Davscan - tool to discover hidden files & folders on DAV enabled webservers.

Davscan – tool to discover hidden files & folders on DAV enabled webservers.

DAVScan is a quick and lightweight webdav scanner designed to discover hidden files and folders on DAV enabled webservers. The scanner works by taking advantage of overly privileged/misconfigured WebDAV servers or servers vulnerable to various disclosure or authentication bypass vulnerabilities. The scanner attempts to fingerprint the target server and then spider the server based on the results of a root PROPFIND request.

davscan and SearchSploit – Exploit-DB’s CLI search tool

What works:
+ Server header fingerprinting – If the webserver returns a server header, davscan can search for public exploits based on the response.
+ Basic DAV scanning with PROPFIND – Quick scan to find anything that might be visible from DAV.
+ Unicode Auth Bypass – Works using GET haven’t added PROPFIND yet. Not fully tested so double check the work.
+ Exclusion of DoS exploit results – You can exclude denial of service exploits from the searchsploit results.
+ Exclusion of MSF modules from exploit results – Custom searchsploit is included in the repo for this. Either overwrite existing searchsploit or backup and replace. This feature may or may not end up in the real searchsploit script.

Latest Change 13/1/2017:
+ Fix some exception errors.
+ More fixes, it seems that some web severs don’t like Depth: infinity
+ Fixed the SSL errors

TODO:
– get ASP and PHP exploit results working
– make the dav scanner smart enough to not attempt IIS auth bypass unless server is IIS
– Bunch of other shit most likely. I’m just happy it doesn’t shit the bed when I run it with just the -H flag.

Usage:

Source: https://github.com/Graph-X