API tools faq
paste
Advertisement
henriq1

Facebook vuls by SUP3RM4N AND KORZUS -CYBER HATS

henriq1
Jul 17th, 2013
3,580
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 59.21 KB | None | 0 0
raw download clone embed print report
  1. Facebook vuls by SUP3RM4N AND KORZUS -CYBER HATS
  2.  
  3. Like any good hacker in your goodbyes, it left a legacy, a legacy that will be followed
  4. by future generations inspired it. We, the directors of Cyber Hats, Korzus Tesla and
  5. SUP3RM4N to celebrate my "retirement" in the hacker world, I Korzus along to our great
  6. SUP3RM4N divulge critical vulnerabilities found on facebook. From SQL Injection to many
  7. others. A hacker never die, they just live a new life in a new way, real life. Our force
  8. anyone to our firepower is infinite, pixel by pixel is explored by us, byte by byte we
  9. sailed to our goal, in a relentless struggle for knowledge. Cyber Hats, the virtual Lords,
  10. who run after knowledge, humbly. There is nothing to stop us, no firewall or anti-virus.
  11. Our strength depends only on our knowledge and ability to learn, we are invulnerable
  12. because we are human, and no machine can beat us. We are Cyber Hats, we are the legend,
  13. we have a legacy and it will be maintained to the ever ever, beyond infinity.
  14.  
  15. vul sql :http://apps.facebook.com/g_dircom/index.php?id=1
  16. VUL SQL :http://apps.facebook.com/mobipride/index.php?id=42
  17. vul sql:http://apps.facebook.com/viewmycalendar/index.php?id=161
  18. PROGRAMATION ERROR:http://apps.facebook.com/mobipride/
  19. PROGRAMATION ERROR:http://apps.facebook.com/g_dircom/
  20. PROGRAMARION ERROR:http://apps.facebook.com/viewmycalendar/
  21. JAVA SCRIPTING ERROR:http://apps.facebook.com/galacticosfootball/en/soccer/simulation/playerpublic/6743
  22. REMORE SERVER CAN BE INFECTED WITH THE NINDA VIRUS:http://apps.facebook.com/mobipride/mobipride/readme.eml
  23. POSSIBLE HAVE INFORMATION ABOUT ANY FACEBOOK:https://graph.facebook.com/303943362983320/accounts/test-users?installed=true&name=test&permissions=HaCked+By+SUP3RM4N+CYBER+HATS&method=post&show_stream
  24. CYBER HATS TEAM INFORMATION ABOUT US:https://graph.facebook.com/cyberhats
  25. SERVER AKAMAI:https://fbstatic-a.akamaihd.net/rsrc.php/v2/y1/r/GbL5UMVTlQR.js
  26.  
  27. + Target IP: 31.13.73.23
  28. + Target Hostname: apps.facebook.com
  29. + Target Port: 80
  30. + Start Time: 2013-04-14 22:05:31 (GMT-3)
  31. ---------------------------------------------------------------------------
  32. + Server: No banner retrieved
  33. + Cookie reg_ext_ref created without the httponly flag
  34. + Cookie reg_fb_gate created without the httponly flag
  35. + Cookie reg_fb_ref created without the httponly flag
  36. + Uncommon header 'x-fb-debug' found, with contents: OxWZVhWyT6cCHntxYINhtUGLv7K
  37. Fou7E70xNaK5gfXE=
  38. + Uncommon header 'x-frame-options' found, with contents: DENY
  39. + Uncommon header 'x-xss-protection' found, with contents: 0
  40. + Uncommon header 'x-content-type-options' found, with contents: nosniff
  41. + No CGI Directories found (use '-C all' to force check all possible dirs)
  42. + lines
  43. + /crossdomain.xml contains 0 line which should be manually viewed for improper
  44. domains or wildcards.
  45. + File/dir '<script>window.Bootloader && Bootloader.done(["+mq8P"]);</script><sc
  46. ript>new (require("ServerJS"))().handle({"require":[["removeArrayReduce"],["mark
  47. JSEnabled"],["lowerDomain"],["QuicklingPrelude"],["Primer"]]})</script></head><b
  48. ody class="ego_wide canvas center_fixed_width_app fbx UIPage_LoggedOut liquid hi
  49. deBanner Locale_pt_BR"><div id="FB_HiddenContainer" style="position:absolute; to
  50. p:-10000px; width:0px; height:0px;"></div><div class="_li"><div id="pagelet_blue
  51. bar" data-referrer="pagelet_bluebar"><div id="blueBarHolder"><div id="blueBar"><
  52. div><div class="loggedout_menubar_container"><div class="clearfix loggedout_menu
  53. bar"><a class="lfloat" href="/" title="Ir para a p&' in robots.txt returned a no
  54. n-forbidden or redirect HTTP code (400)
  55. + "robots.txt" contains 1 entry which should be manually viewed.
  56. + OSVDB-5737: WebLogic may reveal its internal IP or hostname in the Location he
  57. ader. The value is "http://www.facebook.com/mobipride.".
  58. + Multiple index files found: default.asp, index.jhtml, index.php, index.htm, in
  59. dex.pl, default.htm, index.aspx, default.aspx, index.asp, index.do, index.php3,
  60. index.cfm, index.cgi, index.html, index.shtml
  61. + /mobipride/kboard/: KBoard Forum 0.3.0 and prior have a security problem in fo
  62. rum_edit_post.php, forum_post.php and forum_reply.php
  63. + /mobipride/lists/admin/: PHPList pre 2.6.4 contains a number of vulnerabilitie
  64. s including remote administrative access, harvesting user info and more. Default
  65. login to admin interface is admin/phplist
  66. + /mobipride/splashAdmin.php: Cobalt Qube 3 admin is running. This may have mult
  67. iple security problems as described by www.scan-associates.net. These could not
  68. be tested remotely.
  69. + /mobipride/ssdefs/: Siteseed pre 1.4.2 has 'major' security problems.
  70. + /mobipride/sshome/: Siteseed pre 1.4.2 has 'major' security problems.
  71. + /mobipride/tiki/: Tiki 1.7.2 and previous allowed restricted Wiki pages to be
  72. viewed via a 'URL trick'. Default login/pass could be admin/admin
  73. + /mobipride/tiki/tiki-install.php: Tiki 1.7.2 and previous allowed restricted W
  74. iki pages to be viewed via a 'URL trick'. Default login/pass could be admin/admi
  75. n
  76. + /mobipride/scripts/samples/details.idc: See RFP 9901; www.wiretrip.net
  77. + OSVDB-396: /mobipride/_vti_bin/shtml.exe: Attackers may be able to crash Front
  78. Page by requesting a DOS device, like shtml.exe/aux.htm -- a DoS was not attempt
  79. ed.
  80. + OSVDB-637: /mobipride/~root/: Allowed to browse root's home directory.
  81. + /mobipride/cgi-bin/wrap: comes with IRIX 6.2; allows to view directories
  82. + /mobipride/forums//admin/config.php: PHP Config file may contain database IDs
  83. and passwords.
  84. + /mobipride/forums//adm/config.php: PHP Config file may contain database IDs an
  85. d passwords.
  86. + /mobipride/forums//administrator/config.php: PHP Config file may contain datab
  87. ase IDs and passwords.
  88. + /mobipride/forums/config.php: PHP Config file may contain database IDs and pas
  89. swords.
  90. + /mobipride/guestbook/guestbookdat: PHP-Gastebuch 1.60 Beta reveals sensitive i
  91. nformation about its configuration.
  92. + /mobipride/guestbook/pwd: PHP-Gastebuch 1.60 Beta reveals the md5 hash of the
  93. admin password.
  94. + /mobipride/help/: Help directory should not be accessible
  95. + OSVDB-2411: /mobipride/hola/admin/cms/htmltags.php?datei=./sec/data.php: hola-
  96. cms-1.2.9-10 may reveal the administrator ID and password.
  97. + OSVDB-8103: /mobipride/global.inc: PHP-Survey's include file should not be ava
  98. ilable via the web. Configure the web server to ignore .inc files or change this
  99. to global.inc.php
  100. + OSVDB-59620: /mobipride/inc/common.load.php: Bookmark4U v1.8.3 include files a
  101. re not protected and may contain remote source injection by using the 'prefix' v
  102. ariable.
  103. + OSVDB-59619: /mobipride/inc/config.php: Bookmark4U v1.8.3 include files are no
  104. t protected and may contain remote source injection by using the 'prefix' variab
  105. le.
  106. + OSVDB-59618: /mobipride/inc/dbase.php: Bookmark4U v1.8.3 include files are not
  107. protected and may contain remote source injection by using the 'prefix' variabl
  108. e.
  109. + OSVDB-2703: /mobipride/geeklog/users.php: Geeklog prior to 1.3.8-1sr2 contains
  110. a SQL injection vulnerability that lets a remote attacker reset admin password.
  111.  
  112. + OSVDB-8204: /mobipride/gb/index.php?login=true: gBook may allow admin login by
  113. setting the value 'login' equal to 'true'.
  114. + /mobipride/guestbook/admin.php: Guestbook admin page available without authent
  115. ication.
