[TOOL] WebRoot - Web Server Brute Forcer

From: SecuriTeam (support_at_securiteam.com)
Date: 04/25/05

Next message: SecuriTeam: "[NT] Novell's Nsure SSL DoS (webadmin.exe)"

Previous message: SecuriTeam: "[NEWS] Yawcam Directory Traversal"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 25 Apr 2005 15:14:51 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

WebRoot - Web Server Brute Forcer
------------------------------------------------------------------------

SUMMARY

DETAILS

Have you ever been auditing a system where files are stored on a web
server and accessed without authentication directly by an application that
knows each file URL.

Have you tried a number of spider tools but they are based on links so
they don't pull up anything.

CIRT.DK WebRoot is a Webserver auditing tools, that tries each and every
combination (incremental)or a list of words from a file, against the
Webserver.

In short:
A Brute Forcing tool to discover hidden directories, files or parameters
in the URL of a webserver.

Tool source:
#!/usr/bin/perl
#oO
#
# ************************* !!! WARNING !!! ******************************
# ************************* DO NOT DISTRIBUTE
*****************************
# * FOR SECURITY TESTiNG ONLY! *
# ***************************************************************
# * By using this code you agree that I makes no warranties or
representations, express or implied, about the *
# * accuracy, timeliness or completeness of this, including without
limitations the implied warranties of *
# * merchantability and fitness for a particular purpose. *
# * I makes NO Warranty of non-infringement. This code may contain
technical inaccuracies or typographical errors. *
# * This code can never be copyrighted or owned by any commercial company,
under no circumstances what so ever. *
# * but can be use for as long the developer, are giving explicit approval
of the usage, and the user understand *
# * and approve of all the parts written in this notice. *
# * This program may NOT be used by any Danish company, unless explicit
written permission from the developer . *
# * Neither myself nor any of my Affiliates shall be liable for any
direct, incidental, consequential, indirect *
# * or punitive damages arising out of access to, inability to access, or
any use of the content of this code, *
# * including without limitation any PC, other equipment or other
property, even if I am Expressly advised of *
# * the possibility of such damages. I DO NOT encourage criminal
activities. If you use this code or commit *
# * criminal acts with it, then you are solely responsible for your own
actions and by use, downloading,transferring, *
# * and/or reading anything from this code you are considered to have
accepted the terms and conditions and have read *
# * this disclaimer. Once again this code is for penetration testing
purposes only. And once again, DO NOT DISTRIBUTE! *
# ***************************************************************
#
#oO
#
# Author/Developer: Dennis Rand - CIRT.DK
# Website: http://www.cirt.dk
# Copyright: (c)2005 by Dennis Rand
# Remember: This program may NOT be used, published or downloaded by any
Danish company, unless explicit written permission.
# This would be violation of the law on intellectual property rights, and
legal actions will be taken.
# What this tool does:
# Have you ever been auditing a system where files are stored on a web
server and accessed without authentication directly
# by an application that knows each file URL.
#
# Have you tried a number of spider tools but they are based on links so
they don't pull up anything.
#
# CIRT.DK WebRoot is a Webserver auditing tools, that tries each and every
combination (incremental)or a list of words from
# a file, against the Webserver.
#
# In short:
# A Brute Forcing tool to discover hidden directories, files or parameters
in the URL of a webserver.
#
#oO
#
# Usage:
# Scan localhost port 80 search for 200 OK response at the url
http://127.0.0.1:80/admin/> incremental lowercase 1 to 3
# characters.
# WebRoot.pl -host 127.0.0.1 -port 80 -match "200 OK" -url
"/admin/<BRUTE>" -incremental lowercase -minimum 1 -maximum 3
#
#oO
#
# Installation notes:
# perl -MCPAN -e shell
# cpan > install Bundle::LWP
# cpan > install IO::Socket
# cpan > install Getopt::Long
# cpan > install Algorithm::GenerateSequence
# cpan > Net::SSLeay::Handle
# cpan > quit
#
#oO
#
# TODO:
# Make results go into an HTML Report - COMPLETED
# Make scanner use multi threats for speed. - MISSING
# Make support for SSL - COMPLETED
# Make support for POST bruteforcing. - MISSING
# Make support for Cookies - COMPLETED
# Make some sort of false positive check - MISSING
# Make support for recursive scan. - MISSING
#
# Ideas, Features, and code updates, or error corrections please send to
contact@cirt.dk
#
#oO
#
# Version descriptions
# Version 1.0
# I'm back from scratch, this time I'm going to make it a bit better, but
have patience.
# For now results are only written to screen.
#
# Version 1.1
# We now have support for saving the scanning into an HTML file
# Decide how many lines of output from the server goes into the report.
#
# Version 1.2
# More information added into the report start
# Now WebRoot also supports scanning of a HTTPS connection.
# The response in the report now shows the HTML
#
# Version 1.3
# Fixed a bug in the -diff and -match options.
#oO

