Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Nessus-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: frontpage_overflow.nasl - false positive (?)

from [Nicolas Pouvesle] Network Security [Permanent Link]
Subject: Re: frontpage_overflow.nasl - false positive (?)
Date: Thu, 24 Feb 2005 15:07:01 -0500
I removed last modification on frontpage_overflow.nasl . It should not produce FP now.
I will look how to improve this plugin later.

Thanks,

Nicolas


On Feb 24, 2005, at 2:51 PM, Pavol "][ce" Oetter wrote:

Hi,

I'm having a trouble with $SUBJ$ plugin. Plugin is launched in regular
scan ( safechecks disabled, auto dependencies enabled ). Target is
running WinXP build 2600, ENG, SP2. Plugin triggers an alert, but host
is NOT vulnerable - I tested it with Metasploit Framework.

I strongly suspect this if condition :

if (egrep(pattern:".*The remote procedure call failed*", string: r) ||
# First match fails on localized Windows
("HTTP/1.1 500 Server Error" >< r && "<html><head><title>Error</title>" >< r))
security_hole(port);

when I tried to exploit the hole manually I got following output :

host:/boot # telnet target 80
Trying target...
Connected to target.
Escape character is '^]'.
GET /_vti_bin/_vti_aut/fp30reg.dll?<a lot of aaaaaa here> HTTP/1.0

HTTP/1.1 500 Server Error
Server: Microsoft-IIS/5.1
Date: Thu, 24 Feb 2005 12:31:01 GMT
Content-Type: text/html
Content-Length: 100

<html><head><title>Error</title></head><body>The specified module
could not be found. </body></html>Connection closed by foreign host.

Any suggestions are welcome.

Regards,

--
Pavol "][ce" Oetter
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus


_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  frontpage_overflow.nasl - false positive (?), Pavol \"][ce\" Oetter
Next by Date:  Something went wrong when installing the plugins - uncompressing the plugins archive failed, saverio . ferraro
Previous by Thread:  frontpage_overflow.nasl - false positive (?), Pavol \"][ce\" Oetter
Next by Thread:  Something went wrong when installing the plugins - uncompressing the plugins archive failed, saverio . ferraro
Indexes:  [Date] [Thread] [Top] [All Lists]