Bit more efficient brute forcing

Or like most people will call it “just another mod_negotiation script”. Well yeah that’s true. I still think it has it’s added value during a brute force if it’s available. I’m not going to waste any space on explaining what the whole mod_negotiation thing is, because there are a number of excellent resources out there:

• http://www.wisec.it/sectou.php?id=4698ebdc59d15
• http://appseclive.org/content/grudge-match-apaches-modnegotiation-vs-modspeling
• http://www.bonsai-sec.com/blog/index.php/exploiting-http-content-negotiation/
• http://voodoo-labs.org/blog/index.php?!=10
• https://kinqpinz.info/lib/2009/jul/#a79e8b99

For the ones that are just curious how this boils down to source you can of course read the source of the module and some documentation about it, which is available over here:

• https://svn.apache.org/repos/asf/httpd/httpd/tags/2.0.3/modules/mappers/mod_negotiation.c
• http://httpd.apache.org/docs/1.3/mod/mod_negotiation.html

So why did I write “yet another” script for this? Well first because I wanted to keep learning and practicing python. Also because I wanted my brute force attacks to be a little bit more efficient. So with this script instead of trying to guess the entire name(including the extension) of the file, I just guess the name and mod_negotiation will do the rest for me(read the links I provide, because it only works for mime types that are known to apache). So with a bit of luck you need less requests to find more files. For the ones working with w3af, it already has support for mod_negotiation testing.

The way to use this script would be to combine it with the excellent tool DirBuster. Just have DirBuster do a recursive directory brute force. Then take those results and feed them to my script with a decent file name list. This script is kind of an alpha version, just something I quickly whipped up.

[*] DiabloHorn https://diablohorn.wordpress.com
[*] Mod Negotiate File Brute Force
[*] mfbrute.py -t <target> -d <dir list> -f <file list>
[*] -t target to scan
[*] -d directories which will be scanned
[*] -f files which will be scanned
[*] -v verbose
[*] -h this help

You can get the src from here.