From c586fda2d4ffba2ebfc3e2a71253360db11f32fe Mon Sep 17 00:00:00 2001 From: liquidsec Date: Thu, 21 Aug 2025 14:48:55 -0400 Subject: [PATCH 1/4] adding proxy passthru to rau_crypto --- bbot/modules/telerik.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/bbot/modules/telerik.py b/bbot/modules/telerik.py index bf2cb54d92..a4b9174c21 100644 --- a/bbot/modules/telerik.py +++ b/bbot/modules/telerik.py @@ -263,6 +263,11 @@ async def handle_event(self, event): str(root_tool_path / "testfile.txt"), result.url, ] + + # Add proxy if set in the scan config + if self.scan.http_proxy: + command.append(self.scan.http_proxy) + output = await self.run_process(command) description = f"[CVE-2017-11317] [{str(version)}] {webresource}" if "fileInfo" in output.stdout: From 1767bc369aafe15761908dcebc8dd58d9539511f Mon Sep 17 00:00:00 2001 From: liquidsec Date: Thu, 21 Aug 2025 14:49:43 -0400 Subject: [PATCH 2/4] =?UTF-8?q?THE=20SPELLCHECKER=20BROKE=20THIS=20?= =?UTF-8?q?=F0=9F=98=A1=F0=9F=98=A1=F0=9F=98=A1!?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbot/modules/telerik.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bbot/modules/telerik.py b/bbot/modules/telerik.py index a4b9174c21..be01f07918 100644 --- a/bbot/modules/telerik.py +++ b/bbot/modules/telerik.py @@ -204,7 +204,7 @@ async def handle_event(self, event): webresource = "Telerik.Web.UI.WebResource.axd?type=rau" result, _ = await self.test_detector(base_url, webresource) if result: - if "RadAsyncUpload handler is registered successfully" in result.text: + if "RadAsyncUpload handler is registered succesfully" in result.text: self.verbose("Detected Telerik instance (Telerik.Web.UI.WebResource.axd?type=rau)") probe_data = { From 9ff59af99c6324b44eb200e977a2c7b1218f929f Mon Sep 17 00:00:00 2001 From: liquidsec Date: Thu, 21 Aug 2025 14:50:09 -0400 Subject: [PATCH 3/4] ruff format --- bbot/modules/telerik.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bbot/modules/telerik.py b/bbot/modules/telerik.py index be01f07918..3cd0c8eed9 100644 --- a/bbot/modules/telerik.py +++ b/bbot/modules/telerik.py @@ -263,11 +263,11 @@ async def handle_event(self, event): str(root_tool_path / "testfile.txt"), result.url, ] - + # Add proxy if set in the scan config if self.scan.http_proxy: command.append(self.scan.http_proxy) - + output = await self.run_process(command) description = f"[CVE-2017-11317] [{str(version)}] {webresource}" if "fileInfo" in output.stdout: From 675d38e13d8a02d136955def47e092b031d440c0 Mon Sep 17 00:00:00 2001 From: liquidsec Date: Thu, 21 Aug 2025 15:39:49 -0400 Subject: [PATCH 4/4] =?UTF-8?q?the=20spellchecker=20strikes=20again=20?= =?UTF-8?q?=F0=9F=98=92?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bbot/test/test_step_2/module_tests/test_module_telerik.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bbot/test/test_step_2/module_tests/test_module_telerik.py b/bbot/test/test_step_2/module_tests/test_module_telerik.py index 390e196731..c401100bbe 100644 --- a/bbot/test/test_step_2/module_tests/test_module_telerik.py +++ b/bbot/test/test_step_2/module_tests/test_module_telerik.py @@ -11,7 +11,7 @@ async def setup_before_prep(self, module_test): # Simulate Telerik.Web.UI.WebResource.axd?type=rau detection expect_args = {"method": "GET", "uri": "/Telerik.Web.UI.WebResource.axd", "query_string": "type=rau"} respond_args = { - "response_data": '{ "message" : "RadAsyncUpload handler is registered successfully, however, it may not be accessed directly." }' + "response_data": '{ "message" : "RadAsyncUpload handler is registered succesfully, however, it may not be accessed directly." }' } module_test.set_expect_requests(expect_args=expect_args, respond_args=respond_args)