{"action":"opened","number":1,"pull_request":{"url":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls/1","id":37269753,"html_url":"https://github.com/net-ninja/metasploit-framework/pull/1","diff_url":"https://github.com/net-ninja/metasploit-framework/pull/1.diff","patch_url":"https://github.com/net-ninja/metasploit-framework/pull/1.patch","issue_url":"https://api.github.com/repos/net-ninja/metasploit-framework/issues/1","number":1,"state":"open","locked":false,"title":"BrowserAutoPwn 2 Testing","user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"body":"This is a request for testing for Browser Autopwn 2. We plan to release it sometime this year. You will be credited for testing/feedback.\r\n\r\n# Lab Setup\r\n\r\nPlease make sure to have the following setup:\r\n\r\n- [ ] Windows XP SP3 or Windows 7 SP1. No patches. This Windows box should have:\r\n       - [ ] Internet Explorer 8 (if you're on XP)\r\n       - [ ] Internet Explorer 9 (if you're on Win 7)\r\n       - [ ] [Mozilla Firefox](https://www.mozilla.org/en-US/firefox/new/) (doesn't matter what version, but if you want, one of the vulnerable versions we support is [FF 27](http://fs12.filehippo.com/9401/ab6c3b4687e94a3995d2197ba39c63a6/Firefox%20Setup%2027.0.exe))\r\n       - [ ] Adobe Flash for Firefox ([14.0.0.179](http://download.macromedia.com/pub/flashplayer/installers/archive/fp_14.0.0.179_archive.zip)). You will probably also need [other versions of Flash](https://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html) during testing.\r\n\r\n# Git Pull\r\n\r\n- [ ] To start testing, you will need to git pull this. For example:\r\n\r\n```\r\n$ git checkout BAPv2\r\n$ git pull https://github.com/wchen-r7/metasploit-framework.git bapv2\r\n```\r\n\r\n# Basic Usage of BAP\r\n\r\n- [ ] Start msfconsole\r\n- [ ] Do: ```use exploit/multi/browser/autopwn```\r\n- [ ] Do: ```run```\r\n- [ ] In about 10 seconds, BAP will be ready.\r\n\r\n# Basic Things to Test\r\n\r\n- [ ] When you do: ```jobs -K```, all jobs should stop.\r\n- [ ] When you do: ```set Include adobe_flash```, BAP should only give you Adobe Flash exploits.\r\n- [ ] When you do: ```set Exclude adobe_flash```, BAP will not give you any Adobe Flash exploits.\r\n- [ ] When you do: ```set MaxExploits 10```, BAP will only give you 10 exploits.\r\n- [ ] When you do: ```set MaxSessions 0```, BAP will not try to exploit.\r\n- [ ] When you do: ```set RealList true```, BAP will tell you what exploits could be used for each client.\r\n- [ ] When you do: ```set WhiteList file://tmp/ip.txt``` (ip.txt being a list of IPs), BAP will only serve exploits to clients that are on the whitelist.\r\n- [ ] When you do: ```set Content Hello, world```, and ```set MaxSessions 0```, BAP will only give the client the Hello World message, but no exploitation attempt. The Content option also supports the ```file://``` syntax if you want to load a simple HTML page. The more simple the better.\r\n- [ ] When you do: ```./msfconsole -q -r scripts/resource/bap_dryrun_only.rc```, BAP will not serve any exploits, but will tell you which exploits might be suitable for each client, and the client will be rickrolled (assuming you have Flash installed)\r\n- [ ] Try BAP against a vulnerable Flash. In our testing, we've found that some Flash exploits don't work very well with a hidden iframe, so we've changed that to an off-screen iframe instead, which seems to improve reliability.\r\n\r\nAnd that's it. Thanks!","created_at":"2015-06-09T16:01:08Z","updated_at":"2015-06-09T16:01:08Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls/1/commits","review_comments_url":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls/1/comments","review_comment_url":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/net-ninja/metasploit-framework/issues/1/comments","statuses_url":"https://api.github.com/repos/net-ninja/metasploit-framework/statuses/6eb25743e3e5b93444d56351867f5a3e2bc06b04","head":{"label":"wchen-r7:bapv2","ref":"bapv2","sha":"6eb25743e3e5b93444d56351867f5a3e2bc06b04","user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"repo":{"id":3789747,"name":"metasploit-framework","full_name":"wchen-r7/metasploit-framework","owner":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/wchen-r7/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/wchen-r7/metasploit-framework","forks_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/forks","keys_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/events","assignees_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/merges","archive_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/wchen-r7/metasploit-framework/releases{/id}","created_at":"2012-03-21T18:19:05Z","updated_at":"2014-08-01T16:20:50Z","pushed_at":"2015-06-09T15:14:09Z","git_url":"git://github.com/wchen-r7/metasploit-framework.git","ssh_url":"git@github.com:wchen-r7/metasploit-framework.git","clone_url":"https://github.com/wchen-r7/metasploit-framework.git","svn_url":"https://github.com/wchen-r7/metasploit-framework","homepage":"http://www.metasploit.com/","size":299218,"stargazers_count":6,"watchers_count":6,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":2,"forks":3,"open_issues":2,"watchers":6,"default_branch":"master"}},"base":{"label":"net-ninja:BAPv2","ref":"BAPv2","sha":"a39539f8efcde6d950c24ef449b449570592ec1e","user":{"login":"net-ninja","id":1301421,"avatar_url":"https://avatars.githubusercontent.com/u/1301421?v=3","gravatar_id":"","url":"https://api.github.com/users/net-ninja","html_url":"https://github.com/net-ninja","followers_url":"https://api.github.com/users/net-ninja/followers","following_url":"https://api.github.com/users/net-ninja/following{/other_user}","gists_url":"https://api.github.com/users/net-ninja/gists{/gist_id}","starred_url":"https://api.github.com/users/net-ninja