  116. + /mobipride/getaccess: This may be an indication that the server is running get
  117. Access for SSO
  118. + /mobipride/cfdocs/expeval/openfile.cfm: Can use to expose the system/server pa
  119. th.
  120. + /mobipride/tsweb/: Microsoft TSAC found. http://www.dslwebserver.com/main/fr_i
  121. ndex.html?/main/sbs-Terminal-Services-Advanced-Client-Configuration.html
  122. + /mobipride/vgn/performance/TMT: Vignette CMS admin/maintenance script availabl
  123. e.
  124. + /mobipride/vgn/performance/TMT/Report: Vignette CMS admin/maintenance script a
  125. vailable.
  126. + /mobipride/vgn/performance/TMT/Report/XML: Vignette CMS admin/maintenance scri
  127. pt available.
  128. + /mobipride/vgn/performance/TMT/reset: Vignette CMS admin/maintenance script av
  129. ailable.
  130. + /mobipride/vgn/ppstats: Vignette CMS admin/maintenance script available.
  131. + /mobipride/vgn/previewer: Vignette CMS admin/maintenance script available.
  132. + /mobipride/vgn/record/previewer: Vignette CMS admin/maintenance script availab
  133. le.
  134. + /mobipride/vgn/stylepreviewer: Vignette CMS admin/maintenance script available
  135. .
  136. + /mobipride/vgn/vr/Deleting: Vignette CMS admin/maintenance script available.
  137. + /mobipride/vgn/vr/Editing: Vignette CMS admin/maintenance script available.
  138. + /mobipride/vgn/vr/Saving: Vignette CMS admin/maintenance script available.
  139. + /mobipride/vgn/vr/Select: Vignette CMS admin/maintenance script available.
  140. + /mobipride/scripts/iisadmin/bdir.htr: This default script shows host info, may
  141. allow file browsing and buffer a overrun in the Chunked Encoding data transfer
  142. mechanism, request /scripts/iisadmin/bdir.htr??c:\<dirs> . http://www.microsoft.
  143. com/technet/security/bulletin/MS02-028.asp. http://www.cert.org/advisories/CA-20
  144. 02-09.html.
  145. + /mobipride/scripts/iisadmin/ism.dll: Allows you to mount a brute force attack
  146. on passwords
  147. + /mobipride/scripts/tools/ctss.idc: This CGI allows remote users to view and mo
  148. dify SQL DB contents, server paths, docroot and more.
  149. + /mobipride/bigconf.cgi: BigIP Configuration CGI
  150. + /mobipride/blah_badfile.shtml: Allaire ColdFusion allows JSP source viewed thr
  151. ough a vulnerable SSI call.
  152. + OSVDB-4910: /mobipride/vgn/style: Vignette server may reveal system informatio
  153. n through this file.
  154. + OSVDB-17653: /mobipride/SiteServer/Admin/commerce/foundation/domain.asp: Displ
  155. ays known domains of which that server is involved.
  156. + OSVDB-17654: /mobipride/SiteServer/Admin/commerce/foundation/driver.asp: Displ
  157. ays a list of installed ODBC drivers.
  158. + OSVDB-17655: /mobipride/SiteServer/Admin/commerce/foundation/DSN.asp: Displays
  159. all DSNs configured for selected ODBC drivers.
  160. + OSVDB-17652: /mobipride/SiteServer/admin/findvserver.asp: Gives a list of inst
  161. alled Site Server components.
  162. + /mobipride/SiteServer/Admin/knowledge/dsmgr/default.asp: Used to view current
  163. search catalog configurations
  164. + /mobipride/basilix/mbox-list.php3: BasiliX webmail application prior to 1.1.1
  165. contains a XSS issue in 'message list' function/page
  166. + /mobipride/basilix/message-read.php3: BasiliX webmail application prior to 1.1
  167. .1 contains a XSS issue in 'read message' function/page
  168. + /mobipride/clusterframe.jsp: Macromedia JRun 4 build 61650 remote administrati
  169. on interface is vulnerable to several XSS attacks.
  170. + /mobipride/IlohaMail/blank.html: IlohaMail 0.8.10 contains a XSS vulnerability
  171. . Previous versions contain other non-descript vulnerabilities.
  172. + /mobipride/bb-dnbd/faxsurvey: This may allow arbitrary command execution.
  173. + /mobipride/cartcart.cgi: If this is Dansie Shopping Cart 3.0.8 or earlier, it
  174. contains a backdoor to allow attackers to execute arbitrary commands.
  175. + OSVDB-6591: /mobipride/scripts/Carello/Carello.dll: Carello 1.3 may allow comm
  176. ands to be executed on the server by replacing hidden form elements. This could
  177. not be tested by Nikto.
  178. + /mobipride/scripts/tools/dsnform.exe: Allows creation of ODBC Data Source
  179. + /mobipride/scripts/tools/dsnform: Allows creation of ODBC Data Source
  180. + OSVDB-17656: /mobipride/SiteServer/Admin/knowledge/dsmgr/users/GroupManager.as
  181. p: Used to create, modify, and potentially delete LDAP users and groups.
  182. + OSVDB-17657: /mobipride/SiteServer/Admin/knowledge/dsmgr/users/UserManager.asp
  183. : Used to create, modify, and potentially delete LDAP users and groups.
  184. + /mobipride/prd.i/pgen/: Has MS Merchant Server 1.0
  185. + /mobipride/readme.eml: Remote server may be infected with the Nimda virus.
  186. + /mobipride/scripts/httpodbc.dll: Possible IIS backdoor found.
  187. + /mobipride/scripts/proxy/w3proxy.dll: MSProxy v1.0 installed
  188. + /mobipride/SiteServer/admin/: Site Server components admin. Default account ma
  189. y be 'LDAP_Anonymous', pass is 'LdapPassword_1'. see http://www.wiretrip.net/rfp
  190. /p/doc.asp/i1/d69.htm
  191. + /mobipride/siteseed/: Siteseed pre 1.4.2 has 'major' security problems.
  192. + /mobipride/pccsmysqladm/incs/dbconnect.inc: This file should not be accessible
  193. , as it contains database connectivity information. Upgrade to version 1.2.5 or
  194. higher.
  195. + /mobipride/iisadmin/: Access to /iisadmin should be restricted to localhost or
  196. allowed hosts only.
  197. + /mobipride/PDG_Cart/oder.log: Shopping cart software log
  198. + /mobipride/ows/restricted%2eshow: OWS may allow restricted files to be viewed
  199. by replacing a character with its encoded equivalent.
  200. + /mobipride/WEB-INF./web.xml: Multiple implementations of j2ee servlet containe
  201. rs allow files to be retrieved from WEB-INF by appending a '.' to the directory
  202. name. Products include Sybase EA Service, Oracle Containers, Orion, JRun, HPAS,
  203. Pramati and others. See http://www.westpoint.l
  204. + /mobipride/view_source.jsp: Resin 2.1.2 view_source.jsp allows any file on the
  205. system to be viewed by using \..\ directory traversal. This script may be vulne
  206. rable.
  207. + /mobipride/w-agora/: w-agora pre 4.1.4 may allow a remote user to execute arbi
  208. trary PHP scripts via URL includes in include/*.php and user/*.php files. Defaul
  209. t account is 'admin' but password set during install.
  210. + OSVDB-42680: /mobipride/vider.php3: MySimpleNews may allow deleting of news it
  211. ems without authentication.
  212. + OSVDB-6181: /mobipride/officescan/cgi/cgiChkMasterPwd.exe: Trend Micro Offices
  213. can allows you to skip the login page and access some CGI programs directly.
  214. + /mobipride/pbserver/pbserver.dll: This may contain a buffer overflow. http://w
  215. ww.microsoft.com/technet/security/bulletin/http://www.microsoft.com/technet/secu
  216. rity/bulletin/ms00-094.asp.asp
  217. + /mobipride/administrator/gallery/uploadimage.php: Mambo PHP Portal/Server 4.0.
  218. 12 BETA and below may allow upload of any file type simply putting '.jpg' before
  219. the real file extension.
  220. + /mobipride/pafiledb/includes/team/file.php: paFileDB 3.1 and below may allow f
  221. ile upload without authentication.
  222. + /mobipride/phpEventCalendar/file_upload.php: phpEventCalendar 1.1 and prior ar
  223. e vulnerable to file upload bug.
  224. + /mobipride/servlet/com.unify.servletexec.UploadServlet: This servlet allows at
  225. tackers to upload files to the server.
  226. + /mobipride/scripts/cpshost.dll: Posting acceptor possibly allows you to upload
  227. files
  228. + /mobipride/upload.asp: An ASP page that allows attackers to upload files to se
  229. rver
  230. + /mobipride/uploadn.asp: An ASP page that allows attackers to upload files to s
  231. erver
  232. + /mobipride/uploadx.asp: An ASP page that allows attackers to upload files to s
  233. erver
  234. + /mobipride/wa.exe: An ASP page that allows attackers to upload files to server
  235. + /scripts/bannereditor.cgi: This CGI may allow attackers to read any file on th
  236. e system.