use IO::Socket;
use Getopt::Long;
use Algorithm::GenerateSequence;
use Net::SSLeay::Handle qw/shutdown/;

$ver = "1.3";
$copyright = "(c)2005 by Dennis Rand - CIRT.DK";
$host = "127.0.0.1";
$port = "80";
$user_agent = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;
WebRoot $ver)";
$command = "GET";
$url = "/<BRUTE>";
$http_version = "HTTP/1.1";
$timeout = "10";
$l_number = 5;
$delay = "0";
@lowerc = ('a'..'z');
@upperc = ('A'..'Z');
@integ = ('0'..'9');
@spec = ('.', '%', '-', '_', '&', '?', '#', '=', '@', '/', '\\', '\'');
@all = (@lowerc, @upperc, @integ, @spec);
$sucess,$total = 0;
$timestampe = localtime;
$rap_updates = 0;
$recursive_f = "WebRoot.Recursive.Scan";

GetOptions(

        "host=s" => \$host,
        "port=i" => \$port,
        "ssl" => \$ssl,
        "timeout=i" => \$timeout,
        "delay=i" => \$delay,
        "incremental=s" => \$incremental,
        "minimum=i" => \$inc_minimum,
        "maximum=i" => \$inc_maximum,
        "wordlist=s" => \$wordlist,
        "url=s" => \$url,
        "command=s" => \$command,
        "different=s" => \$diff,
        "match=s" => \$match,
        "useragent=s" => \$user_agent,
        "cookie=s" => \$cookie,
        "http_version=s" => \$http_version,
        "reportlines=i" => \$l_number,
        "saveas=s" => \$log,
        "recursive" => \$recursive,


        "help|?" => sub {
        print "\n" x 2;
        print "\t\t################################################\n";
        print "\t\t# Webserver Bruteforcing $ver #\n";
        print "\t\t# ******* !!! WARNING !!! ****** #\n";
        print "\t\t# **** FOR PENETRATION USE ONLY ***** #\n";
        print "\t\t# ********************* #\n";
        print "\t\t# $copyright #\n";
        print "\t\t################################################\n\n";
        print "\t\t Basic settings\r\n";
        print "\t\t -host\t\t Set the host ip or hostname to scan\r\n";
        print "\t\t -port\t\t Set the port where the webserver are
located\r\n";
        print "\t\t -timeout\t Set a maximum timeout for each try\r\n";
        print "\t\t -delay\t Set a delay between each attempt\r\n";
        print "\r\n";
        print "\t\t Scanning options\r\n";
        print "\t\t -incremental\t Set if the scanning has to
bruteforce\r\n";
        print "\t\t use with \"lowercase\", \"uppercase\", \"integer\",
\"special\ or \"all\"\r\n\r\n";
        print "\t\t -minimum\t Set the min chars for the incremental
scan\r\n";
        print "\t\t -maximum\t Set the max chars for the incremental
scan\r\n";
        print "\t\t -wordlist\t Set if a wordlist is supplied\r\n";
        print "\t\t -url\t\t Set the URL to bruteforce.\r\n";
        print "\t\t Use <BRUTE> where you want the bruteforcing\r\n";
        print "\r\n";
        print "\t\t Advanced scanning options\r\n";
        print "\t\t -diff\t\t If the result has to be different, from the
response(Default)\r\n";
        print "\t\t use with \"404 File not found\" and it will find
anything NOT matching in the response\r\n\r\n";
        print "\t\t -match\t\t If the result has to match the
response\r\n";
        print "\t\t use with \"200 OK\" and it will find anything
matching\r\n\r\n";
        print "\t\t -command\t Set the HTTP command if not GET\r\n";
        print "\t\t Remeber you can also use <BRUTE> in this
field\r\n\r\n";
        print "\t\t -useragent\t Enter your own useragent\r\n";
        print "\t\t -cookie\t Enter a cookie value\r\n";
        print "\t\t -http_version\t If you want to use anything other then
HTTP/1.1\r\n";
        print "\t\t -recursive\t Make WebRoot scan recursively when
scanning for directories(Missing)\r\n";
        print "\r\n";
        print "\t\t Report options\r\n";
        print "\t\t -saveas\t Save report as defines name\r\n";
        print "\t\t -reportlines\t Amount of lines output from webserver
to put into report (Def: $l_number)\r\n";