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/net-ninja/subscriptions","organizations_url":"https://api.github.com/users/net-ninja/orgs","repos_url":"https://api.github.com/users/net-ninja/repos","events_url":"https://api.github.com/users/net-ninja/events{/privacy}","received_events_url":"https://api.github.com/users/net-ninja/received_events","type":"User","site_admin":false},"repo":{"id":17930179,"name":"metasploit-framework","full_name":"net-ninja/metasploit-framework","owner":{"login":"net-ninja","id":1301421,"avatar_url":"https://avatars.githubusercontent.com/u/1301421?v=3","gravatar_id":"","url":"https://api.github.com/users/net-ninja","html_url":"https://github.com/net-ninja","followers_url":"https://api.github.com/users/net-ninja/followers","following_url":"https://api.github.com/users/net-ninja/following{/other_user}","gists_url":"https://api.github.com/users/net-ninja/gists{/gist_id}","starred_url":"https://api.github.com/users/net-ninja/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/net-ninja/subscriptions","organizations_url":"https://api.github.com/users/net-ninja/orgs","repos_url":"https://api.github.com/users/net-ninja/repos","events_url":"https://api.github.com/users/net-ninja/events{/privacy}","received_events_url":"https://api.github.com/users/net-ninja/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/net-ninja/metasploit-framework","description":"Metasploit Framework","fork":true,"url":"https://api.github.com/repos/net-ninja/metasploit-framework","forks_url":"https://api.github.com/repos/net-ninja/metasploit-framework/forks","keys_url":"https://api.github.com/repos/net-ninja/metasploit-framework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/net-ninja/metasploit-framework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/net-ninja/metasploit-framework/teams","hooks_url":"https://api.github.com/repos/net-ninja/metasploit-framework/hooks","issue_events_url":"https://api.github.com/repos/net-ninja/metasploit-framework/issues/events{/number}","events_url":"https://api.github.com/repos/net-ninja/metasploit-framework/events","assignees_url":"https://api.github.com/repos/net-ninja/metasploit-framework/assignees{/user}","branches_url":"https://api.github.com/repos/net-ninja/metasploit-framework/branches{/branch}","tags_url":"https://api.github.com/repos/net-ninja/metasploit-framework/tags","blobs_url":"https://api.github.com/repos/net-ninja/metasploit-framework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/net-ninja/metasploit-framework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/net-ninja/metasploit-framework/git/refs{/sha}","trees_url":"https://api.github.com/repos/net-ninja/metasploit-framework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/net-ninja/metasploit-framework/statuses/{sha}","languages_url":"https://api.github.com/repos/net-ninja/metasploit-framework/languages","stargazers_url":"https://api.github.com/repos/net-ninja/metasploit-framework/stargazers","contributors_url":"https://api.github.com/repos/net-ninja/metasploit-framework/contributors","subscribers_url":"https://api.github.com/repos/net-ninja/metasploit-framework/subscribers","subscription_url":"https://api.github.com/repos/net-ninja/metasploit-framework/subscription","commits_url":"https://api.github.com/repos/net-ninja/metasploit-framework/commits{/sha}","git_commits_url":"https://api.github.com/repos/net-ninja/metasploit-framework/git/commits{/sha}","comments_url":"https://api.github.com/repos/net-ninja/metasploit-framework/comments{/number}","issue_comment_url":"https://api.github.com/repos/net-ninja/metasploit-framework/issues/comments{/number}","contents_url":"https://api.github.com/repos/net-ninja/metasploit-framework/contents/{+path}","compare_url":"https://api.github.com/repos/net-ninja/metasploit-framework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/net-ninja/metasploit-framework/merges","archive_url":"https://api.github.com/repos/net-ninja/metasploit-framework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/net-ninja/metasploit-framework/downloads","issues_url":"https://api.github.com/repos/net-ninja/metasploit-framework/issues{/number}","pulls_url":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls{/number}","milestones_url":"https://api.github.com/repos/net-ninja/metasploit-framework/milestones{/number}","notifications_url":"https://api.github.com/repos/net-ninja/metasploit-framework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/net-ninja/metasploit-framework/labels{/name}","releases_url":"https://api.github.com/repos/net-ninja/metasploit-framework/releases{/id}","created_at":"2014-03-20T03:58:32Z","updated_at":"2015-06-09T14:24:06Z","pushed_at":"2015-06-09T14:26:28Z","git_url":"git://github.com/net-ninja/metasploit-framework.git","ssh_url":"git@github.com:net-ninja/metasploit-framework.git","clone_url":"https://github.com/net-ninja/metasploit-framework.git","svn_url":"https://github.com/net-ninja/metasploit-framework","homepage":"http://www.metasploit.com/","size":230917,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls/1"},"html":{"href":"https://github.com/net-ninja/metasploit-framework/pull/1"},"issue":{"href":"https://api.github.com/repos/net-ninja/metasploit-framework/issues/1"},"comments":{"href":"https://api.github.com/repos/net-ninja/metasploit-framework/issues/1/comments"},"review_comments":{"href":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls/1/comments"},"review_comment":{"href":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/net-ninja/metasploit-framework/pulls/1/commits"},"statuses":{"href":"https://api.github.com/repos/net-ninja/metasploit-framework/statuses/6eb25743e3e5b93444d56351867f5a3e2bc06b04"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":97,"additions":1336,"deletions":355,"changed_files":19}}