  237. + /scripts/architext_query.pl: Versions older than 1.1 of Excite for Web Servers
  238. allow attackers to execute arbitrary commands.
  239. + /scripts/bizdb1-search.cgi: This CGI may allow attackers to execute commands r
  240. emotely. See http://www.hack.co.za/daem0n/cgi/cgi/bizdb.htm
  241. + /scripts/blog/: A blog was found. May contain security problems in CGIs, weak
  242. passwords, and more.
  243. + /scripts/blog/mt-load.cgi: Movable Type weblog installation CGI found. May be
  244. able to reconfigure or reload.
  245. + /scripts/iisadmin/bdir.htr: This default script shows host info, may allow fil
  246. e browsing and buffer a overrun in the Chunked Encoding data transfer mechanism,
  247. request /scripts/iisadmin/bdir.htr??c:\<dirs> . http://www.microsoft.com/techne
  248. t/security/bulletin/MS02-028.asp. http://www.cert.org/advisories/CA-2002-09.html
  249. .
  250. + /scripts/iisadmin/ism.dll: Allows you to mount a brute force attack on passwor
  251. ds
  252. + /scripts/tools/ctss.idc: This CGI allows remote users to view and modify SQL D
  253. B contents, server paths, docroot and more.
  254. + OSVDB-2878: /scripts/moin.cgi?test: MoinMoin 1.1 and prior contain at least tw
  255. o XSS vulnerabilities. Version 1.0 and prior also contains a XSLT related vulner
  256. ability
  257. + OSVDB-6591: /scripts/Carello/Carello.dll: Carello 1.3 may allow commands to be
  258. executed on the server by replacing hidden form elements. This could not be tes
  259. ted by Nikto.
  260. + /scripts/tools/dsnform.exe: Allows creation of ODBC Data Source
  261. + /scripts/tools/dsnform: Allows creation of ODBC Data Source
  262. + /scripts/httpodbc.dll: Possible IIS backdoor found.
  263. + /scripts/proxy/w3proxy.dll: MSProxy v1.0 installed
  264. + /scripts/astrocam.cgi: Astrocam 1.4.1 contained buffer overflow http://www.sec
  265. urityfocus.com/bid/4684. Prior to 2.1.3 contained unspecified security bugs
  266. + /scripts/badmin.cgi: BannerWheel v1.0 is vulnerable to a local buffer overflow
  267. . If this is version 1.0 it should be upgraded.
  268. + OSVDB-2017: /scripts/boozt/admin/index.cgi?section=5&input=1: Boozt CGI may ha
  269. ve a buffer overflow. Upgrade to a version newer than 0.9.8alpha.
  270. + /scripts/ezadmin.cgi: Some versions of this CGI are vulnerable to a buffer ove
  271. rflow.
  272. + /scripts/ezboard.cgi: Some versions of this CGI are vulnerable to a buffer ove
  273. rflow.
  274. + /scripts/ezman.cgi: Some versions of this CGI are vulnerable to a buffer overf
  275. low.
  276. + OSVDB-11740: /scripts/foxweb.dll: Foxweb 2.5 and below is vulnerable to a buff
  277. er overflow (not tested or confirmed). Verify Foxweb is the latest available ver
  278. sion.
  279. + OSVDB-11741: /scripts/foxweb.exe: Foxweb 2.5 and below is vulnerable to a buff
  280. er overflow (not tested or confirmed). Verify Foxweb is the latest available ver
  281. sion.
  282. + /scripts/mgrqcgi: This CGI from Magic Enterprise 8.30-5 and earlier is vulnera
  283. ble to multiple buffer overflows. Upgrade to 9.x.
  284. + /scripts/wconsole.dll: It may be possible to overflow this dll with 1024 bytes
  285. of data.
  286. + /servlet/com.unify.servletexec.UploadServlet: This servlet allows attackers to
  287. upload files to the server.
  288. + /scripts/uploader.exe: This CGI allows attackers to upload files to the server
  289. and then execute them.
  290. + /scripts/cpshost.dll: Posting acceptor possibly allows you to upload files
  291. + /scripts/fpsrvadm.exe: Potentially vulnerable CGI program.
  292. + /scripts/.cobalt: May allow remote admin of CGI scripts.
  293. + OSVDB-52975: /guestbook/admin/o12guest.mdb: Ocean12 ASP Guestbook Manager allo
  294. ws download of SQL database which contains admin password.
  295. + OSVDB-15971: /shoppingdirectory/midicart.mdb: MIDICART database is available f
  296. or browsing. This should not be allowed via the web server.
  297. + OSVDB-4398: /database/db2000.mdb: Max Web Portal database is available remotel
  298. y. It should be moved from the default location to a directory outside the web r
  299. oot.
  300. + OSVDB-319: /scripts/mailit.pl: Sambar may allow anonymous email to be sent fro
  301. m any host via this CGI.
  302. + /scripts/.access: Contains authorization information
  303. + OSVDB-11093: /scripts/%2e%2e/abyss.conf: The Abyss configuration file was succ
  304. essfully retrieved. Upgrade with the latest version/patches for 1.0 from http://
  305. www.aprelium.com/
  306. + /servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter: Allaire ColdFusion allow
  307. s JSP source viewed through a vulnerable SSI call.
  308. + /webcart/carts/: This may allow attackers to read credit card data. Reconfigur
  309. e to make this dir not accessible via the web.
  310. + /webcart/config/: This may allow attackers to read credit card data. Reconfigu
  311. re to make this dir not accessible via the web.
  312. + /webcart/config/clients.txt: This may allow attackers to read credit card data
  313. . Reconfigure to make this file not accessible via the web.
  314. + /webcart/orders/: This may allow attackers to read credit card data. Reconfigu
  315. re to make this dir not accessible via the web.
  316. + /webcart/orders/import.txt: This may allow attackers to read credit card data.
  317. Reconfigure to make this file not accessible via the web.
  318. + OSVDB-11871: /scripts/MsmMask.exe: MondoSearch 4.4 may allow source code viewi
  319. ng by requesting MsmMask.exe?mask=/filename.asp where 'filename.asp' is a real A
  320. SP file.
  321. + /webmail/blank.html: IlohaMail 0.8.10 contains an XSS vulnerability. Previous
  322. versions contain other non-descript vulnerabilities.
  323. + /scripts/addbanner.cgi: This CGI may allow attackers to read any file on the s
  324. ystem.
  325. + /scripts/shtml.dll: This may allow attackers to retrieve document source.
  326. + /scripts/aglimpse.cgi: This CGI may allow attackers to execute remote commands
  327. .
  328. + /scripts/aglimpse: This CGI may allow attackers to execute remote commands.
  329. + /scripts/architext_query.cgi: Versions older than 1.1 of Excite for Web Server
  330. s allow attackers to execute arbitrary commands.
  331. + OSVDB-6196: /servlet/SchedulerTransfer: PeopleSoft SchedulerTransfer servlet f
  332. ound, which may allow remote command execution. See http://www.iss.net/issEn/del
  333. ivery/xforce/alertdetail.jsp?oid=21999
  334. + /servlet/sunexamples.BBoardServlet: This default servlet lets attackers execut
  335. e arbitrary commands.
  336. + OSVDB-6196: /servlets/SchedulerTransfer: PeopleSoft SchedulerTransfer servlet
  337. found, which may allow remote command execution. See http://www.iss.net/issEn/de
  338. livery/xforce/alertdetail.jsp?oid=21999
  339. + /scripts/cmd.exe?/c+dir: cmd.exe can execute arbitrary commands
  340. + /scripts/cmd1.exe?/c+dir: cmd1.exe can execute arbitrary commands
  341. + /scripts/hello.bat?&dir+c:\\: This batch file may allow attackers to execute r
  342. emote commands.
  343. + /scripts/post32.exe|dir%20c:\\: post32 can execute arbitrary commands
  344. + /webmail/: Web based mail package installed.
  345. + /scripts/archie: Gateway to the unix command, may be able to submit extra comm
  346. ands
  347. + /scripts/calendar.pl: Gateway to the unix command, may be able to submit extra
  348. commands
  349. + /scripts/calendar: Gateway to the unix command, may be able to submit extra co
  350. mmands
  351. + /scripts/date: Gateway to the unix command, may be able to submit extra comman
  352. ds
  353. + /scripts/fortune: Gateway to the unix command, may be able to submit extra com
  354. mands
  355. + /scripts/redirect: Redirects via URL from form
  356. + /scripts/uptime: Gateway to the unix command, may be able to submit extra comm
  357. ands
  358. + /scripts/wais.pl: Gateway to the unix command, may be able to submit extra com
  359. mands
  360. + OSVDB-8450: /phpMyAdmin/db_details_importdocsql.php?submit_show=true&do=import
  361. &docpath=../: phpMyAdmin allows directory listings remotely. Upgrade to version
  362. 2.5.3 or higher. http://www.securityfocus.com/bid/7963.
  363. + OSVDB-8450: /phpmyadmin/db_details_importdocsql.php?submit_show=true&do=import
  364. &docpath=../: phpMyAdmin allows directory listings remotely. Upgrade to version
  365. 2.5.3 or higher. http://www.securityfocus.com/bid/7963.