exit;
}
);

   if ($port >= 0 and $port <= 65535){} else { print "Error: Port number
invalid, please use from 1-65535\r\n"; exit;}
   if (($inc_minimum) > ($inc_maximum)) {print "Error: The Maximum are
larger then the Minimum\r\n"; exit;}
   if (!$inc_minimum){$inc_minimum = "1"};
   if (!$inc_maximum){$inc_maximum = "3"};
   $r_url = $url;
#oO
#oO
# Check for updates at www.cirt.dk
sub ChkUpdates
{
   $| = 1;
   $updates = IO::Socket::INET->new(
   Proto => "tcp",
   PeerAddr => "www.cirt.dk",
   PeerPort => "80",
   Reuse => 1,
   Timeout => 10,) || print "";
}

ChkUpdates();
$response = undef;
print $updates "GET /tools/webroot/wr_update.txt HTTP/1.0\r\nHost:
www.cirt.dk\r\nUser-Agent: Mozilla/4.0 (WebRoot Update Check)\r\n\r\n";
while(<$updates>)
   {
      if(!defined($response)){$response = $_;}
      $result .= $_;
   }
if ($result =~ m/200 OK/mgsi)
{
   if($result !~ m/$ver/mgsi)
   {
      printf STDERR
"\r\no0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0\r\nINFORMATION:\r\nCIRT.DK WebRoot scanner has been updated, get the latest version at www.cirt.dk\r\nThe scan will continue in 5 seconds\r\no0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0\r\n";
      close(updates);
      $rap_updates = 1;
      sleep(5);
   }
}

#oO
#oO
# Catch Interupt - CTRL + C

sub catchInterrupt
{
   $SIG{INT} = sub {exit;};
   print "\n\n", "o0" x 12, "\n[X] Interrupted\t\t\t\t - DONE\n", "o0" x
12, "\r\n\r\n";
   exit;
};

$SIG{INT} = \&catchInterrupt;

# verify that interrupt handler was installed properly

unless(defined($SIG{INT})){print "Unable to install signal handler,
contact $copyright";}
unless($SIG{INT} == \&catchInterrupt){print "There was an unexpected error
installing the signal handler, contact $copyright";}

#oO
#oO
# Write start of logfile
sub start_log
{
   $r_url =~ s/</</g;
   $r_url =~ s/>/>/g;
   if (!$log)
   {
      $log = "WebRoot_Scanner_".$host."_".$port.".html";
   }
   open(FH, ">", $log);
   print FH "\r\n\r\n";
   print FH "<HTML>\n<HEAD>\n<TITLE>CIRT.DK WebRoot Security Scanner
Version $ver</TITLE>\n<BODY BGCOLOR=white>\n";
   print FH "<SCRIPT LANGUAGE=\"JavaScript\" TYPE=\"text/javascript\">\n";
   print FH "\n";
   print FH "</SCRIPT>\n";
   print FH "</HEAD>\n";
   print FH "<TABLE WIDTH=90% BGCOLOR=white CELLSPACING=0 CELLPADDING=2
BORDER=0>\n<TR>\n<TD>\n<CENTER>\n<FONT FACE=Tahoma COLOR=black
SIZE=+2><B>CIRT.DK WebRoot Version
$ver</B></FONT>\n</LEFT>\n</TD>\n</TABLE>\r\n";
   print FH "<TABLE WIDTH=90% BGCOLOR=white CELLSPACING=0 CELLPADDING=2
BORDER=0>\n<TR>\n<TD>\n<CENTER>\n<FONT FACE=Tahoma COLOR=black
SIZE=1><B>$copyright</B></FONT>\n</LEFT>\n</TD>\n</TABLE>\n<BR>\r\n";
   print FH "<TABLE WIDTH=90% BGCOLOR=black CELLSPACING=0 CELLPADDING=2
BORDER=0>\n<TR>\n<TD>\n<CENTER>\n<FONT FACE=Tahoma COLOR=white
SIZE=+1><B>Audit Rapport for $host port
$port</B>\n</FONT>\n</LEFT>\n</TD>\n</TABLE>\n<BR>\r\n";

