先日 [セミナー受講] JBoss Developer Workshop in 東京 11/09/13 – jBPM5 http://www.fxfrog.com/?p=3848 を公開しましたが、JBoss Management Console 動作例まで言及しておらず、やや消化不良でした。今回改めてスクリーンショットを採取しましたのでご紹介します。
＝＝＝
JBoss Management Console 動作例
■ cygwin 環境から ant 起動します。（最初に eclipse を、次いで jboss を）
↓
起動した Eclipse の 概要です。
↓
■ http://127.0.0.1:8080/web-console/ で JBoss Management Console を起動します。
なにやら稼働状況が表示されていますね。
JBoss |
|
VersionVersion: 5.1.0.GA (build: SVNTag=JBoss_5_1_0_GA date=200905221100) Version Name: The Oracle Built on: May 22 2009 |
EnvironmentStart date: Sat Sep 24 07:31:14 JST 2011 Host: Lets-note (192.168.56.1) Base Location: file:/C:/jbpm-installer/jboss-5.1.0.GA/server/ Base Location (local): C:\jbpm-installer\jboss-5.1.0.GA\server Running config: ‘default’ |
JVM – Hardware |
|
Hardware#CPU: 4 OS: Windows 7 6.1 (x86) |
JVM EnvironmentFree Memory: 105 MB Max Memory: 474 MB Total Memory: 474 MB #Threads: 81 JVM Version: 20.0-b11 (Sun Microsystems Inc.) JVM Name: Java HotSpot(TM) Server VM |
w3af (waf チェック）
■結果（標準的なスキャンオプションのみ実行）
[09/24/11 08:29:25] Auto-enabling plugin: discovery.serverHeader [09/24/11 08:29:25] Auto-enabling plugin: discovery.allowedMethods [09/24/11 08:29:25] Auto-enabling plugin: discovery.frontpage_version [09/24/11 08:29:27] The server header for the remote web server is: "Apache-Coyote/1.1". This information was found in the request with id 2. [09/24/11 08:29:27] "X-Powered-By" header for this HTTP server is: "Servlet 2.5; JBoss-5.0/JBossWeb-2.1". This information was found in the request with id 3. [09/24/11 08:29:27] Starting formAuthBrute plugin execution. [09/24/11 08:29:27] Starting basicAuthBrute plugin execution. [09/24/11 08:29:27] Found 1 URLs and 1 different points of injection. [09/24/11 08:29:27] The list of URLs is: [09/24/11 08:29:27] - http://127.0.0.1:8080 [09/24/11 08:29:27] The list of fuzzable requests is: [09/24/11 08:29:27] - http://127.0.0.1:8080 | Method: GET [09/24/11 08:29:27] "X-Powered-By" header for this HTTP server is: "Servlet 2.5; JBoss-5.0/JBossWeb-2.1". This information was found in the request with id 3. [09/24/11 08:29:27] The remote Web server has a custom configuration, in which any non existent methods that are invoked are defaulted to GET instead of returning a "Not Implemented" response. This information was found in the requests with ids 5 to 6. [09/24/11 08:29:28] Could not determine the language of the site. [09/24/11 08:29:28] Scan finished in 2 seconds.
※ヘッダ情報のみ取得しただけで基本的な脆弱性は無さそうでした（ディスカバリなどマシンが落ちるｗようなチェックまではしていない）。
BPMN ビジネスプロセスモデリングの紹介は別途紹介します。
以上