  366. + /scripts/mail: Simple Perl mailing script to send form data to a pre-configure
  367. d email address
  368. + /scripts/nph-error.pl: Gives more information in error messages
  369. + /scripts/post-query: Echoes back result of your POST
  370. + /scripts/query: Echoes back result of your GET
  371. + /scripts/test-cgi.tcl: May echo environment variables or give directory listin
  372. gs
  373. + /scripts/test-env: May echo environment variables or give directory listings
  374. + /local/httpd$map.conf: WASD reveals the http configuration file. Upgrade to a
  375. later version and secure according to the documents on the WASD web site.
  376. + /scripts/cgitest.exe: This CGI allows remote users to download other CGI sourc
  377. e code. May have a buffer overflow in the User-Agent header.
  378. + OSVDB-6666: /scripts/hpnst.exe?c=p+i=SrvSystemInfo.html: HP Instant TopTools m
  379. ay be vulnerable to a DoS by requesting hpnst.exe?c=p+i=hpnst.exe multiple times
  380. .
  381. + /contents/extensions/asp/1: The IIS system may be vulnerable to a DOS, see htt
  382. p://www.microsoft.com/technet/security/bulletin/MS02-018.asp for details.
  383. + OSVDB-55370: /scripts/Pbcgi.exe: Sambar may be vulnerable to a DOS when a long
  384. string is passed to Pbcgi.exe (not attempted). Default CGI should be removed fr
  385. om web servers.
  386. + OSVDB-55369: /scripts/testcgi.exe: Sambar may be vulnerable to a DOS when a lo
  387. ng string is passed to testcgi.exe (not attempted). Default CGI should be remove
  388. d from web servers.
  389. + /scripts/snorkerz.bat: Arguments passed to DOS CGI without checking
  390. + /scripts/snorkerz.cmd: Arguments passed to DOS CGI without checking
  391. + /scripts/webfind.exe?keywords=01234567890123456789: May be vulnerable to a buf
  392. fer overflow (request 2000 bytes of data). Upgrade to WebSitePro 2.5 or greater
  393. + OSVDB-724: /scripts/ans.pl?p=../../../../../usr/bin/id|&blah: Avenger's News S
  394. ystem allows commands to be issued remotely.
  395. + OSVDB-724: /scripts/ans/ans.pl?p=../../../../../usr/bin/id|&blah: Avenger's Ne
  396. ws System allows commands to be issued remotely.
  397. + OSVDB-4969: /scripts/ezshopper/search.cgi?user_id=id&database=dbase1.exm&templ
  398. ate=../../../../../../../etc/passwd&distinct=1: EZShopper search CGI allows arbi
  399. trary files to be read
  400. + OSVDB-2511: /scripts/sbcgi/sitebuilder.cgi: SITEBUILDER v1.4 may allow retriev
  401. al of any file. With a valid username and password, request: /<CGIDIR>/sbcgi/sit
  402. ebuilder.cgi?username=<user>&password=<password>&selectedpage=../../../../../../
  403. ../../../../etc/passwd
  404. + OSVDB-7715: /scripts/talkback.cgi?article=../../../../../../../../etc/passwd%0
  405. 0&action=view&matchview=1: Talkback CGI displays arbitrary files
  406. + /scripts/classifieds/index.cgi: My Classifieds pre 2.12 is vulnerable to SQL i
  407. njection attacks.
  408. + /scripts/myguestbook.cgi?action=view: myGuestBook 1.0 may be vulnerable to Cro
  409. ss Site Scripting (XSS) in posted contents. Upgrade to the latest version from h
  410. ttp://www.levcgi.com/. http://www.cert.org/advisories/CA-2000-02.html.
  411. + OSVDB-21366: /scripts/diagnose.cgi: This COWS (CGI Online Worldweb Shopping) s
  412. cript may give system information to attackers, and may be vulnerable to Cross S
  413. ite Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html.
  414. + /catinfo?<u><b>TESTING: The Interscan Viruswall catinfo script is vulnerable t
  415. o Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html.
  416. + OSVDB-2754: /guestbook/?number=5&lng=%3Cscript%3Ealert(document.domain);%3C/sc
  417. ript%3E: MPM Guestbook 1.2 and previous are vulnreable to XSS attacks.
  418. + /anthill/login.php: Anthill bug tracking system may be installed. Versions low
  419. er than 0.1.6.1 allow XSS/HTML injection and may allow users to bypass login req
  420. uirements. http://anthill.vmlinuz.ca/ and http://www.cert.org/advisories/CA-2000
  421. -02.html
  422. + OSVDB-19772: /scripts/title.cgi: HNS's title.cgi is vulnerable to Cross Site S
  423. cripting (XSS http://www.cert.org/advisories/CA-2000-02.html) in version 2.00 an
  424. d earlier, and Lite 0.8 and earlier.
  425. + OSVDB-21365: /scripts/compatible.cgi: This COWS (CGI Online Worldweb Shopping)
  426. script may give system information to attackers, and may be vulnerable to Cross
  427. Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html.
  428. + /scripts/probecontrol.cgi?command=enable&userNikto=cancer&password=killer: Thi
  429. s might be interesting... has been seen in web logs from a scanner.
  430. + /scripts/probecontrol.cgi?command=enable&username=cancer&password=killer: This
  431. might be interesting... has been seen in web logs from a scanner.
  432. + /scripts/retrieve_password.pl: May not be vulnerable, but see http://www.dcscr
  433. ipts.com/bugtrac/DCForumID7/3.html for information.
  434. + /scripts/wwwadmin.pl: Administration CGI?
  435. + /scripts/webmap.cgi: nmap front end... could be fun
  436. + /ariadne/: Ariadne pre 2.1.2 has several vulnerabilities. The default login/pa
  437. ss to the admin page is admin/muze.
  438. + /scripts/admin/admin.cgi: May be ImageFolio Pro administration CGI. Default lo
  439. gin is Admin/ImageFolio.
  440. + /scripts/admin/setup.cgi: May be ImageFolio Pro setup CGI. Default login is Ad
  441. min/ImageFolio.
  442. + /scripts/mt-static/mt-load.cgi: Movable Type weblog installation CGI found. Ma
  443. y be able to reconfigure or reload.
  444. + /scripts/mt/mt-load.cgi: Movable Type weblog installation CGI found. May be ab
  445. le to reconfigure or reload.
  446. + /scripts/dbman/db.cgi?db=no-db: This CGI allows remote attackers to view syste
  447. m information.
  448. + OSVDB-17111: /scripts/dcshop/auth_data/auth_user_file.txt: The DCShop installa
  449. tion allows credit card numbers to be viewed remotely. See dcscripts.com for fix
  450. information.
  451. + OSVDB-17111: /scripts/DCShop/auth_data/auth_user_file.txt: The DCShop installa
  452. tion allows credit card numbers to be viewed remotely. See dcscripts.com for fix
  453. information.
  454. + OSVDB-596: /scripts/dcshop/orders/orders.txt: The DCShop installation allows c
  455. redit card numbers to be viewed remotely. See dcscripts.com for fix information.
  456.  
  457. + OSVDB-596: /scripts/DCShop/orders/orders.txt: The DCShop installation allows c
  458. redit card numbers to be viewed remotely. See dcscripts.com for fix information.
  459.  
  460. + /scripts/dumpenv.pl: This CGI gives a lot of information to attackers.
  461. + /scripts/mkilog.exe: This CGI can give an attacker a lot of information.
  462. + /scripts/mkplog.exe: This CGI can give an attacker a lot of information.
  463. + OSVDB-596: /scripts/orders/orders.txt: The DCShop installation allows credit c
  464. ard numbers to be viewed remotely. See dcscripts.com for fix information.
  465. + /scripts/processit.pl: This CGI returns environment variables, giving attacker
  466. s valuable information.
  467. + /scripts/rpm_query: This CGI allows anyone to see the installed RPMs
  468. + OSVDB-17111: /scripts/shop/auth_data/auth_user_file.txt: The DCShop installati
  469. on allows credit card numbers to be viewed remotely. See dcscripts.com for fix i
  470. nformation.
  471. + OSVDB-596: /scripts/shop/orders/orders.txt: The DCShop installation allows cre
  472. dit card numbers to be viewed remotely. See dcscripts.com for fix information.
  473. + /scripts/ws_ftp.ini: Can contain saved passwords for ftp sites
  474. + /scripts/WS_FTP.ini: Can contain saved passwords for ftp sites
  475. + /scripts/view-source?view-source: This allows remote users to view source code
  476. .
  477. + OSVDB-13978: /scripts/ibill.pm: iBill.pm is installed. This may allow brute fo
  478. rcing of passwords.
  479. + OSVDB-9332: /scripts/scoadminreg.cgi: This script (part of UnixWare WebTop) ma
  480. y have a local root exploit. It is also an system admin script and should be pro
  481. tected via the web.
  482. + OSVDB-4663: /scripts/SGB_DIR/superguestconfig: Super GuestBook 1.0 from lasour
  483. ce.r2.ru stores the admin password in a plain text file.
