Step-by-Step to Run the Scanning Modules
Main Framework
The main framework (RedisScannerFramework) is a Python-based Command Line Interface
(CLI) tool using with the cmd module. Its purpose is to provide a modular and extensible
structure for scanning and exploiting Redis server vulnerabilities via web applications.
Broken Authentication Module
Step 1: Start the Framework
Command: python3 [Link]
Purpose: Starts the Redis Scanner Framework, providing a CLI interface for managing modules.
Intention: To initialize the framework and prepare for module selection.
Redis >
Details: The framework will dynamically load all available modules during startup.
Step 2: Search for the Module
Command: search redis
Purpose: List modules matching the keyword redis.
Intention: To confirm that all the available Redis module is loaded.
Use this step to verify that the module has been correctly loaded.
Note the index (0 in this case) or the name (broken_authentication) for selecting the module.
Step 3: Select the Module
Command: use broken_authentication or (index number)
Purpose: Selects the Broken Authentication Vulnerability module.
Intention: To make this module active and ready for configuration and execution.
Details: You can also use the index instead of the name (e.g., use 0).
Step 4: Show Module Options
Command: show options
Purpose: Displays the configurable options for the module.
Intention: To understand and verify the default settings or customize them if needed.
Details: The TARGET is the IP of the web application connected to Redis.
The PORT specifies the web server's HTTP port.
WORDLIST contains a list of potential PHP pages for brute-forcing.
ACTION defines whether to scan or exploit.
NETWORK_RANGE is used for discovering devices on the network.
Step 5: Set Module Options
Command: set TARGET [Link]
Purpose: Configures the target IP address.
Command: set PORT 80
Purpose: Configures the HTTP port for the web application.
Command: set ACTION scan
Purpose: Specifies the module action as scan.
Step 6: Run the Module
Command: run
Purpose: Executes the full_scan method of the module.
Step 7: Test for Vulnerabilities
Command: set ACTION exploit
Purpose: Switches the module to exploitation mode.
Command: run
Purpose: Executes the inject_payloads method.
Step 8: Interpret Results
Purpose: Review the results to identify vulnerabilities.
Intention:
To confirm whether the Redis server lacks a bind address or password configuration.
To prepare recommendations for fixing these issues.
Details:
A bind value of [Link] exposes the Redis server to all network interfaces.
An empty requirepass value means no authentication is required.
Outcome Result Explanation
Network Discovery
Explanation: The tool sends the ARP request to the targeted network, then captured ARP
respond from live hosts in the network, showing their IP addresses, MAC addresses, and device
vendors. This step identifies live hosts for further scanning.
Port Scanning and Service Detection
Explanation: The scan identified open ports and corresponding services on the target IP
([Link]).
Web crawling and dir brute forcing
HTTP 500: Internal Server Error
Explanation: Indicates a problem with the php script. The server encountered an error it couldn't
handle while processing the request.
Common causes: Faulty or untested PHP scripts (e.g., syntax errors).
HTTP 404: Not Found
Explanation: Indicates the requested php pages does not exist on the server.
Common causes: The file may have been deleted, renamed, or not uploaded.
The crawling function only accesses the PHP pages explicitly linked within the <a href="...">
tags in the <ul> element. Here's why this behavior occurs:
1. How the Web Crawler Works
The crawler starts by fetching the [Link] page.
The crawling function does not attempt to guess or brute-force additional URLs. That’s why,
crawling depends on the availability of hyperlinks.
High-risk Commands Exposure Module
Step 1: Start the Framework
Command: python3 main_framework.py
Purpose: Launches the CLI framework.
Step 2: Load the Module
Command: use high_risk_commands (or) use index number to select the desire module.
Purpose: Activates the High-risk Commands Exposure Vulnerability module.
Step 3: Configure the Module
Set Target IP: set TARGET [Link]
Sets the target IP for scanning or exploitation.
Set Action: set ACTION scan
Configures the module to perform a scan.
Step 4: Run the Scan
Command: run
Purpose: Performs network discovery, port scanning, and web crawling.
Expected Outcome: Lists active devices, open ports, and accessible PHP pages.
Step 5: Set Action to Exploit
Command: set ACTION exploit
Purpose: Switches the module to exploitation mode.
Step 6: Run the Exploitation
Command: run
Purpose: Tests Redis commands via the [Link] page.
Expected Outcome: Identifies accessible Redis commands and their statuses (e.g., available,
renamed).
Memory misconfiguration Module
Step 1: Start the Framework
Command: python3 main_framework.py
Purpose: Launches the CLI framework.
Step 2: Load the Module
Command: use memory_misconfiguration or (index number)
Purpose: Activates the Memory Misconfiguration Vulnerability module.
Step 3: Configure the Module
Set Target IP: set TARGET [Link]
Configures the target web application.
Set Action:
For scanning: set ACTION scan
For SSRF exploitation: set ACTION ssrf_exploit
For DoS exploitation: set ACTION dos_exploit
Step 4: Execute the Selected Action
Run Scan: run
Performs network discovery, port scanning, and PHP page discovery.
Run SSRF Exploit: run
Exploits SSRF vulnerabilities to retrieve Redis memory settings.
Run DoS Exploit: run
Overloads Redis memory using key-value injection via SSRF.
PHPSESSID Cookie: The PHPSESSID cookie lacks the HttpOnly flag, exposing it to XSS-
based attacks and enabling potential session hijacking.
Unencrypted Communication (TLS)
Step 1: Start the Framework
Command: python3 main_framework.py
Purpose: Launches the CLI framework.
Step 2: Select the Module
Command: use unencrypted_communication (or) index number
Purpose: Activates the module.
Step 3: Configure the Module
Set Target IP: set TARGET [Link]
Set Action:
For scanning: set ACTION scan
For exploitation: set ACTION exploit
For analysis: set ACTION analyze
Step 4: Execute the Selected Action
Run Scan: run
Performs port scanning, service detection, and TLS testing.
Run Exploit: run
Executes Redis commands to generate traffic.
Example Output: Executing: redis-cli -h [Link] -p 6379 PING
Run Traffic Analysis: run
Analyzes captured traffic.
Example Output: Analyzing unencrypted traffic...
Packet details: Redis commands in plaintext