Home page logo

fulldisclosure logo Full Disclosure mailing list archives

MonkeyShell: using XML-RPC for access to a remote shell
From: Abe Usher <securitylist () sharp-ideas net>
Date: Sun, 10 Oct 2004 20:57:09 -0400

Security pundits have been warning about the dangers implicit with Web
services for years. A good starting point for understanding the security
issues related to Web services can be found at:

Of course to really understand the security risks posed by Web services,
you need to understand the basics of Web services. Enter an application
I wrote called "Monkey Shell."

MonkeyShell is a simple open source Python application that uses
extensible markup language remote procedure calls (XML-RPC) to execute
commands through a remote system shell.

I kept the code terse (less than 100 lines total) so that it can be
studied easily.  It is similar to netcat except instead of "shell
shoveling" data through a raw TCP connection, it wraps data in XML and
transports it over HTTP.

MonkeyShell is freely available at:

Abe Usher, CISSP

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
  • MonkeyShell: using XML-RPC for access to a remote shell Abe Usher (Oct 11)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]