  484. + /scripts/icat: Multiple versions of icat allow attackers to read arbitrary fil
  485. es. Make sure the latest version is running.
  486. + /scripts/nph-showlogs.pl?files=../../&filter=.*&submit=Go&linecnt=500&refresh=
  487. 0: nCUBE Server Manager 1.0 nph-showlogs.pl directory traversal bug
  488. + OSVDB-6192: /scripts/update.dpgs: Duma Photo Gallery System may allow remote u
  489. sers to write to any file on the system. See http://b0iler.eyeonsecurity.net for
  490. details. This could not be remotely tested.
  491. + /scripts/view-source: This may allow remote arbitrary file retrieval.
  492. + /scripts/wrap: This CGI lets users read any file with 755 perms. It should not
  493. be in the CGI directory.
  494. + /scripts/cgiwrap: Some versions of cgiwrap allow anyone to execute commands re
  495. motely.
  496. + /scripts/Count.cgi: This may allow attackers to execute arbitrary commands on
  497. the server
  498. + /scripts/echo.bat: This CGI may allow attackers to execute remote commands.
  499. + OSVDB-4571: /scripts/ImageFolio/admin/admin.cgi: ImageFolio (default accout Ad
  500. min/ImageFolio) may allow files to be deleted via URLs like: ?cgi=remove.pl&uid=
  501. 111.111.111.111&rmstep=2&category=../../../../../../../../../../../etc/
  502. + /scripts/info2www: This CGI allows attackers to execute commands.
  503. + /scripts/infosrch.cgi: This CGI allows attackers to execute commands.
  504. + /scripts/listrec.pl: This CGI allows attackers to execute commands on the host
  505. .
  506. + /scripts/mailnews.cgi: Some versions allow attacker to execute commands as htt
  507. p daemon. Upgrade or remove.
  508. + /scripts/mmstdod.cgi: May allow attacker to execute remote commands. Upgrade t
  509. o version 3.0.26 or higher.
  510. + /scripts/pagelog.cgi: Some versions of this allow you to create system files.
  511. Request 'pagelog.cgi?name=../../../../.././tmp/filename' to try.
  512. + /scripts/perl?-v: Perl is installed in the CGI directory. This essentially giv
  513. es attackers a system shell. Remove Perl from the CGI dir.
  514. + /scripts/perl.exe?-v: Perl is installed in the CGI directory. This essentially
  515. gives attackers a system shell. Remove perl.exe from the CGI dir.
  516. + /scripts/perl.exe: Perl is installed in the CGI directory. This essentially gi
  517. ves attackers a system shell. Remove Perl from the CGI dir.
  518. + /scripts/perl: Perl is installed in the CGI directory. This essentially gives
  519. attackers a system shell. Remove Perl from the CGI dir.
  520. + /scripts/plusmail: This CGI may allow attackers to execute commands remotely.
  521. + /scripts/smartsearch.cgi?keywords=|/bin/cat%20/etc/passwd|: To check for remot
  522. e execution vulnerability use ?keywords=|/bin/ls| or your favorite command
  523. + /scripts/smartsearch/smartsearch.cgi?keywords=|/bin/cat%20/etc/passwd|: To che
  524. ck for remote execution vulnerability use ?keywords=|/bin/ls| or your favorite c
  525. ommand
  526. + OSVDB-54034: /scripts/spin_client.cgi?aaaaaaaa: This CGI may be vulnerable to
  527. remote execution by sending 8000 x 'a' characters (check to see if you get a 500
  528. error message)
  529. + OSVDB-10598: /scripts/sscd_suncourier.pl: Sunsolve CD script may allow users t
  530. o execute arbitrary commands. The script was confirmed to exist, but the test wa
  531. s not done.
  532. + OSVDB-13981: /scripts/viralator.cgi: May be vulnerable to command injection, u
  533. pgrade to 0.9pre2 or newer. This flaw could not be confirmed.
  534.  
  535.  
  536. + Server: No banner retrieved
  537. + Cookie reg_ext_ref created without the httponly flag
  538. + Cookie reg_fb_gate created without the httponly flag
  539. + Cookie reg_fb_ref created without the httponly flag
  540. + Uncommon header 'x-fb-debug' found, with contents: NDGJxkwgcnrAOYSA/785kjLeEuu
  541. ddv/GterA6Gc4x04=
  542. + Uncommon header 'x-frame-options' found, with contents: DENY
  543. + Uncommon header 'x-xss-protection' found, with contents: 0
  544. + Uncommon header 'x-content-type-options' found, with contents: nosniff
  545. + No CGI Directories found (use '-C all' to force check all possible dirs)
  546. + lines
  547. + /crossdomain.xml contains 0 line which should be manually viewed for improper
  548. domains or wildcards.
  549. + "robots.txt" contains 1 entry which should be manually viewed.
  550. + Multiple index files found: default.asp, index.jhtml, index.php, index.htm, in
  551. dex.pl, default.htm, index.aspx, default.aspx, index.asp, index.do, index.php3,
  552. index.cfm, index.cgi, index.html, index.shtml
  553. + Server banner has changed from '' to 'nginx/1.3.7' which may suggest a WAF, lo
  554. ad balancer or proxy is in place
  555. + /g_dircom/kboard/: KBoard Forum 0.3.0 and prior have a security problem in for
  556. um_edit_post.php, forum_post.php and forum_reply.php
  557. + /g_dircom/lists/admin/: PHPList pre 2.6.4 contains a number of vulnerabilities
  558. including remote administrative access, harvesting user info and more. Default
  559. login to admin interface is admin/phplist
  560. + /g_dircom/splashAdmin.php: Cobalt Qube 3 admin is running. This may have multi
  561. ple security problems as described by www.scan-associates.net. These could not b
  562. e tested remotely.
  563. + /g_dircom/ssdefs/: Siteseed pre 1.4.2 has 'major' security problems.
  564. + /g_dircom/sshome/: Siteseed pre 1.4.2 has 'major' security problems.
  565. + /g_dircom/tiki/: Tiki 1.7.2 and previous allowed restricted Wiki pages to be v
  566. iewed via a 'URL trick'. Default login/pass could be admin/admin
  567. + /g_dircom/tiki/tiki-install.php: Tiki 1.7.2 and previous allowed restricted Wi
  568. ki pages to be viewed via a 'URL trick'. Default login/pass could be admin/admin
  569.  
  570. + /g_dircom/scripts/samples/details.idc: See RFP 9901; www.wiretrip.net
  571. + OSVDB-396: /g_dircom/_vti_bin/shtml.exe: Attackers may be able to crash FrontP
  572. age by requesting a DOS device, like shtml.exe/aux.htm -- a DoS was not attempte
  573. d.
  574. + OSVDB-637: /g_dircom/~root/: Allowed to browse root's home directory.
  575. + /g_dircom/cgi-bin/wrap: comes with IRIX 6.2; allows to view directories
  576. + /g_dircom/forums//admin/config.php: PHP Config file may contain database IDs a
  577. nd passwords.
  578. + /g_dircom/forums//adm/config.php: PHP Config file may contain database IDs and
  579. passwords.
  580. + /g_dircom/forums//administrator/config.php: PHP Config file may contain databa
  581. se IDs and passwords.
  582. + /g_dircom/forums/config.php: PHP Config file may contain database IDs and pass
  583. words.
  584. + /g_dircom/guestbook/guestbookdat: PHP-Gastebuch 1.60 Beta reveals sensitive in
  585. formation about its configuration.
  586. + /g_dircom/guestbook/pwd: PHP-Gastebuch 1.60 Beta reveals the md5 hash of the a
  587. dmin password.
  588. + /g_dircom/help/: Help directory should not be accessible
  589. + OSVDB-2411: /g_dircom/hola/admin/cms/htmltags.php?datei=./sec/data.php: hola-c
  590. ms-1.2.9-10 may reveal the administrator ID and password.
  591. + OSVDB-8103: /g_dircom/global.inc: PHP-Survey's include file should not be avai
  592. lable via the web. Configure the web server to ignore .inc files or change this
  593. to global.inc.php
  594. + OSVDB-59620: /g_dircom/inc/common.load.php: Bookmark4U v1.8.3 include files ar
  595. e not protected and may contain remote source injection by using the 'prefix' va
  596. riable.
  597. + OSVDB-59619: /g_dircom/inc/config.php: Bookmark4U v1.8.3 include files are not
  598. protected and may contain remote source injection by using the 'prefix' variabl
  599. e.
  600. + OSVDB-59618: /g_dircom/inc/dbase.php: Bookmark4U v1.8.3 include files are not
  601. protected and may contain remote source injection by using the 'prefix' variable
  602. .
  603. + OSVDB-2703: /g_dircom/geeklog/users.php: Geeklog prior to 1.3.8-1sr2 contains
  604. a SQL injection vulnerability that lets a remote attacker reset admin password.
  605. + OSVDB-8204: /g_dircom/gb/index.php?login=true: gBook may allow admin login by
  606. setting the value 'login' equal to 'true'.
  607. + /g_dircom/guestbook/admin.php: Guestbook admin page available without authenti
  608. cation.
