Ekultek / Ekultek/Zeus-Scanner
Unhandled exception (54c41ebb)
- Dominant language
- Python
- Stars
- 999
- Forks
- 245
- PR merge metrics
- No merged PRs in 30d
Description
Zeus version:
`1.5.2.21b875`
Firefox version:
`(58, 0)`
Geckodriver version:
`geckodriver-v0.19.0-linux64.tar.gz`
Error info:
```Traceback (most recent call last):
File "./zeus.py", line 335, in
__run_attacks_main()
File "./zeus.py", line 146, in __run_attacks_main
threads=opt.amountOfThreads, force_ssl=opt.forceSSL
File "/app/lib/core/settings.py", line 994, in run_attacks
opts=create_arguments(sqlmap=True, sqlmap_args=sqlmap_arguments, conf=conf_file), auto_start=auto_start)
File "/app/lib/attacks/sqlmap_scan/__init__.py", line 164, in sqlmap_scan_main
subprocess.Popen(sqlmap_api_command, stdout=subprocess.PIPE)
File "/usr/lib/python2.7/subprocess.py", line 394, in __init__
errread, errwrite)
File "/usr/lib/python2.7/subprocess.py", line 1047, in _execute_child
raise child_exception
OSError: [Errno 2] No such file or directory
```
Running details:
`Linux-5.3.0-19-generic-x86_64-with-Ubuntu-18.10-cosmic`
Commands used:
`./zeus.py -b https://www.uniwebhosting.com --verbose --auto -s`
Log file info:
```2019-10-27 23:23:05,629;zeus-log;INFO;connection test succeeded, continuing
2019-10-27 23:23:05,629;zeus-log;INFO;crawling given URL 'https://www.uniwebhosting.com' for links
2019-10-27 23:23:08,625;zeus-log;INFO;found a total of 37 links from given URL 'https://www.uniwebhosting.com'
2019-10-27 23:23:08,626;zeus-log;INFO;successfully wrote found items to '/app/log/blackwidow-log/blackwidow-log-4.log'
2019-10-27 23:23:08,626;zeus-log;INFO;currently running on 'http://www.uniwebhosting.com/mailto:info@uniwebhosting.com' (target #1)
2019-10-27 23:23:08,626;zeus-log;INFO;fetching target meta-data
2019-10-27 23:23:10,009;zeus-log;INFO;detecting target charset
2019-10-27 23:23:10,009;zeus-log;INFO;target charset appears to be 'UTF-8'
2019-10-27 23:23:10,009;zeus-log;DEBUG;loading XML data
2019-10-27 23:23:10,011;zeus-log;INFO;attempting to get request headers for 'http://www.uniwebhosting.com/mailto:info@uniwebhosting.com'
2019-10-27 23:23:10,011;zeus-log;DEBUG;fetched {'Content-Encoding': 'gzip', 'Transfer-Encoding': 'chunked', 'Strict-Transport-Security': 'max-age=111186400; includeSubDomains', 'Vary': 'Accept-Encoding, Accept-Encoding', 'Server': 'nginx', 'Last-Modified': 'Thu, 24 Oct 2019 13:42:00 GMT', 'Connection': 'keep-alive', 'Date': 'Sun, 27 Oct 2019 23:23:10 GMT', 'Content-Type': 'text/html; charset=UTF-8'}
2019-10-27 23:23:10,012;zeus-log;WARNING;provided target has protection against unencrypted connections (force HTTPS connection)
2019-10-27 23:23:10,012;zeus-log;INFO;writing found headers to log file
2019-10-27 23:23:10,012;zeus-log;INFO;successfully wrote found items to '/app/log/header-log/www.uniwebhosting.com(1).json'
2019-10-27 23:23:18,805;zeus-log;WARNING;skipping 'http://www.uniwebhosting.com/mailto:info@uniwebhosting.com'
2019-10-27 23:23:18,805;zeus-log;INFO;currently running on 'https://client.uniwebhosting.com/submitticket.php?step=2&deptid=1' (target #2)
2019-10-27 23:23:18,806;zeus-log;INFO;fetching target meta-data
2019-10-27 23:23:19,760;zeus-log;INFO;detecting target charset
2019-10-27 23:23:19,760;zeus-log;INFO;target charset appears to be 'windows-1252'
