Metasploit Releases Web-Based ActiveX Fuzzing Engine

By | August 2, 2006

Metasploit offers AxMan – web-based ActiveX fuzzing engine. The goal of AxMan is to discover vulnerabilities in COM objects exposed through Internet Explorer. Since AxMan is web-based, any security changes in the browser will also affect the results of the fuzzing process.

This allows for a much more realistic test than other COM-based assessment tools. AxMan is designed to be used with Internet Explorer 6 only.

AxMan works by first enumerating all registered COM objects and their associated typelib information, then using that information to test each object´s properties and methods. To enumerate the COM information, copy binaxman.exe to the target system, and execute it as an administrative user:

C:> axman.exe myoutput

The axman.exe executable will take anywhere from 10 minutes to 2 hours to complete, depending on the number of COM objects registered on your system. While it runs, a number of new processes will be spawned and random popup windows will open. You can safely close any popup windows as they open, or just wait for the entire process to complete. Once axman.exe completes, the resulting directory should contain one javascript source file for every registered COM object.Read Full Story

Leave a Reply