full-disclosure - IIS double UTF decoding bug (old) exploit: IIS explorer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20020711175128.GF10584@obfuscation.org>
From: techs at obfuscation.org (Erik Fichtner)
Subject: IIS double UTF decoding bug (old) exploit:  IIS explorer

On Thu, Jul 11, 2002 at 11:00:47AM -0600, Steve wrote:
> So how hard is it going to be to take a tool/script that only tests
> localhost and modify it to test other hosts?  There is really no point in
> forcing localhost as it won't stop anyone.

That, and it's an extra time-wasting step for a lot of admins who want to 
scan their entire network to make sure they know where everything they need
to go fix is.. (Not everyone has well documented networks.  I'd speculate
that most do not have well documented networks.)

That said, it might be nicer if more folks released Nessus NASL scripts for
testing purposes instead of half a dozen marginally broken tools, but that
probably won't ever happen.  [1] 

Admins responsible for the security of their networks need to be made 
aware that there are problems, and they need to have adequate tools to 
tell them exactly what they need to fix, and to prove that it's been fixed.
This in a world where many admins know less about security then the average
script kiddie. 

[1] In my perfect world, every responsible advisory for a remote attack 
would come with both a working NASL script to test it, and a set of well
written snort signatures to spot the attack in progress.   C'mon guys, 
you did all the work to discover and exploit the flaw, do a little more and
tell us how to watch for it while you're at it.

(if that doesn't start an argument of some sort, I don't know what will.)

-- 
                        Erik Fichtner; Unix Ronin
                    http://www.obfuscation.org/techs/
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."  -- Benjamin Franklin, 1759

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 238 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20020711/099180f3/attachment.bin