   if($rap_updates)
   {
      print FH " <B><CENTER>This scan was run with an outdated version of
WebRoot, get the latest version from
http://www.cirt.dk>\r\n</CENTER><BR>\r\n";
   }
   print FH "<TABLE WIDTH=90% BGCOLOR=white CELLSPACING=0 CELLPADDING=0
BORDER=0><TR ALIGN=left><COLOR=black SIZE=2>\r\n";

   print FH "\r\n";
   print FH " <TR>\r\n";
   print FH " <TD>\r\n";
   print FH " <B>Host:</B>\r\n";
   print FH " </TD>\r\n";
   print FH " <TD><LEFT>\r\n";
   print FH " <B>$host</B>\r\n";

   print FH "\r\n";
   print FH " <TR>\r\n";
   print FH " <TD>\r\n";
   print FH " <B>Port number:</B>\r\n";
   print FH " </TD>\r\n";
   print FH " <TD><LEFT>\r\n";
   print FH " <B>$port</B>\r\n";
   print FH " </LEFT></TD>\r\n";
   print FH " </TR>\r\n";
   print FH "\r\n";

   if($ssl)
   {
      print FH " <TR>\r\n";
      print FH " <TD>\r\n";
      print FH " <B><BR>Using SSL:</B>\r\n";
      print FH " </TD>\r\n";
      print FH " <TD><LEFT>\r\n";
      print FH " <B><BR>TRUE</B>\r\n";
      print FH " </LEFT></TD>\r\n";
      print FH " </TR>\r\n";
   }

   print FH " <TR>\r\n";
   print FH " <TD>\r\n";
   print FH " <B><BR>Bruteforce:</B>\r\n";
   print FH " </TD>\r\n";
   print FH " <TD><LEFT>\r\n";
   if($ssl)
   {
      print FH " <B><BR>https://$host:$port$r_url>\r\n";
   }
   else
   {
      print FH " <B><BR>http://$host:$port$r_url>\r\n";
   }
   print FH " </LEFT></TD>\r\n";
   print FH " </TR>\r\n";

   if($match)
   {
      print FH " <TR>\r\n";
      print FH " <TD>\r\n";
      print FH " <B>Result has to match:</B>\r\n";
      print FH " </TD>\r\n";
      print FH " <TD><LEFT>\r\n";
      print FH " <B>$match</B>\r\n";
      print FH " </LEFT></TD>\r\n";
      print FH " </TR>\r\n";
   }

   if($diff)
   {
      print FH " <TR>\r\n";
      print FH " <TD>\r\n";
      print FH " <B>Result has to be different from:</B>\r\n";
      print FH " </TD>\r\n";
      print FH " <TD><LEFT>\r\n";
      print FH " <B>$diff</B>\r\n";
      print FH " </LEFT></TD>\r\n";
      print FH " </TR>\r\n";
   }

   print FH " <TR>\r\n";
   print FH " <TD>\r\n";
   print FH " <B>Scan Started:</B>\r\n";
   print FH " </TD>\r\n";
   print FH " <TD><LEFT>\r\n";
   print FH " <B>$timestampe</B>\r\n";
   print FH " </LEFT></TD>\r\n";
   print FH " </TR>\r\n";

   print FH "</TABLE>\r\n";
   print FH "<BR><TABLE WIDTH=90% BGCOLOR=black CELLSPACING=0
CELLPADDING=2 BORDER=0><TR><TD><CENTER><FONT FACE=Tahoma COLOR=white
SIZE=+1><B>Audit Results</B></FONT></LEFT></TD></TABLE>\r\n";
   print FH "\r\n";
   print FH "<TABLE WIDTH=70% BGCOLOR=white CELLSPACING=0 CELLPADDING=0
BORDER=0><TR ALIGN=left><BR>\r\n";
   close(FH);
}