2019-10-27 23:23:19,761;zeus-log;DEBUG;loading XML data
2019-10-27 23:23:19,762;zeus-log;INFO;attempting to get request headers for 'https://client.uniwebhosting.com/submitticket.php?step=2&deptid=1'
2019-10-27 23:23:19,762;zeus-log;INFO;found a request cookie, saving to file
2019-10-27 23:23:19,763;zeus-log;INFO;successfully wrote found items to '/app/log/cookies/client.uniwebhosting.com-cookie.log'
2019-10-27 23:23:19,764;zeus-log;DEBUG;fetched {'X-XSS-Protection': '1; mode=block', 'X-Content-Type-Options': 'nosniff', 'Content-Encoding': 'gzip', 'Transfer-Encoding': 'chunked', 'Set-Cookie': 'WHMCSgtEULLnQoPV0=h495805g0c9psphr3boslqkjo1; path=/; HttpOnly', 'Expires': 'Thu, 19 Nov 1981 08:52:00 GMT', 'Vary': 'Accept-Encoding, Accept-Encoding', 'Server': 'nginx', 'Connection': 'keep-alive', 'Pragma': 'no-cache', 'Cache-Control': 'no-store, no-cache, must-revalidate', 'Date': 'Sun, 27 Oct 2019 23:23:20 GMT', 'Content-Type': 'text/html; charset=utf-8', 'X-Server-Powered-By': 'nginx'}
2019-10-27 23:23:19,764;zeus-log;WARNING;provided target has protection against MIME type attacks
2019-10-27 23:23:19,765;zeus-log;WARNING;provided target has protection against XSS attacks
2019-10-27 23:23:19,765;zeus-log;INFO;writing found headers to log file
2019-10-27 23:23:19,766;zeus-log;INFO;successfully wrote found items to '/app/log/header-log/client.uniwebhosting.com-headers.json'
2019-10-27 23:23:22,938;zeus-log;INFO;creating arguments for sqlmap
2019-10-27 23:23:22,939;zeus-log;INFO;attempting to launch sqlmap API
2019-10-27 23:23:22,946;zeus-log;ERROR;[7;31;31mran into exception '[Errno 2] No such file or directory' exception has been saved to log file
Traceback (most recent call last):
File "./zeus.py", line 335, in
__run_attacks_main()
File "./zeus.py", line 146, in __run_attacks_main
threads=opt.amountOfThreads, force_ssl=opt.forceSSL
File "/app/lib/core/settings.py", line 994, in run_attacks
opts=create_arguments(sqlmap=True, sqlmap_args=sqlmap_arguments, conf=conf_file), auto_start=auto_start)
File "/app/lib/attacks/sqlmap_scan/__init__.py", line 164, in sqlmap_scan_main
subprocess.Popen(sqlmap_api_command, stdout=subprocess.PIPE)
File "/usr/lib/python2.7/subprocess.py", line 394, in __init__
errread, errwrite)
File "/usr/lib/python2.7/subprocess.py", line 1047, in _execute_child
raise child_exception
OSError: [Errno 2] No such file or directory
2019-10-27 23:23:35,715;zeus-log;INFO;[32mZeus got an unexpected error and will automatically create an issue for this error, please wait[0m
2019-10-27 23:23:35,715;zeus-log;INFO;[32mgetting authorization[0m
2019-10-27 23:23:35,715;zeus-log;INFO;[32mextracting traceback from log file[0m
2019-10-27 23:23:35,716;zeus-log;INFO;[32mattempting to get firefox browser version[0m
```
Contributor guide
Research direction
Start at lib/attacks/sqlmap_scan/__init__.py line 164, where subprocess.Popen launches the sqlmap API command, and review the traceback from the reported ./zeus.py -b ... --verbose --auto -s run. Reproduce the missing-file error and determine the expected behavior when the sqlmap API executable cannot be found; done should prevent this unhandled exception or clearly report the missing dependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100