Ekultek / Ekultek/Zeus-Scanner
Unhandled exception (ed6839f7)
- Dominant language
- Python
- Stars
- 999
- Forks
- 245
- PR merge metrics
- No merged PRs in 30d
Description
Zeus version:
`1.5.2.21b875`
Firefox version:
`(57, 0)`
Geckodriver version:
`geckodriver-v0.19.0-linux64.tar.gz`
Error info:
```Traceback (most recent call last):
File "/opt/Zeus-Scanner/lib/attacks/sqlmap_scan/__init__.py", line 194, in sqlmap_scan_main
api_id = sqlmap_scan.get_scan_id()
File "/opt/Zeus-Scanner/lib/attacks/sqlmap_scan/__init__.py", line 55, in get_scan_id
to_check = str(json.loads(req.content)["tasks"]).lower()
File "/usr/lib/python2.7/json/__init__.py", line 339, in loads
return _default_decoder.decode(s)
File "/usr/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib/python2.7/json/decoder.py", line 382, in raw_decode
raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded
```
Running details:
`Linux-5.7.0-kali1-amd64-x86_64-with-Sn3rpOs_v7.19-Sn3rpOs_Custom-Kali_v7.19-EvilCore`
Commands used:
`zeus.py -B --rand-dork -L 20 --verbose --sqli`
Log file info:
```2020-07-18 02:20:47,270;zeus-log;INFO;URL successfully gathered, searching for GET parameters
2020-07-18 02:20:47,270;zeus-log;INFO;no proxy configuration detected
2020-07-18 02:20:48,473;zeus-log;INFO;adjusting user-agent header to default user agent 'Zeus-Scanner/1.5.2.21b875 (Language=Python/2.7.18; Platform=Linux)'
2020-07-18 02:20:48,475;zeus-log;DEBUG;found 'https://business.bing.com/api/v3/search/person/photo?id='
2020-07-18 02:20:48,475;zeus-log;DEBUG;found 'http://go.microsoft.com/fwlink/?LinkId=521839'
2020-07-18 02:20:48,476;zeus-log;DEBUG;found 'http://go.microsoft.com/fwlink/?LinkID=246338'
2020-07-18 02:20:48,476;zeus-log;DEBUG;found 'https://go.microsoft.com/fwlink/?linkid=868922'
2020-07-18 02:20:48,476;zeus-log;DEBUG;found 'http://go.microsoft.com/fwlink/?LinkID=286759'
2020-07-18 02:20:48,476;zeus-log;DEBUG;found 'https://go.microsoft.com/fwlink/?LinkID=617297'
2020-07-18 02:20:48,476;zeus-log;DEBUG;found 'https://storage.live.com/users/0x'
2020-07-18 02:20:48,476;zeus-log;DEBUG;found 'https://storage.live.com/users/0x'
2020-07-18 02:20:48,477;zeus-log;DEBUG;found 'https://login.live.com/login.srf?wa=wsignin1.0\u0026rpsnv=11\u0026ct=1595064048\u0026rver=6.0.5286.0\u0026wp=MBI_SSL\u0026wreply=https://www.bing.com/secure/Passport.aspx?popup=1\u0026lc=1033\u0026id=264960'
2020-07-18 02:20:48,477;zeus-log;DEBUG;found 'https://s.bingparachute.com/search?q='
2020-07-18 02:20:48,477;zeus-log;DEBUG;found 'https://s.bingparachute.com/?&mkt=global'
2020-07-18 02:20:48,477;zeus-log;DEBUG;found 'https://t.bingparachute.com/telemetry?cat='
2020-07-18 02:20:48,477;zeus-log;INFO;successfully wrote found items to '/opt/Zeus-Scanner/log/url-log/url-log-2.log'
2020-07-18 02:20:48,477;zeus-log;INFO;found a total of 11 URLs with given query 'inurl:/cgi-bin/php'
2020-07-18 02:20:48,478;zeus-log;INFO;currently running on 'https://business.bing.com/api/v3/search/person/photo?id=' (target #1)
2020-07-18 02:20:48,478;zeus-log;INFO;fetching target meta-data