#oO
#oO
# Write results to logfile
sub write_log
{
   $html_hostheader = $hostheader;
   $html_hostheader =~ s/\r\n/<BR>/g;
   open(FH, ">>", $log);
   print FH "\r\n";
   print FH " <TR>\r\n";
   print FH " <TD>\r\n";
   if($ssl)
   {
      print FH " <B><A
HREF=\"https://$host:$port$uri\">https://$host:$port$uri
COLOR=\"#FF0000\"></FONT></A></B><BR>\n";
   }
   else
   {
      print FH " <B><A
HREF=\"http://$host:$port$uri\">http://$host:$port$uri
COLOR=\"#FF0000\"></FONT></A></B><BR>\n";
   }
   print FH " <B><A onClick=\"expandIt(input$total); return false\"
CLASS=\"outline\">+ Sent to server</A></B><BR>\n";
   print FH " <DIV ID=\"input$total\" CLASS=\"hiddentext\">\n";
   print FH " $command $uri $http_version<BR>$html_hostheader<BR><BR>";
   print FH " </DIV>\n";

   print FH " <B><A onClick=\"expandIt(output$total); return false\"
CLASS=\"outline\">+ Response from server:</B></A><BR>\n";
   print FH " <DIV ID=\"output$total\" CLASS=\"hiddentext\">\n";
   $result =~ s/</</g;
   $result =~ s/>/>/g;
   my @lines = split(/\n/,$result);
   my $firstlines;
   for(0 .. $l_number)
   {
      $firstlines .= $lines[$_];
      print FH "$lines[$_]<BR>\r\n";
   }
   print FH " </DIV>\n";
   print FH " <HR>\r\n";
   print FH " </TD>\r\n";
   close (FH);

}

   print FH " <TR>\r\n";
   print FH " <TD>\r\n";
   print FH " <B>Possible findings:</B>\r\n";
   print FH " </TD>\r\n";
   print FH " <TD><LEFT>\r\n";
   print FH " <B>$sucess<B>\r\n";
   print FH " </LEFT></TD>\r\n";
   print FH " </TR>\r\n";
   print FH "\r\n";

print FH "\r\n\r\n";
   print FH "</HTML>\r\n";
   close (FH);
}

#oO
#oO
# Lets create the host header
$hostheader = "Accept: */*\r\n";
$hostheader .= "Accept-Language: en\r\n";
$hostheader .= "User-Agent: $user_agent\r\n";
$hostheader .= "Host: $host\r\n";
if($cookie)
{
$hostheader .= "Cookie: $cookie\r\n";
}
$hostheader .= "Connection: Close\r\n";

#oO
#oO
# Save findings into for Recursive scanning

sub recursive_teaching
{
   if($recursive)
   {
      open(RECU_LEARN, ">>", $recursive_f);
      print RECU_LEARN "$brute/\r\n";
      close RECU_LEARN;
   }
}

#oO
#oO
#Incremental
if ($incremental)
{
   @choice = split(/,/, $incremental);
   foreach $inc_input (@choice)
   {
      if ($inc_input eq "lowercase") {@do_choice = @lowerc;}
      elsif ($inc_input eq "uppercase") {@do_choice = @upperc}
      elsif ($inc_input eq "integer") {@do_choice = @integ}
      elsif ($inc_input eq "special") {@do_choice = @spec;}
      elsif ($inc_input eq "all") {@do_choice = @all;break;}
      else
      {
         print "Error: You have to specify the -incremental with
lowercase, uppercase, integer, special or all\r\n"; exit;
      }

