/cve_2021_38648.py | 22 | except Exception: | CODE |
| LOW | …ware_view_planner_4_6_uploadlog_rce/log_upload_wsgi.py | 90 | except Exception as e: | CODE |
| MEDIUM | data/exploits/CVE-2023-4911/cve_2023_4911.py | 253 | print("Error: %s" % error_msg) | CODE |
| LOW | data/exploits/CVE-2025-60787/sign_request.py | 82 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | lib/net/dns/question.rb | 37 | # To obtain the binary data from a question object you can use | COMMENT |
| MEDIUM | lib/msf/core/exploit/laravel_crypto_killer.rb | 9 | # The tool requires a valid `APP_KEY` to be used, you can also try to bruteforce them if you think there is a potential | COMMENT |
| LOW | lib/msf/core/exploit/remote/http_server/html.rb | 117 | # writing style, so make sure you have the following before using: | COMMENT |
| MEDIUM | lib/msf/core/post/linux/f5_mcp.rb | 19 | # If you're just reading data, you can use `mcp_simple_query()` to build | COMMENT |
| MEDIUM | external/source/exploits/CVE-2019-2215/poc.c | 355 | // clear the TIF_SECCOMP flag and everything else :P (feel free to modify this to just clear the single flag) | COMMENT |
| LOW | modules/exploits/example_webapp.rb | 129 | # since we will check res to see if auth was a success, make sure to capture the return | COMMENT |
| LOW | modules/exploits/osx/mdns/upnp_location.rb | 206 | # And we make sure to put our payload in the USN header | COMMENT |
| LOW | modules/exploits/multi/vpn/tincd_bof.rb | 172 | # Don't forget to stop firewalld for testing, as the port is still closed otherwise | COMMENT |
| LOW | modules/exploits/unix/local/netbsd_mail_local.rb | 276 | fprintf(stderr, "[+] done! Don't forget to change atrun(1) " | CODE |
| LOW | …dules/exploits/unix/http/contentkeeperweb_mimencode.rb | 119 | print_status("Don't forget to clean up afterwards (chmod -s /bin/bash and restore an original copy of the OVERWRIT | CODE |
| LOW | …exploits/linux/misc/asterisk_ami_originate_auth_rce.rb | 202 | print_good("!!!Don't forget to clean evidence from #{datastore['CONF']}!!!") | CODE |
| LOW | modules/exploits/linux/local/docker_runc_escape.rb | 351 | # shell in the docker container, make sure to restore it now. | COMMENT |
| MEDIUM | modules/exploits/linux/http/cisco_asax_sfr_rce.rb | 32 | Finally, it's worth noting that this attack bypasses the affects of the | CODE |
| MEDIUM | …indows/http/php_cgi_arg_injection_rce_cve_2024_4577.rb | 98 | # To debug your payloads you can add this: | COMMENT |
| LOW | …s/http/manageengine_servicedesk_plus_cve_2021_44077.rb | 130 | print_warning("Yo, don't forget to clean up ..\\bin\\msiexec.exe") | CODE |
| LOW | …es/auxiliary/gather/prometheus_node_exporter_gather.rb | 53 | # since we will check res to see if auth was a success, make sure to capture the return | COMMENT |
| LOW | …les/auxiliary/admin/networking/cisco_asa_extrabacon.rb | 185 | print_warning("Don't forget to run PASS_ENABLE after logging in!") | CODE |
| MEDIUM | …/auxiliary/server/capture/http_javascript_keylogger.rb | 211 | <p><font color="red"><i>This form submits data to the Metasploit listener for demonstration purposes.</i></font> | CODE |
| LOW | modules/auxiliary/scanner/http/http_traversal.rb | 336 | # Ah, don't forget to restore our method | COMMENT |
| LOW | modules/auxiliary/scanner/http/http_traversal.rb | 336 | # Ah, don't forget to restore our method | COMMENT |
| LOW | …/auxiliary/scanner/http/coldfusion_locale_traversal.rb | 149 | # file probably specified by user, make sure to add in actual traversal | COMMENT |
| LOW | modules/auxiliary/scanner/mysql/mysql_writable_dirs.rb | 35 | # make sure you handle the errors yourself | COMMENT |
| LOW | modules/auxiliary/scanner/mysql/mysql_file_enum.rb | 38 | # make sure you handle the errors yourself | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …msf/core/modules/external/python/metasploit/version.py | 321 | except ValueError: | CODE |
| HIGH | …re/modules/external/python/metasploit/probe_scanner.py | 96 | except Exception: | CODE |