  609. + /g_dircom/getaccess: This may be an indication that the server is running getA
  610. ccess for SSO
  611. + /g_dircom/cfdocs/expeval/openfile.cfm: Can use to expose the system/server pat
  612. h.
  613. + /g_dircom/tsweb/: Microsoft TSAC found. http://www.dslwebserver.com/main/fr_in
  614. dex.html?/main/sbs-Terminal-Services-Advanced-Client-Configuration.html
  615. + /g_dircom/vgn/performance/TMT: Vignette CMS admin/maintenance script available
  616. .
  617. + /g_dircom/vgn/performance/TMT/Report: Vignette CMS admin/maintenance script av
  618. ailable.
  619. + /g_dircom/vgn/performance/TMT/Report/XML: Vignette CMS admin/maintenance scrip
  620. t available.
  621. + /g_dircom/vgn/performance/TMT/reset: Vignette CMS admin/maintenance script ava
  622. ilable.
  623. + /g_dircom/vgn/ppstats: Vignette CMS admin/maintenance script available.
  624. + /g_dircom/vgn/previewer: Vignette CMS admin/maintenance script available.
  625. + /g_dircom/vgn/record/previewer: Vignette CMS admin/maintenance script availabl
  626. e.
  627. + /g_dircom/vgn/stylepreviewer: Vignette CMS admin/maintenance script available.
  628.  
  629. + /g_dircom/vgn/vr/Deleting: Vignette CMS admin/maintenance script available.
  630. + /g_dircom/vgn/vr/Editing: Vignette CMS admin/maintenance script available.
  631. + /g_dircom/vgn/vr/Saving: Vignette CMS admin/maintenance script available.
  632. + /g_dircom/vgn/vr/Select: Vignette CMS admin/maintenance script available.
  633. + /g_dircom/scripts/iisadmin/bdir.htr: This default script shows host info, may
  634. allow file browsing and buffer a overrun in the Chunked Encoding data transfer m
  635. echanism, request /scripts/iisadmin/bdir.htr??c:\<dirs> . http://www.microsoft.c
  636. om/technet/security/bulletin/MS02-028.asp. http://www.cert.org/advisories/CA-200
  637. 2-09.html.
  638. + /g_dircom/scripts/iisadmin/ism.dll: Allows you to mount a brute force attack o
  639. n passwords
  640. + /g_dircom/scripts/tools/ctss.idc: This CGI allows remote users to view and mod
  641. ify SQL DB contents, server paths, docroot and more.
  642. + /g_dircom/bigconf.cgi: BigIP Configuration CGI
  643. + /g_dircom/blah_badfile.shtml: Allaire ColdFusion allows JSP source viewed thro
  644. ugh a vulnerable SSI call.
  645. + OSVDB-4910: /g_dircom/vgn/style: Vignette server may reveal system information
  646. through this file.
  647. + OSVDB-17653: /g_dircom/SiteServer/Admin/commerce/foundation/domain.asp: Displa
  648. ys known domains of which that server is involved.
  649. + OSVDB-17654: /g_dircom/SiteServer/Admin/commerce/foundation/driver.asp: Displa
  650. ys a list of installed ODBC drivers.
  651. + OSVDB-17655: /g_dircom/SiteServer/Admin/commerce/foundation/DSN.asp: Displays
  652. all DSNs configured for selected ODBC drivers.
  653. + OSVDB-17652: /g_dircom/SiteServer/admin/findvserver.asp: Gives a list of insta
  654. lled Site Server components.
  655. + /g_dircom/SiteServer/Admin/knowledge/dsmgr/default.asp: Used to view current s
  656. earch catalog configurations
  657. + /g_dircom/basilix/mbox-list.php3: BasiliX webmail application prior to 1.1.1 c
  658. ontains a XSS issue in 'message list' function/page
  659. + /g_dircom/basilix/message-read.php3: BasiliX webmail application prior to 1.1.
  660. 1 contains a XSS issue in 'read message' function/page
  661. + /g_dircom/clusterframe.jsp: Macromedia JRun 4 build 61650 remote administratio
  662. n interface is vulnerable to several XSS attacks.
  663. + /g_dircom/IlohaMail/blank.html: IlohaMail 0.8.10 contains a XSS vulnerability.
  664. Previous versions contain other non-descript vulnerabilities.
  665. + /g_dircom/bb-dnbd/faxsurvey: This may allow arbitrary command execution.
  666. + /g_dircom/cartcart.cgi: If this is Dansie Shopping Cart 3.0.8 or earlier, it c
  667. ontains a backdoor to allow attackers to execute arbitrary commands.
  668. + OSVDB-6591: /g_dircom/scripts/Carello/Carello.dll: Carello 1.3 may allow comma
  669. nds to be executed on the server by replacing hidden form elements. This could n
  670. ot be tested by Nikto.
  671. + /g_dircom/scripts/tools/dsnform.exe: Allows creation of ODBC Data Source
  672. + /g_dircom/scripts/tools/dsnform: Allows creation of ODBC Data Source
  673. + OSVDB-17656: /g_dircom/SiteServer/Admin/knowledge/dsmgr/users/GroupManager.asp
  674. : Used to create, modify, and potentially delete LDAP users and groups.
  675. + OSVDB-17657: /g_dircom/SiteServer/Admin/knowledge/dsmgr/users/UserManager.asp:
  676. Used to create, modify, and potentially delete LDAP users and groups.
  677. + /g_dircom/prd.i/pgen/: Has MS Merchant Server 1.0
  678. + /g_dircom/readme.eml: Remote server may be infected with the Nimda virus.
  679. + /g_dircom/scripts/httpodbc.dll: Possible IIS backdoor found.
  680. + /g_dircom/scripts/proxy/w3proxy.dll: MSProxy v1.0 installed
  681. + /g_dircom/SiteServer/admin/: Site Server components admin. Default account may
  682. be 'LDAP_Anonymous', pass is 'LdapPassword_1'. see http://www.wiretrip.net/rfp/
  683. p/doc.asp/i1/d69.htm
  684. + /g_dircom/siteseed/: Siteseed pre 1.4.2 has 'major' security problems.
  685. + /g_dircom/pccsmysqladm/incs/dbconnect.inc: This file should not be accessible,
  686. as it contains database connectivity information. Upgrade to version 1.2.5 or h
  687. igher.
  688. + /g_dircom/iisadmin/: Access to /iisadmin should be restricted to localhost or
  689. allowed hosts only.
  690. + /g_dircom/PDG_Cart/oder.log: Shopping cart software log
  691. + /g_dircom/ows/restricted%2eshow: OWS may allow restricted files to be viewed b
  692. y replacing a character with its encoded equivalent.
  693. + /g_dircom/WEB-INF./web.xml: Multiple implementations of j2ee servlet container
  694. s allow files to be retrieved from WEB-INF by appending a '.' to the directory n
  695. ame. Products include Sybase EA Service, Oracle Containers, Orion, JRun, HPAS, P
  696. ramati and others. See http://www.westpoint.l
  697. + /g_dircom/view_source.jsp: Resin 2.1.2 view_source.jsp allows any file on the
  698. system to be viewed by using \..\ directory traversal. This script may be vulner
  699. able.
  700. + /g_dircom/w-agora/: w-agora pre 4.1.4 may allow a remote user to execute arbit
  701. rary PHP scripts via URL includes in include/*.php and user/*.php files. Default
  702. account is 'admin' but password set during install.
  703. + OSVDB-42680: /g_dircom/vider.php3: MySimpleNews may allow deleting of news ite
  704. ms without authentication.
  705. + OSVDB-6181: /g_dircom/officescan/cgi/cgiChkMasterPwd.exe: Trend Micro Officesc
  706. an allows you to skip the login page and access some CGI programs directly.
  707. + /g_dircom/pbserver/pbserver.dll: This may contain a buffer overflow. http://ww
  708. w.microsoft.com/technet/security/bulletin/http://www.microsoft.com/technet/secur
  709. ity/bulletin/ms00-094.asp.asp
  710. + /g_dircom/administrator/gallery/uploadimage.php: Mambo PHP Portal/Server 4.0.1
  711. 2 BETA and below may allow upload of any file type simply putting '.jpg' before
  712. the real file extension.
  713. + /g_dircom/pafiledb/includes/team/file.php: paFileDB 3.1 and below may allow fi
  714. le upload without authentication.
  715. + /g_dircom/phpEventCalendar/file_upload.php: phpEventCalendar 1.1 and prior are
  716. vulnerable to file upload bug.
  717. + /g_dircom/servlet/com.unify.servletexec.UploadServlet: This servlet allows att
  718. ackers to upload files to the server.
  719. + /g_dircom/scripts/cpshost.dll: Posting acceptor possibly allows you to upload
  720. files
  721. + /g_dircom/upload.asp: An ASP page that allows attackers to upload files to ser
  722. ver
  723. + /g_dircom/uploadn.asp: An ASP page that allows attackers to upload files to se
  724. rver
  725. + /g_dircom/uploadx.asp: An ASP page that allows attackers to upload files to se
  726. rver
  727. + /g_dircom/wa.exe: An ASP page that allows attackers to upload files to server
  728. + /g_dircom/basilix/compose-attach.php3: BasiliX webmail application prior to 1.
