Ekultek / Ekultek/Zeus-Scanner

Unhandled exception (54c41ebb)

Open
#808 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
999
Forks
245
PR merge metrics
No merged PRs in 30d

Description

Zeus version:
`1.5.2.21b875`

Firefox version:
`(58, 0)`

Geckodriver version:
`geckodriver-v0.19.0-linux64.tar.gz`

Error info:
```Traceback (most recent call last):
File "./zeus.py", line 335, in
__run_attacks_main()
File "./zeus.py", line 146, in __run_attacks_main
threads=opt.amountOfThreads, force_ssl=opt.forceSSL
File "/app/lib/core/settings.py", line 994, in run_attacks
opts=create_arguments(sqlmap=True, sqlmap_args=sqlmap_arguments, conf=conf_file), auto_start=auto_start)
File "/app/lib/attacks/sqlmap_scan/__init__.py", line 164, in sqlmap_scan_main
subprocess.Popen(sqlmap_api_command, stdout=subprocess.PIPE)
File "/usr/lib/python2.7/subprocess.py", line 394, in __init__
errread, errwrite)
File "/usr/lib/python2.7/subprocess.py", line 1047, in _execute_child
raise child_exception
OSError: [Errno 2] No such file or directory
```

Running details:
`Linux-5.3.0-19-generic-x86_64-with-Ubuntu-18.10-cosmic`

Commands used:
`./zeus.py -b https://www.uniwebhosting.com --verbose --auto -s`

Log file info:
```2019-10-27 23:23:05,629;zeus-log;INFO;connection test succeeded, continuing
2019-10-27 23:23:05,629;zeus-log;INFO;crawling given URL 'https://www.uniwebhosting.com' for links
2019-10-27 23:23:08,625;zeus-log;INFO;found a total of 37 links from given URL 'https://www.uniwebhosting.com'
2019-10-27 23:23:08,626;zeus-log;INFO;successfully wrote found items to '/app/log/blackwidow-log/blackwidow-log-4.log'
2019-10-27 23:23:08,626;zeus-log;INFO;currently running on 'http://www.uniwebhosting.com/mailto:info@uniwebhosting.com' (target #1)
2019-10-27 23:23:08,626;zeus-log;INFO;fetching target meta-data
2019-10-27 23:23:10,009;zeus-log;INFO;detecting target charset
2019-10-27 23:23:10,009;zeus-log;INFO;target charset appears to be 'UTF-8'
2019-10-27 23:23:10,009;zeus-log;DEBUG;loading XML data
2019-10-27 23:23:10,011;zeus-log;INFO;attempting to get request headers for 'http://www.uniwebhosting.com/mailto:info@uniwebhosting.com'
2019-10-27 23:23:10,011;zeus-log;DEBUG;fetched {'Content-Encoding': 'gzip', 'Transfer-Encoding': 'chunked', 'Strict-Transport-Security': 'max-age=111186400; includeSubDomains', 'Vary': 'Accept-Encoding, Accept-Encoding', 'Server': 'nginx', 'Last-Modified': 'Thu, 24 Oct 2019 13:42:00 GMT', 'Connection': 'keep-alive', 'Date': 'Sun, 27 Oct 2019 23:23:10 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
2019-10-27 23:23:10,012;zeus-log;WARNING;provided target has protection against unencrypted connections (force HTTPS connection)
2019-10-27 23:23:10,012;zeus-log;INFO;writing found headers to log file
2019-10-27 23:23:10,012;zeus-log;INFO;successfully wrote found items to '/app/log/header-log/www.uniwebhosting.com(1).json'
2019-10-27 23:23:18,805;zeus-log;WARNING;skipping 'http://www.uniwebhosting.com/mailto:info@uniwebhosting.com'
2019-10-27 23:23:18,805;zeus-log;INFO;currently running on 'https://client.uniwebhosting.com/submitticket.php?step=2&deptid=1' (target #2)
2019-10-27 23:23:18,806;zeus-log;INFO;fetching target meta-data
2019-10-27 23:23:19,760;zeus-log;INFO;detecting target charset