| HIGH | modules/auxiliary/gather/office365userenum.py | 157 | except ImportError as e: | CODE |
| HIGH | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 226 | except: | CODE |
| HIGH | data/exploits/CVE-2026-31431/CVE-2026-31431.py | 31 | except Exception: | CODE |
| HIGH | …ware_view_planner_4_6_uploadlog_rce/log_upload_wsgi.py | 40 | except: | CODE |
| HIGH | data/exploits/CVE-2023-4911/cve_2023_4911.py | 130 | except: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | modules/post/multi/manage/screenshare.rb | 199 | // required function will instead be invoked 1 second later as requested. | COMMENT |
| HIGH⚡ | modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb | 504 | print_status("Attacking #{app[0]} on #{peer} as requested with TLS #{ssl ? 'on' : 'off'}") | CODE |
| HIGH | modules/exploits/linux/samba/setinfopolicy_heap.rb | 21 | because of an error on the PIDL auto-generated code. Making a specially crafted | CODE |
| HIGH | …ble/security_center/pull_encrypted_database_fields.php | 3 | // generated by Claude Code | COMMENT |
| HIGH | data/post/tenable/security_center/dump_crack_hashes.php | 3 | // generated by Claude Code | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | lib/msf/core/post/linux/f5_mcp.rb | 106 | # In this example, 559604 is right and 548160 is truncated: | COMMENT |
| HIGH | lib/metasploit/framework/login_scanner/teamcity.rb | 231 | # Currently, those building blocks are not available, so this is the approach I have implemented. | COMMENT |
| HIGH | …ploits/cve-2013-3660/ppr_flatten_rec/ppr_flatten_rec.c | 646 | // I've created a list of candidates in DispatchRedirect. | COMMENT |
| HIGH | modules/auxiliary/scanner/udp/example.rb | 99 | # to something, etc. In this example, we simply look for any response | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/hardware/killerbee_msfrelay.py | 8 | CODE | |
| LOW | tools/hardware/killerbee_msfrelay.py | 15 | CODE | |
| LOW | tools/hardware/killerbee_msfrelay.py | 20 | CODE | |
| LOW | lib/msf/core/modules/external/python/metasploit/cli.py | 1 | CODE | |
| LOW | …urce/exploits/CVE-2026-66066/generate_msf_templates.py | 7 | CODE | |
| LOW | modules/auxiliary/gather/office365userenum.py | 3 | CODE | |
| LOW | modules/auxiliary/gather/mikrotik_winbox_fileread.py | 11 | CODE | |
| LOW | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 5 | CODE | |
| LOW | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 6 | CODE | |
| LOW | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 8 | CODE | |
| LOW | …ules/auxiliary/scanner/teradata/teradata_odbc_login.py | 6 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 9 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 12 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 13 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 16 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 17 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/dcomexec.py | 10 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/dcomexec.py | 11 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/dcomexec.py | 12 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/dcomexec.py | 13 | CODE | |
| LOW | …ware_view_planner_4_6_uploadlog_rce/log_upload_wsgi.py | 3 | CODE | |
| LOW | data/exploits/CVE-2023-4911/cve_2023_4911.py | 6 | CODE | |
| LOW | data/exploits/CVE-2023-4911/cve_2023_4911.py | 8 | CODE | |
| LOW | data/exploits/CVE-2021-3156/userspec_generic.py | 48 | CODE | |
| LOW | data/exploits/CVE-2021-4034/cve_2021_4034.py | 1 | CODE | |
| LOW | data/exploits/CVE-2021-4034/cve_2021_4034.py | 3 | CODE | |
| LOW | data/exploits/CVE-2021-4034/cve_2021_4034.py | 4 | CODE | |
| LOW | data/meterpreter/python/met_rsa.py | 2 | CODE | |
| LOW | data/meterpreter/python/met_rsa.py | 3 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/hardware/killerbee_msfrelay.py | 130 | CODE | |
| LOW | …msf/core/modules/external/python/metasploit/version.py | 168 | CODE | |
