From f85eda7ec18468f43d22bb7956cdf60698c213fb Mon Sep 17 00:00:00 2001
From: "Z. Cliffe Schreuders" <code.cliffe@schreuders.org>
Date: Mon, 15 Jul 2019 11:47:50 +0100
Subject: [PATCH] webapps conflict with eachother since they accept any
 virtualhost name

---
 .../unix/webapp/gitlist_040/secgen_metadata.xml           | 5 +++++
 .../unix/webapp/moinmoin_195/secgen_metadata.xml          | 8 +++++++-
 .../unix/webapp/onlinestore/secgen_metadata.xml           | 5 +++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/modules/vulnerabilities/unix/webapp/gitlist_040/secgen_metadata.xml b/modules/vulnerabilities/unix/webapp/gitlist_040/secgen_metadata.xml
index 2e1f85951..576fe6b90 100644
--- a/modules/vulnerabilities/unix/webapp/gitlist_040/secgen_metadata.xml
+++ b/modules/vulnerabilities/unix/webapp/gitlist_040/secgen_metadata.xml
@@ -49,6 +49,11 @@
   <msf_module>exploit/linux/http/gitlist_exec</msf_module>
   <hint>Visit the webapp in a browser at: ip:80/gitlist </hint>
 
+  <!-- can't live alongside other web sites, since they it accepts any virtual host name -->
+  <conflict>
+    <type>webapp</type>
+  </conflict>
+
   <requires>
     <module_path>.*apache.*compatible.*</module_path>
   </requires>
diff --git a/modules/vulnerabilities/unix/webapp/moinmoin_195/secgen_metadata.xml b/modules/vulnerabilities/unix/webapp/moinmoin_195/secgen_metadata.xml
index c7d47b679..e9d6b89c8 100644
--- a/modules/vulnerabilities/unix/webapp/moinmoin_195/secgen_metadata.xml
+++ b/modules/vulnerabilities/unix/webapp/moinmoin_195/secgen_metadata.xml
@@ -33,6 +33,7 @@
     <value>80</value>
   </default_input>
 
+  <!-- TODO: should strings_to_leak be hidden away on the server, so the exploit needs exploiting before getting to the files, at the moment browsing to the website reveals the files -->
   <default_input into="strings_to_leak">
     <value>This is some leaked data.</value>
     <generator type="message_generator"/>
@@ -69,6 +70,11 @@
     Path traversal found in AttachFile module.
   </solution>
 
+  <!-- can't live alongside other web sites, since they it accepts any virtual host name -->
+  <conflict>
+    <type>webapp</type>
+  </conflict>
+
   <conflict>
     <name>.*Stretch.*</name>
   </conflict>
@@ -79,4 +85,4 @@
   </requires>
 
 
-</vulnerability>
\ No newline at end of file
+</vulnerability>
diff --git a/modules/vulnerabilities/unix/webapp/onlinestore/secgen_metadata.xml b/modules/vulnerabilities/unix/webapp/onlinestore/secgen_metadata.xml
index af851a041..9bcfc9de8 100644
--- a/modules/vulnerabilities/unix/webapp/onlinestore/secgen_metadata.xml
+++ b/modules/vulnerabilities/unix/webapp/onlinestore/secgen_metadata.xml
@@ -143,6 +143,11 @@
     <module_path>modules/bases/kali.*</module_path>
   </conflict>
 
+  <!-- can't live alongside other web sites, since they it accepts any virtual host name -->
+  <conflict>
+    <type>webapp</type>
+  </conflict>
+
   <requires>
     <module_path>.*apache.*compatible.*</module_path>
   </requires>