Struts2Scanner

Apache Struts is a modern Java framework that uses the Model, View, Controller (MVC) architecture for building enterprise-ready web applications. It uses OGNL - Object-Graph Navigation Language to interpret user supplied data.

Object Graph Navigation Language (OGNL) was developed to provide developers with an easy way to extract data from an object model but when the interpreter attempts to interpret user-supplied data without validation, it introduce critical security flaws.

Struts2Scanner is a python based vulnerability scanner to find out if a target endpoint is vulnerable OGNL injection. As of now it checks anginst following vulnerabilities.

• cve-2020-17530
• cve-2019-0230
• cve-2018-11776
• cve-2017-5638
• cve-2017-9791

How to use

root@kali:/home/Struts2Scanner# python3 Struts2Scanner.py -h
usage: Struts2Scanner.py [options] --url "http://www.site.com/vuln.php?id=1"

optional arguments:
  -h, --help         show this help message and exit
  -u URL, --url URL  Target URL (e.g."http://www.site.com/vuln.php?id=1&fname=test&lname=tester")
  --data DATA        Data string to be sent through POST (e.g. "id=1&fname=test&lname=tester")
  --cookies COOKIES  HTTP cookies (eg. "jsessionid=1234")
  --proxy PROXY      Use a proxy to connect to the target URL

Requirements

• Python3
• Check requirements.txt file

Installation Steps

pip3 install -r requirements.txt