  729. 1.1 contains a non-descript security vulnerability in compose-attach.php3 relate
  730. d to attachment uploads
  731. + /g_dircom/server/: If port 8000, Macromedia JRun 4 build 61650 remote administ
  732. ration interface is vulnerable to several XSS attacks.
  733. + /g_dircom/vgn/ac/data: Vignette CMS admin/maintenance script available.
  734. + /g_dircom/vgn/ac/delete: Vignette CMS admin/maintenance script available.
  735. + /g_dircom/vgn/ac/edit: Vignette CMS admin/maintenance script available.
  736. + /g_dircom/vgn/ac/esave: Vignette CMS admin/maintenance script available.
  737. + /g_dircom/vgn/ac/fsave: Vignette CMS admin/maintenance script available.
  738. + /g_dircom/vgn/ac/index: Vignette CMS admin/maintenance script available.
  739. + /g_dircom/vgn/asp/MetaDataUpdate: Vignette CMS admin/maintenance script availa
  740. ble.
  741. + /g_dircom/vgn/asp/previewer: Vignette CMS admin/maintenance script available.
  742. + /g_dircom/vgn/asp/status: Vignette CMS admin/maintenance script available.
  743. + /g_dircom/vgn/asp/style: Vignette CMS admin/maintenance script available.
  744. + /g_dircom/vgn/errors: Vignette CMS admin/maintenance script available.
  745. + /g_dircom/vgn/jsp/controller: Vignette CMS admin/maintenance script available.
  746.  
  747. + /g_dircom/vgn/jsp/errorpage: Vignette CMS admin/maintenance script available.
  748. + /g_dircom/vgn/jsp/initialize: Vignette CMS admin/maintenance script available.
  749.  
  750. + /g_dircom/vgn/jsp/jspstatus: Vignette CMS admin/maintenance script available.
  751. + /g_dircom/vgn/jsp/jspstatus56: Vignette CMS admin/maintenance script available
  752. .
  753. + /g_dircom/vgn/jsp/metadataupdate: Vignette CMS admin/maintenance script availa
  754. ble.
  755. + /g_dircom/vgn/jsp/previewer: Vignette CMS admin/maintenance script available.
  756. + /g_dircom/vgn/jsp/style: Vignette CMS admin/maintenance script available.
  757. + /g_dircom/vgn/legacy/edit: Vignette CMS admin/maintenance script available.
  758. + /g_dircom/vgn/login: Vignette server may allow user enumeration based on the l
  759. ogin attempts to this file.
  760. + OSVDB-35707: /g_dircom/forum/admin/wwforum.mdb: Web Wiz Forums password databa
  761. se found.
  762. + /g_dircom/fpdb/shop.mdb: MetaCart2 is an ASP shopping cart. The database of cu
  763. stomers is available via the web.
  764. + OSVDB-52975: /g_dircom/guestbook/admin/o12guest.mdb: Ocean12 ASP Guestbook Man
  765. ager allows download of SQL database which contains admin password.
  766. + OSVDB-15971: /g_dircom/midicart.mdb: MIDICART database is available for browsi
  767. ng. This should not be allowed via the web server.
  768. + OSVDB-15971: /g_dircom/MIDICART/midicart.mdb: MIDICART database is available f
  769. or browsing. This should not be allowed via the web server.
  770. + OSVDB-41850: /g_dircom/mpcsoftweb_guestbook/database/mpcsoftweb_guestdata.mdb:
  771. MPCSoftWeb Guest Book passwords retrieved.
  772. + /g_dircom/news/news.mdb: Web Wiz Site News release v3.06 admin password databa
  773. se is available and unencrypted.
  774. + OSVDB-53413: /g_dircom/shopping300.mdb: VP-ASP shopping cart application allow
  775. s .mdb files (which may include customer data) to be downloaded via the web. The
  776. se should not be available.
  777. + OSVDB-53413: /g_dircom/shopping400.mdb: VP-ASP shopping cart application allow
  778. s .mdb files (which may include customer data) to be downloaded via the web. The
  779. se should not be available.
  780. + OSVDB-15971: /g_dircom/shoppingdirectory/midicart.mdb: MIDICART database is av
  781. ailable for browsing. This should not be allowed via the web server.
  782. + OSVDB-4398: /g_dircom/database/db2000.mdb: Max Web Portal database is availabl
  783. e remotely. It should be moved from the default location to a directory outside
  784. the web root.
  785. + /g_dircom/admin/config.php: PHP Config file may contain database IDs and passw
  786. ords.
  787. + /g_dircom/adm/config.php: PHP Config file may contain database IDs and passwor
  788. ds.
  789. + /g_dircom/administrator/config.php: PHP Config file may contain database IDs a
  790. nd passwords.
  791. + /g_dircom/contents.php?new_language=elvish&mode=select: Requesting a file with
  792. an invalid language selection from DC Portal may reveal the system path.
  793. + OSVDB-6467: /g_dircom/pw/storemgr.pw: Encrypted ID/Pass for Mercantec's SoftCa
  794. rt, http://www.mercantec.com/, see http://www.mindsec.com/advisories/post2.txt f
  795. or more information.
  796. + /g_dircom/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter: Allaire ColdFus
  797. ion allows JSP source viewed through a vulnerable SSI call.
  798. + /g_dircom/shopa_sessionlist.asp: VP-ASP shopping cart test application is avai
  799. lable from the web. This page may give the location of .mdb files which may also
  800. be available.
  801. + OSVDB-53303: /g_dircom/simplebbs/users/users.php: Simple BBS 1.0.6 allows user
  802. information and passwords to be viewed remotely.
  803. + /g_dircom/typo3conf/: This may contain sensitive Typo3 files.
  804. + /g_dircom/typo3conf/database.sql: Typo3 SQL file found.
  805. + /g_dircom/typo3conf/localconf.php: Typo3 config file found.
  806. + OSVDB-53386: /g_dircom/vchat/msg.txt: VChat allows user information to be retr
  807. ieved.
  808. + OSVDB-4907: /g_dircom/vgn/license: Vignette server license file found.
  809. + /g_dircom/webcart-lite/config/import.txt: This may allow attackers to read cre
  810. dit card data. Reconfigure to make this file not accessible via the web.
  811. + /g_dircom/webcart-lite/orders/import.txt: This may allow attackers to read cre
  812. dit card data. Reconfigure to make this file not accessible via the web.
  813. + /g_dircom/webcart/carts/: This may allow attackers to read credit card data. R
  814. econfigure to make this dir not accessible via the web.
  815. + /g_dircom/webcart/config/: This may allow attackers to read credit card data.
  816. Reconfigure to make this dir not accessible via the web.
  817. + /g_dircom/webcart/config/clients.txt: This may allow attackers to read credit
  818. card data. Reconfigure to make this file not accessible via the web.
  819. + /g_dircom/webcart/orders/: This may allow attackers to read credit card data.
  820. Reconfigure to make this dir not accessible via the web.
  821. + /g_dircom/webcart/orders/import.txt: This may allow attackers to read credit c
  822. ard data. Reconfigure to make this file not accessible via the web.
  823. + /g_dircom/ws_ftp.ini: Can contain saved passwords for FTP sites
  824. + /g_dircom/WS_FTP.ini: Can contain saved passwords for FTP sites
  825. + /g_dircom/_mem_bin/auoconfig.asp: Displays the default AUO (LDAP) schema, incl
  826. uding host and port.
  827. + OSVDB-17659: /g_dircom/SiteServer/Admin/knowledge/persmbr/vs.asp: Expose vario
  828. us LDAP service and backend configuration parameters
  829. + OSVDB-17661: /g_dircom/SiteServer/Admin/knowledge/persmbr/VsLsLpRd.asp: Expose
  830. various LDAP service and backend configuration parameters
  831.  
  832. ---------------------------------------------------------------------------
  833. + Target IP: 31.13.73.23
  834. + Target Hostname: graph.facebook.com
  835. + Target Port: 443
  836. ---------------------------------------------------------------------------
  837. + SSL Info: Subject: /C=US/ST=California/L=Palo Alto/O=Facebook, Inc./CN=
  838. *.facebook.com
  839. Ciphers: RC4-SHA
  840. Issuer: /O=VeriSign Trust Network/OU=VeriSign, Inc./OU=VeriS
  841. ign International Server CA - Class 3/OU=www.verisign.com/CPS Incorp.by Ref. LIA
  842. BILITY LTD.(c)97 VeriSign
  843. + Start Time: 2013-04-13 21:50:45 (GMT-3)
  844. ---------------------------------------------------------------------------
  845. + Server: No banner retrieved
  846. + The anti-clickjacking X-Frame-Options header is not present.
