Added 'useragent' explanation to readme and updated changes.

infobyte · Jun 8, 2016 · 8bb6608 · 8bb6608
1 parent debd2e6
commit 8bb6608
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/README.md b/README.md
@@ -619,6 +619,8 @@ will fill out for you (agentmd5, agentsha256, and agentsize) that can't be done
                 . "Content-Length: 0 \r\n"
                 . "Connection: close \r\n\r\n",
         },
+
+7) To filter via User-Agent, use as an example the Sparkle2 module. In base add  'useragent' => 'true', and on a request use as you would use the 'req' field but for user agents in 'useragent'. Note that this field already stripped "User-Agent: ".
 ```
 
 ## .:: [REQUIREMENTS] ::.

diff --git a/docs/CHANGES b/docs/CHANGES
@@ -6,6 +6,8 @@ Version 2.0.8 - 08-06-2016
 - Added a 2 new configuration variables <%URL_FILE%> and <%URL_FILE_EXT%>
 - ACER Care Center Live Update module added
 - OpenBazaar module added
+- Sparkle module generic exploitation added
+- Extended filtering of requests via useragent too. 
 
 Version 2.0.7 - 03-06-2016
 --------------------------

diff --git a/modules/sparkle2.pm b/modules/sparkle2.pm
@@ -6,7 +6,6 @@
 # Info:
 # https://vulnsec.com/2016/osx-apps-vulnerabilities/
 # Credits to @radekk
-# This module
 #
 # This file is part of isr-evilgrade, www.infobytesec.com .
 #
@@ -38,11 +37,11 @@ my $base = {
     'version'     => '1.0',
     'appver'      => 'All',
     'author'      => ['Matias Ariel Re Medina <mre[at]infobytesec[dot]com>'],
-    'description' => qq{},
+    'description' => qq{Sparkle },
     # 'vh'          => '', #(sequelpro.com)', # |adiumx.cachefly.net|download.panic.com|iterm2.com|github.com,
     'useragent' => 'true',
     'request'     => [
-        {   'req'    => 'testing', #match Sparkle header,
+        {   'req'    => '.*', #match Sparkle header,
             'useragent' => 'Sparkle',
             'agent' => '',
             'type'   => 'string',                  #file|string|agent|install