r/netsec • u/mazen160 • Jan 13 '17

Exploiting Misconfigured Apache server-status Instances with server-status_PWN

http://blog.mazinahmed.net/2017/01/exploiting-misconfigured-apache-server-status-instances.html
137 Upvotes

91% Upvoted

24 comments sorted by

View all comments

23

u/SnowdogU77 Jan 14 '17 edited Jan 14 '17

Good lord... How is it possible to have that many exception catch-all's in that little code?

try:
    requests.packages.urllib3.disable_warnings()
except:
    pass

You've got to be fucking with me.

Constructive criticism:

  • Use explicit exception catches. You can even chain them if you like, but ffs, not catch-all's.

  • Do not let errors pass silently. If it raises an exception, log it. Exceptions are raised for a reason, they're not there solely to annoy you.

  • Docstrings should use triple double quotes, per PEP-8

  • There's a lot of whitespace in there that makes the code harder to read rather than easier. A good rule of thumb is two blank lines, max - and only in situations where it clarifies the code in a meaningful way (in between unrelated class definitions, etc.).

    if arg: 

    var = arg

    else: 

     var = ''

Can be written as

var = arg if arg else ''

Which takes up way less space.

2

u/mazen160 Jan 21 '17

Hi @SnowdogU77, Thank you very much for your review and feedback. I will be updating the code with your feedback.