module

Cerberus FTP Server SFTP Username Enumeration

Try Surface Command
Back to search
Disclosed
May 27, 2014
Created
May 30, 2018

Description

This module uses a dictionary to brute force valid usernames from
Cerberus FTP server via SFTP. This issue affects all versions of
the software older than 6.0.9.0 or 7.0.0.2 and is caused by a discrepancy
in the way the SSH service handles failed logins for valid and invalid
users. This issue was discovered by Steve Embling.

Authors

Steve Embling
Matt Byrne attackdebris@gmail.com

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use auxiliary/scanner/ssh/cerberus_sftp_enumusers
    msf auxiliary(cerberus_sftp_enumusers) > show actions
        ...actions...
    msf auxiliary(cerberus_sftp_enumusers) > set ACTION < action-name >
    msf auxiliary(cerberus_sftp_enumusers) > show options
        ...show and set options...
    msf auxiliary(cerberus_sftp_enumusers) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today