Message-ID: <4120E42D.4010103@cr-secure.net>
From: chris at cr-secure.net (ChrisR-)
Subject: Re: ws_ftp.log

Hello,

This is not really anything new, try googling for someones IP address, there is a lot of sensitive information to be found. 
Even better search for a public anonymous proxy IP, some proxy servers keep a public log of who has used them and what sites
they were used to visit. Not so anonymous anymore are they. Google has always been a powerful tool for information gathering
in a variety of creative ways.

ChrisR-
www.cr-secure.net

===========================================================================

     >Hi,

    WS_FTP is a popular & feature rich ftp client. It
    makes upload/download as easy as drag & drop. But
    mostly peoples using this forget that it creates a log
    file with name ws_ftp.log. This file holds sensitive
    data such as file source/destination and file name,
    date/time of upload etc., People when use this to
    upload files to their website, never know that along
    with other files even ws_ftp.log file also gets
    uploaded to the webserver, making it globally
    accessible.

    One can find thousands of ws_ftp.log files with a
    quick google search as follows,

    http://www.google.com/search?hl=en&ie=UTF-8&q=inurl%3Aws_ftp.log
    <http://www.google.com/search?hl=en&ie=UTF-8&q=inurl%3Aws_ftp.log>

    now people might use extensive google search to find
    files that have got copied to web server recently with
    following query, which will show you what files
    actually got copied in Auguts 2004, because its likely
    that those files will still be in there in web server.

    http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=2004.08+inurl%3Aws_ftp.log+&btnG=Search
    <http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=2004.08+inurl%3Aws_ftp.log+&btnG=Search>

    An attacker has a look at cached google page (without
    actually hitting the target & leaving traces at
    webserver logs) and quickly finds out some vital
    informations such as,

    1. Exact location of file in web server (i.e.,
    /usr/local/www/test/abc.htm instead of
    www.web.dom/test/abc.htm).

    2. It some times also gives user names(in case where
    web master gives each user a directory to host their
    websites), which later can be used with brute
    force/dictonary attack to gain access to web server.

    3. It makes it easy to find/download vulnerable
    scripts or classes in a website, with again just a
    google search, as given below. Which otherwise can be
    found by viewing source of html file. Which can later
    be use to attack the host.

    http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=class+2004.08+inurl%3Aws_ftp.log+
    <http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=class+2004.08+inurl%3Aws_ftp.log+>

    Other than that it also (sometimes) gives internal
    hostname/ip address of webserver.

    Recommendation:
    Please remove ws_ftp.log file from website after data
    movement, and webmasters are requested to scan/remove
    such files from webserver (in case files are uploaded
    by some one else). Which can easily be done by a cron
    job.

    Special Thanks to:
    Johnny Long (http://johnny.ihackstuff.com) for his
    wonderful work of "The Google Hacker?s Guide
    Understanding and Defending Against
    the Google Hacker"

    Thanks & Regards,

    Gaurang.
    http://www.geocities.com/gaurangpandya/



    __________________________________
    Do you Yahoo!?
    Yahoo! Mail - 50x more storage than other providers!
    http://promotions.yahoo.com/new_mail

Powered by blists - more mailing lists