   }
   start_log();
   $start_pos = ($inc_minimum - 1);
   do
   {
      my $len = $start_pos;
      my $gen = Algorithm::GenerateSequence->new(
      map {[@do_choice]} (0 .. $len)
      );

      local $" = "";
      while(my @c = $gen->next)
      {
$brute = join("",@c);
         $uri = $url;
$uri =~ s/<BRUTE>/$brute/g;
$hostheader =~ s/<BRUTE>/$brute/g;
         bruteforcing();

      }
      $start_pos++;
   } until ($start_pos >= $inc_maximum);
}

#oO
#oO
#Wordlist
if ($wordlist)
{
   foreach (split(/,/, $wordlist))
   {
      if (-f $_)
      {
         start_log();
         open(_FILE, $_);
         while (<_FILE>)
         {
            s/\r//;
            chomp;
            $brute = $_;
            $uri = $url;
    $uri =~ s/<BRUTE>/$brute/g;
    $hostheader =~ s/<BRUTE>/$brute/g;
    $found = $brute;
            bruteforcing();
         }
         close(_FILE);
      }
      else
      {
         print "\r\nThe wordfile you are trying to use: '$_' could not be
found\n";
         print "WebRoot.pl -help or -?' for more information.\n";
         exit;
      }
   }
}

#oO
#oO
# The connection are setup here.
sub connection {
   $| = 1;
   $remote = IO::Socket::INET->new(
   Proto => "tcp",
   PeerAddr => $host,
   PeerPort => $port,
   Reuse => 1,
   Timeout => $timeout,) || die {print "\r\n Could not connect to $host on
port $port \r\n"};
}

#oO
#oO
# Let the bruteforcing begin
sub bruteforcing
{
   sleep($delay);
   $total++;
   $result = "";
   $response_code = undef;
   connection();

   if($ssl)
   {
      $ssl=1;
      eval
      {
         tie(*SSL, "Net::SSLeay::Handle", $target,$port);
      };
      print SSL "$command $uri $http_version\r\n$hostheader\r\n\r\n";
      shutdown(\*SSL, 1);
      while(<SSL>)
      {
         if(!defined($response_code)){$response_code = $_;}
         $result .= $_;
      }
   }
   else
   {
      print $remote "$command $uri $http_version\r\n$hostheader\r\n\r\n";
      while (<$remote>)
      {
         if(!defined($response_code)){$response_code = $_;}
         $result .= $_;
      }
   }

   if($match)
   {
      if($result =~ m/$match/mgsi) {print
"X";$sucess++;write_log();recursive_teaching();} else {print "*";}
   }

   if($diff)
   {
      if($result !~ m/$diff/mgsi) {print
"X";$sucess++;write_log();recursive_teaching();} else {print "*";}
   }
   close($remote);
}
end_log();
print "\r\n\r\n";

ADDITIONAL INFORMATION

The information has been provided by <mailto:DennisRand@CIRT.dk> Dennis
Rand.
To keep updated with the tool visit the project's homepage at:
<http://www.cirt.dk/tools/webroot/WebRoot.txt>
http://www.cirt.dk/tools/webroot/WebRoot.txt

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Next message: SecuriTeam: "[NT] Novell's Nsure SSL DoS (webadmin.exe)"

Previous message: SecuriTeam: "[NEWS] Yawcam Directory Traversal"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[NEWS] Apple OSX Fetchmail Buffer Overflow
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apple OSX Fetchmail Buffer Overflow ... alarm $timeout; ... sub ERR ...
(Securiteam)
[TOOL] Multimap - Multithreaded Wrapper for NMap
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... concurrent NMap scans and speed up the scan of large networks. ... Writes the results to an HTML file ... sub getDate { ...
(Securiteam)
[EXPL] I-Mall Commerce i-mall.cgi Arbitrary Command Execution (Exploit)
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A remote command execution vulnerability has been discovered in the I-Mall ... sub intro { ... chomp $host; ...
(Securiteam)
[TOOL] Flawseeker - Runtime Address Overflow Seeker
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... sub exploit_adjacent { ... printf <<EOF ... sub execmenu() { ...
(Securiteam)
[NT] Zango Adware - Insecure Auto-Update and File Execution
... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Zango Adware - Insecure Auto-Update and File Execution ... Initial Install ... You have legitimate control over the DNS server ...
(Securiteam)