24 Matching Annotations
  1. Aug 2022
    1. by calling the method and then defining a proc

      Uhhh yeah so actually its the proc itself that calls the method and the proc itself will be executed inside a different namespace than Metasploit::Framework::LoginScanner::HTTP I think (since your return the proc). Its not until the <proc name>.call() function is called that this actually executes so the method isn't called at this point.

      Your also missing the code snippet where you actually make this call.

    2. These methods are then called from the Metasploit::Framework::LoginScanner::HTTP class to check the value of datastore[‘HttpTrace’] and set the proc accordingly.

      Uhhh I think only one option does this proc functionality not all of them? You also just stated they only return the value of the respective datastore options so this is a contradiction at the very least.

    3. smb_version

      This could be confusing since its ambiguous if this might be a scanner module, or an auxiliary/gather module. Best to include the full path to the module here.

    4. Figure 5: Code example showing Metasploit::Framework::LoginScanner::HTTP

      This is way too wordy and confusing. Please reword this to be clearer and more succinct. You seem to be trying to express 3 ideas at once here vs focusing on the one important idea.

      Sorry couldn't highlight the entire quote but this applies to the entire quote.

    5. Figure 3: Code example showing the usage of print statements in Rex:: namespace, which is not ideal

      Should look at changing the configuration of this caption text in your posts to be smaller. Its bigger than the main text of the article which is odd.

    6. register options in this library since register options are limited to the Metasploit codebase only

      Technically these are datastore options not register options. Should also clarify that by Metasploit codebase you mean the Metasploit:: and Msf:: namespaces or otherwise specify which specific namespaces you are referring to since that is the topic of discussion here.

    7. implement a register option in the Rex:: namespace, nor can we use print statements for logging in the Rex:: layer. This is because the Rex:: layer is meant to work independently as a gem and it should not access Metasploit code in any way.

      The relationship here isn't explained well. You lack the explanation of the datastore and how that can only be accessed from the Metasploit:: namespace.

    8. Rex:: being the top layer and Msf:: being the bottom layer and Metasploit:: in the intermediate part.

      Rex:: being the top layer, Msf:: being the bottom layer, and Metasploit:: in the intermediate part.

      This is a list format as it contains 3 or more items you are describing. Don't use multiple "and" in this case. Instead separate list items with commas with the last element starting with ", and"

    9. Currently, there are some login scanner modules that do not access the Metasploit:: API, and directly call the Rex:: class for sending requests and responses (e.g. buffalo_login. So, HTTP-Trace feature will not work for those modules as of now. Conclusion It’s a wrap for Mid-Terms :) Our plan for next week is to re-construct those login scanner modules which do not access the Metasploit:: API currently.

      This feels like a repeat of information. Perhaps this note can be moved into the conclusion and your explanation line of the HTTP-Trace feature not working also included?

      I feel like the Conclusion is missing that explanation whilst the Note is good but doesn't explain your future plans.

    10. code.

      For what purpose? Should reiterate the goal here otherwise you saying your doing a piece of work and my next reaction is "okay but why". Keep in minder the reader may forget points as they go along so having these explanations at hand helps make your text easier to read vs them having to now go back, find the paragraph where you explained why this concept was needed, and then reread.

      You often hear people say that certain books are hard to read. This can be one of the reasons why people might state this.

    11. some login scanner modules make a call to the Rex::Proto::Http::Client library directly without touching the Metasploit:: API.

      See above point about scanner types/implementations. Seems like this is what you were trying to go for here but you only start discussing different implementation styles at the very end here instead of discussing how the two examples about are each their own unique style of implementation of a login scanner.

    12. Metasploit::Framework::LoginScanner::HTTP common library.

      These are just two examples. And I don't see any groupings of types of Login Scanners here. So its hard for me to take these two examples as representative of all the login scanners in Metasploit without this contextual information r.e the different login scanner types/implementations that is missing here.

    13. >

      This looks like a greater than sign vs an arrow.

      It may be better to separate this into a code section with indentation to better show the class heirarchy and what relies on what.

      We could also use arrows with --> but personally I would say that is also confusing as to what inherits what without further text explaining things.

    14. see Approach#1)

      See it....where exactly? Its not in this page. As a reader who is reading your blog you should always try to assume your reader has not read your previous articles where possible, and where this is required, always link to the previous article at the top of your blog post and ideally discuss what was covered in that blog post. This will make it easier for users to find the information they are after and reference topics they might need to fill in their knowledge on.

    15. So, in this solution Rex:: namespace is not defining anything on its own, rather it’s just accessing the elements defined in the Msf:: namespace.

      Actually technically speaking its sending the proc so that Msf namespace does the work on its behalf thus preventing the namespace issues. You haven't really explained it this well by this point and so you likely will want to clarify this point here.