Update to newer perl about dotdotpwn

[wireghoul]

Hi there,

It's not the perl version that is causing this error. You don't have the required module. Please refer to the following information from the README file:

=== REQUIREMENTS ===

• Perl (http://www.perl.org)
  Programmed and tested on Perl 5.8.8 and 5.10
• Nmap (http://www.nmap.org)
  Only if you plan to use the OS detection feature
  (needs root priviledges)

Perl modules:

• Net::FTP
• TFTP
• Time::HiRes
• Socket
• IO::Socket
• Getopt::Std
• Switch

You can easily install the missing modules doing the
following as root:

perl -MCPAN -e "install <MODULE_NAME>"

or

cpan

cpan> install <MODULE_NAME>

Installing the missing modules will solve this problem for you.

[wireghoul]

You can easily install the missing modules doing the
following as root:

perl -MCPAN -e "install <MODULE_NAME>"
or
cpan> install <MODULE_NAME>

[user021]

Thx for support, perl -MCPAN -e "install TFTP" fixed the issue.

Hi,

just for the information:

If you want to use the package libnet-tftp-perl from your package manager on ubuntu/debian you have to change the line:

use TFTP;

to:

use Net::TFTP;

in this file: https://github.com/wireghoul/dotdotpwn/blob/master/DotDotPwn/TFTP.pm

[user021]

I did not want to make new thread for this so ill go offtopic with this question, basically i was wondering for a while if there are any major differences in detecting a LFI vuln with dotdotpwn compared to fimap in blind mode, i know fimap launches fewer fuzz requests so it might miss something?

[wireghoul]

dotdotpwn looks for directory traversals and aims to defeat blacklist filtering (thus the large number of requests). While dotdotpwn may detect LFI as the attack vector is similar they are not the same class of bug. Next time try to google/owasp and do some reading. Or better yet, try running the tools against some vulnerable apps and find out for yourself.

[wireghoul]

@RealRancor Those are different modules and blind changes may break functionality. While I'm not opposed to supporting a larger number of modules it would require a significant rewrite. I'm leaving this as #wontfix for now.

Hi,

and thanks for the clarification. I wasn't aware that those are two different modules. Don't think that it is needed to support the other module also.