  847. + Uncommon header 'x-fb-rev' found, with contents: 784561
  848. + Uncommon header 'x-fb-debug' found, with contents: uSOE1rKPfqvR+V0PvHv8M4bRzfT
  849. uYUQDblAIvknrlXE=
  850. + Uncommon header 'access-control-allow-origin' found, with contents: *
  851. + Server leaks inodes via ETags, header found with file /cgi.cgi/, fields: 0x250
  852. a0eb3ea3e9866522b45dfb59bdb06755487bd
  853. + /crossdomain.xml contains a full wildcard entry. See http://jeremiahgrossman.b/
  854. logspot.com/2008/05/crossdomainxml-invites-cross-site.html
  855. + /crossdomain.xml contains 0 line which should be manually viewed for improper
  856. domains or wildcards.
  857. + "robots.txt" contains 1 entry which should be manually viewed.
  858. + Multiple index files found: default.asp, default.aspx, index.asp, index.shtml,
  859. index.aspx
  860. + Server is using a wildcard certificate: '*.facebook.com'
  861. + Cookie datr created without the secure flag
  862. + Cookie reg_ext_ref created without the secure flag
  863. + Cookie reg_ext_ref created without the httponly flag
  864. + Cookie reg_fb_gate created without the secure flag
  865. + Cookie reg_fb_gate created without the httponly flag
  866. + Cookie reg_fb_ref created without the secure flag
  867. + Cookie reg_fb_ref created without the httponly flag
  868. + Uncommon header 'x-frame-options' found, with contents: DENY
  869. + Uncommon header 'x-xss-protection' found, with contents: 0
  870. + Uncommon header 'x-content-type-options' found, with contents: nosniff
  871. + /kboard/: KBoard Forum 0.3.0 and prior have a security problem in forum_edit_p
  872. ost.php, forum_post.php and forum_reply.php
  873. + /ssdefs/: Siteseed pre 1.4.2 has 'major' security problems.
  874. + /sshome/: Siteseed pre 1.4.2 has 'major' security problems.
  875. + OSVDB-8103: /global.inc: PHP-Survey's include file should not be available via
  876. the web. Configure the web server to ignore .inc files or change this to global
  877. .inc.php
  878. + /getaccess: This may be an indication that the server is running getAccess for
  879. SSO
  880. + /tsweb/: Microsoft TSAC found. http://www.dslwebserver.com/main/fr_index.html?
  881. /main/sbs-Terminal-Services-Advanced-Client-Configuration.html
  882. + /w-agora/: w-agora pre 4.1.4 may allow a remote user to execute arbitrary PHP
  883. scripts via URL includes in include/*.php and user/*.php files. Default account
  884. is 'admin' but password set during install.
  885. + /wa.exe: An ASP page that allows attackers to upload files to server
  886. + /server/: If port 8000, Macromedia JRun 4 build 61650 remote administration in
  887. terface is vulnerable to several XSS attacks.
  888. + /names.nsf: User names and groups can be accessed remotely (possibly password
  889. hashes as well)
  890. + /mail.box: The mail database can be read without authentication.
  891. + OSVDB-4015: /jigsaw/: Jigsaw server may be installed. Versions lower than 2.2.
  892. 1 are vulnerable to Cross Site Scripting (XSS) in the error page.
  893. + /ariadne/: Ariadne pre 2.1.2 has several vulnerabilities. The default login/pa
  894. ss to the admin page is admin/muze.
  895. + /cgi.cgi/photo/manage.cgi: My Photo Gallery management interface. May allow fu
  896. ll access to photo galleries and more.
  897. + /webcgi/photo/manage.cgi: My Photo Gallery management interface. May allow ful
  898. l access to photo galleries and more.
  899. + /bin/photo/manage.cgi: My Photo Gallery management interface. May allow full a
  900. ccess to photo galleries and more.
  901. + /cgi-perl/photo/manage.cgi: My Photo Gallery management interface. May allow f
  902. ull access to photo galleries and more.
  903. + /krysalis/: Krysalis pre 1.0.3 may allow remote users to read arbitrary files
  904. outside docroot
  905. + OSVDB-561: /server-status: This reveals Apache information. Comment out approp
  906. riate line in httpd.conf or restrict access to allowed hosts.
  907. + OSVDB-2117: /cpanel/: Web-based control panel
  908. + OSVDB-2695: /cgi.cgi/photo/: My Photo Gallery pre 3.6 contains multiple vulner
  909. abilities including directory traversal, unspecified vulnerabilities and remote
  910. management interface access.
  911. + OSVDB-2695: /webcgi/photo/: My Photo Gallery pre 3.6 contains multiple vulnera
  912. bilities including directory traversal, unspecified vulnerabilities and remote m
  913. anagement interface access.
  914. + OSVDB-2695: /bin/photo/: My Photo Gallery pre 3.6 contains multiple vulnerabil
  915. ities including directory traversal, unspecified vulnerabilities and remote mana
  916. gement interface access.
  917. + OSVDB-2695: /cgi-perl/photo/: My Photo Gallery pre 3.6 contains multiple vulne
  918. rabilities including directory traversal, unspecified vulnerabilities and remote
  919. management interface access.
  920.  
  921. #SUP3RM4N and KORZUS
  922. TEAM:http://www.facebook.com/CyberHats
  923.  
  924.  
  925.  
  926. /:------------------------------------:/
  927. o o
  928. o http://goo.gl/XuWOX o
  929. s` `s
  930. `--------------------------------------`
  931.  
  932. `-://///+oo+/:.
  933. `-/:--:. -o ..//+:```````.:yNNmho-
  934. -M-``.od- `s -M .-/+-` +NNNNNd/
  935. -M. hm /o-s+ -d+o+/M:..M-/y+ `-:s: ```` `NNNNNNNy`
  936. -M. hm -/-sd N: .M .M` /m --hy. `+hmmmmmmhs/NNNNNNNNs
  937. -M. .od- h+`od` N: .M``.M /m -`hd` /y/+yNNNNNNNNNNNNNNNN
  938. `:o/-::-` :o:-o..+:` +/.-o-`:+. - :dm+.`......../NNNNNNNNNNNNNNNN.
  939. -` --m:` `-sdNNNNNNNNNNNNNN-
  940. `-. :/s-`...` .:+ydNNNNNNNNNN:
  941. .-...-` .:` .- `/:` -soddmmmdmh+` yd` /NNNNNNNNNN/
  942. :N-``-/ .M. .- `hNdhdmm//NNNN-ymNd: yN+-dNNNNNNNNNN+
  943. -M-`.- .o: .s- .:-++ `M.`+:``++ .s/:oo ./-/+:` -NNNNNNo mNNh`.+NNN+ /NNNNNNNNNNNNNNy
  944. -M:.:/ ho m: m- `/ `M/o. oy `m+``M. yo `M- .NNNNmy` +/-` `./+mN/ `mNNNNNNNNNNNNNN:
  945. -M. yo `m/ N+``-``M:yo` oy d/ M- :y::/ `NNmo. :hy/--:shdmNNN-`/sNNNNNNNNNNNNNNm.
  946. `:h:` :y+-y+`-sso: -y:`so-`+s`.y/`-y: osoooo NN/+:`/oydNNNNNNNNNNNm`/mNNNNNNNNNNNNNNNh`
  947. .h:---+ mNhNNo` `:yNNmhs+omNNy yNNNNNNNNNNNNNNNNs
  948. .---. hNNNNNs` //+oymNNNNN-.NNNNNNNNNNNNNNNNNo
  949. ``` `` `. hmNyh++o -+ooosNNNNNNh yNNNNNNNNNNNNNNNNN/
  950. `/d: `s: :N` `.o:/.:./::oydmNNNNNNNNNNN+/oyNNNNNNNNNNNNNNNN/
  951. sd` -+ `::/. .::/M` `-:/. -/.+` .++.../shNNNNNNNNNNNNNNNNNNNNNmNNNNNNNNNNNNNNNNN:
  952. yh`.o +/`oh -h` -M`.h--sh`+m.:` `-+ymNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNm.
  953. `dso` /+-od sd `M`:m` . /d `-+yNmmNNNmh+/+Ny:yNNNNNNNNNNNNNNyyo:`
  954. .h. hs:+d-.hs//m:`ohso:`+d. `-:/`.---` /++.dNNNNNNNNNNNNmo:`
  955. ` ` `` ` ` `````.-o+``` ``./shdNNNNNNNNNNNNNNNNNNd+`
  956. `+shhhhhhhhmNNh+/.-hdmNNNNNNNNNNNNNNNNNNNNNNNNNd/`
  957. `+++NNNNNNNNmNy` /NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNm
  958. .odmNNNNNmo+/.-h oNNNNNNh:yNNNNNNNNNNNNNNNNNNNNNNNm
  959. `oNNNNNNNNh` `h` ym.dNNNo od/dNNNNNNNNNNNNNNNNNNNNm
  960. .dNNNNNNNNh` s: yN-+NNN/ oNNo`yNNNNNNNNNNNNNNNNNNNm
  961. `dNNNNNNNNh` /s +N/.NNd. oNNNNs`dNNNNNNNNNNNNNNNNNNm
  962. yNNNNNNNNd` .d` .Ny hNs` oNNNNNNo-NNNNNNNNNNNNNNNNNNm
  963. syyyyyyyy` o- +y`.s- -yyyyyyss`+sssooooooooooooooo
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!