| LOW | external/source/shellcode/windows/x64/build.py | 81 | CODE | |
| LOW | external/source/shellcode/windows/x86/build.py | 99 | CODE | |
| LOW | external/source/shellcode/windows/x86/src/hash.py | 91 | CODE | |
| LOW | external/source/shellcode/windows/x86/src/hash.py | 133 | CODE | |
| LOW | modules/auxiliary/gather/office365userenum.py | 162 | CODE | |
| LOW | modules/auxiliary/gather/office365userenum.py | 189 | CODE | |
| LOW | modules/auxiliary/gather/office365userenum.py | 252 | CODE | |
| LOW | modules/auxiliary/dos/http/slowloris.py | 101 | CODE | |
| LOW | modules/auxiliary/admin/http/grafana_auth_bypass.py | 105 | CODE | |
| LOW | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 133 | CODE | |
| LOW | modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py | 163 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/secretsdump.py | 114 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/_msf_impacket.py | 84 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/dcomexec.py | 83 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/dcomexec.py | 103 | CODE | |
| LOW | modules/auxiliary/scanner/smb/impacket/wmiexec.py | 69 | CODE | |
| LOW | …ware_view_planner_4_6_uploadlog_rce/log_upload_wsgi.py | 46 | CODE | |
| LOW | data/exploits/CVE-2023-4911/cve_2023_4911.py | 112 | CODE | |
| LOW | data/exploits/CVE-2021-3156/nss_generic2.py | 119 | CODE | |
| LOW | data/exploits/CVE-2021-3156/nss_u16.py | 38 | CODE | |
| LOW | data/exploits/CVE-2021-3156/nss_u14.py | 40 | CODE | |
| LOW | data/exploits/CVE-2021-3156/userspec_generic.py | 126 | CODE | |
| LOW | data/meterpreter/python/met_rsa.py | 55 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | spec/lib/tasks/module_generator_spec.rb | 109 | # narrow allow-list rejected -> nil -> unusable scaffold. | COMMENT |
| MEDIUM | spec/lib/tasks/module_generator_spec.rb | 384 | # PayloadCachedSize. The scaffold must default to :dynamic (always correct) with a | COMMENT |
| MEDIUM | spec/lib/tasks/module_generator_spec.rb | 406 | # SessionTypes is a compatibility claim the scaffold cannot verify. Default to an empty | COMMENT |
| MEDIUM | lib/msf/core/post/session_upgrade.rb | 9 | # Shared orchestration logic for session upgrade modules. Provides LHOST | COMMENT |
| MEDIUM | lib/msf/core/mcp/application.rb | 8 | # Main application class that orchestrates the MCP server startup and lifecycle | COMMENT |
| MEDIUM | modules/exploits/multi/persistence/ssh_key.rb | 55 | 'DisablePayloadHandler' => true, # since this is non-traditional persistence in that it isn't traditional even | CODE |
| MEDIUM | data/exploits/CVE-2026-46300/cve-2026-46300.c | 8 | // V12 - https://v12.sh - dangerously powerful agentic security | COMMENT |
| MEDIUM | data/exploits/CVE-2026-41264/cve_2026_41264.json | 3 | "flowData": "{\"nodes\":[{\"id\":\"csvAgent_0\",\"position\":{\"x\":795,\"y\":248},\"type\":\"customNode\",\"data\": | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/dev/generate_mitre_attack_technique_constants.rb | 12 | # Usage: | COMMENT |
| LOW | tools/dev/generate_mitre_attack_technique_constants.rb | 95 | # Example usage: | COMMENT |
| LOW | tools/dev/update_gitlab_versions.rb | 14 | # Usage: | COMMENT |
| LOW | lib/msf/core/exploit/remote/http/wordpress/sqli.rb | 7 | # Usage: | COMMENT |
| LOW | lib/msf/core/trace/certificate_trace_presenter.rb | 15 | # Usage: | COMMENT |
| LOW | lib/rex/parser/nmap_xml.rb | 24 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | lib/anemone/rex_http.rb | 84 | # TODO: implement | COMMENT |
| LOW | lib/msf/core/mcp/tools/module_info.rb | 44 | # TODO: consider adding `description` fields to these properties | COMMENT |
| LOW | lib/msf/core/rpc/json/request.rb | 110 | # TODO: implement batch response processing | COMMENT |
| LOW | modules/auxiliary/spoof/cisco/cdp.rb | 95 | # TODO: implement this correctly | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | modules/auxiliary/scanner/smb/impacket/dcomexec.py | 65 | CODE |