bugtraq - Re: BEA WebLogic internal hostname disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <005301c2f9bf$7e2d8f60$1500020a@bigdog>
Date: Thu, 3 Apr 2003 01:00:37 -0800
From: "Kurt Seifried" <kurt@...fried.org>
To: "Michael Hendrickx" <michael@...nit.be>,
	<bugtraq@...urityfocus.com>
Subject: Re: BEA WebLogic internal hostname disclosure


> Hi,
>
> During a penentration test, I discovered that the BEA Weblogic Server
> reveals it hostname (on windows machines NetBIOS name) while sending the
> following request:
>
> GET . HTTP/1.0\r\n\r\n
>
> On older systems (Weblogic 7.0), a simple "BLAH . BLAH\r\n\r\n" will do
> the same trick.  BEA was contacted about two weeks ago, but I haven't
> heard from them (yet).
>
> Regards,
> Michael

Reveals hostname:
./
.//
.//////////////
.%20
.%20%20
..

Does not reveal hostname:
...
.a
.1
.\
.%21

Seems that a single "." or a "." followed by a "special" character such as
"/" or %20 (space) works. Don't know what other "special" characters work.


Kurt Seifried, kurt@...fried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/