2020-07-18 02:20:50,469;zeus-log;INFO;detecting target charset
2020-07-18 02:20:50,470;zeus-log;WARNING;unable to detect target charset
2020-07-18 02:20:50,470;zeus-log;DEBUG;loading XML data
2020-07-18 02:20:50,472;zeus-log;INFO;attempting to get request headers for 'https://business.bing.com/api/v3/search/person/photo?id='
2020-07-18 02:20:50,472;zeus-log;INFO;found a request cookie, saving to file
2020-07-18 02:20:50,473;zeus-log;INFO;successfully wrote found items to '/opt/Zeus-Scanner/log/cookies/business.bing.com(1).log'
2020-07-18 02:20:50,473;zeus-log;DEBUG;fetched {'Content-Length': '0', 'Set-Cookie': 'MUIDB=1FE7F2EEFF78620F3483FDE5FE2363DB; path=/; httponly; expires=Thu, 12-Aug-2021 09:20:50 GMT', 'Cache-Control': 'max-age=0, no-cache, no-store, must-revalidate', 'Date': 'Sat, 18 Jul 2020 09:20:50 GMT', 'X-MSEdge-Ref': 'Ref A: 19C66CEC308249CB88913F8B71481F23 Ref B: BL2EDGE1018 Ref C: 2020-07-18T09:20:50Z', 'WWW-Authenticate': 'Bearer, Bearer, Bearer'}
2020-07-18 02:20:50,473;zeus-log;INFO;writing found headers to log file
2020-07-18 02:20:50,473;zeus-log;INFO;successfully wrote found items to '/opt/Zeus-Scanner/log/header-log/business.bing.com(1).json'
2020-07-18 02:20:53,180;zeus-log;INFO;creating arguments for sqlmap
2020-07-18 02:21:11,899;zeus-log;INFO;initializing new sqlmap scan with given URL 'https://business.bing.com/api/v3/search/person/photo?id='
2020-07-18 02:21:11,904;zeus-log;DEBUG;scan initialized
2020-07-18 02:21:11,905;zeus-log;INFO;gathering sqlmap API scan ID
2020-07-18 02:21:11,909;zeus-log;ERROR;[7;31;31mran into error 'No JSON object could be decoded', seems something went wrong, error has been saved to current log file.
Traceback (most recent call last):
File "/opt/Zeus-Scanner/lib/attacks/sqlmap_scan/__init__.py", line 194, in sqlmap_scan_main
api_id = sqlmap_scan.get_scan_id()
File "/opt/Zeus-Scanner/lib/attacks/sqlmap_scan/__init__.py", line 55, in get_scan_id
to_check = str(json.loads(req.content)["tasks"]).lower()
File "/usr/lib/python2.7/json/__init__.py", line 339, in loads
return _default_decoder.decode(s)
File "/usr/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib/python2.7/json/decoder.py", line 382, in raw_decode
raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded
2020-07-18 02:21:16,633;zeus-log;INFO;[32mZeus got an unexpected error and will automatically create an issue for this error, please wait[0m
2020-07-18 02:21:16,633;zeus-log;INFO;[32mgetting authorization[0m
2020-07-18 02:21:16,634;zeus-log;INFO;[32mextracting traceback from log file[0m
2020-07-18 02:21:16,634;zeus-log;INFO;[32mattempting to get firefox browser version[0m
```
Contributor guide
Research direction
Start in lib/attacks/sqlmap_scan/__init__.py, especially get_scan_id at line 55 and sqlmap_scan_main at line 194. Reproduce the reported command and inspect the response content before json.loads, noting that the logged response has Content-Length 0. Done means the reported empty-response case is handled without an unhandled exception.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100