2019-10-27 23:23:19,760;zeus-log;INFO;target charset appears to be 'windows-1252'
2019-10-27 23:23:19,761;zeus-log;DEBUG;loading XML data
2019-10-27 23:23:19,762;zeus-log;INFO;attempting to get request headers for 'https://client.uniwebhosting.com/submitticket.php?step=2&deptid=1'
2019-10-27 23:23:19,762;zeus-log;INFO;found a request cookie, saving to file
2019-10-27 23:23:19,763;zeus-log;INFO;successfully wrote found items to '/app/log/cookies/client.uniwebhosting.com-cookie.log'
2019-10-27 23:23:19,764;zeus-log;DEBUG;fetched {'X-XSS-Protection': '1; mode=block', 'X-Content-Type-Options': 'nosniff', 'Content-Encoding': 'gzip', 'Transfer-Encoding': 'chunked', 'Set-Cookie': 'WHMCSgtEULLnQoPV0=h495805g0c9psphr3boslqkjo1; path=/; HttpOnly', 'Expires': 'Thu, 19 Nov 1981 08:52:00 GMT', 'Vary': 'Accept-Encoding, Accept-Encoding', 'Server': 'nginx', 'Connection': 'keep-alive', 'Pragma': 'no-cache', 'Cache-Control': 'no-store, no-cache, must-revalidate', 'Date': 'Sun, 27 Oct 2019 23:23:20 GMT', 'Content-Type': 'text/html; charset=utf-8', 'X-Server-Powered-By': 'nginx'}
2019-10-27 23:23:19,764;zeus-log;WARNING;provided target has protection against MIME type attacks
2019-10-27 23:23:19,765;zeus-log;WARNING;provided target has protection against XSS attacks
2019-10-27 23:23:19,765;zeus-log;INFO;writing found headers to log file
2019-10-27 23:23:19,766;zeus-log;INFO;successfully wrote found items to '/app/log/header-log/client.uniwebhosting.com-headers.json'
2019-10-27 23:23:22,938;zeus-log;INFO;creating arguments for sqlmap
2019-10-27 23:23:22,939;zeus-log;INFO;attempting to launch sqlmap API
2019-10-27 23:23:22,946;zeus-log;ERROR;ran into exception '[Errno 2] No such file or directory' exception has been saved to log file
Traceback (most recent call last):
File "./zeus.py", line 335, in
__run_attacks_main()
File "./zeus.py", line 146, in __run_attacks_main
threads=opt.amountOfThreads, force_ssl=opt.forceSSL
File "/app/lib/core/settings.py", line 994, in run_attacks
opts=create_arguments(sqlmap=True, sqlmap_args=sqlmap_arguments, conf=conf_file), auto_start=auto_start)
File "/app/lib/attacks/sqlmap_scan/__init__.py", line 164, in sqlmap_scan_main
subprocess.Popen(sqlmap_api_command, stdout=subprocess.PIPE)
File "/usr/lib/python2.7/subprocess.py", line 394, in __init__
errread, errwrite)
File "/usr/lib/python2.7/subprocess.py", line 1047, in _execute_child
raise child_exception
OSError: [Errno 2] No such file or directory

2019-10-27 23:23:35,715;zeus-log;INFO;Zeus got an unexpected error and will automatically create an issue for this error, please wait
2019-10-27 23:23:35,715;zeus-log;INFO;getting authorization
2019-10-27 23:23:35,715;zeus-log;INFO;extracting traceback from log file
2019-10-27 23:23:35,716;zeus-log;INFO;attempting to get firefox browser version
```

Contributor guide

Open the contributing guide

Research direction

Start at lib/attacks/sqlmap_scan/__init__.py line 164, where subprocess.Popen launches the sqlmap API command, and review the traceback from the reported ./zeus.py -b ... --verbose --auto -s run. Reproduce the missing-file error and determine the expected behavior when the sqlmap API executable cannot be found; done should prevent this unhandled exception or clearly report the missing dependency.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.