On Sun, Aug 29, 2004 at 05:04:48AM +1000, Serg Belokamen brazenly wrote:
Is there a way to somehow enumerate a directory structur on a remote
webserver? Brute force springs to mind but thats mathematically
impossible, to go through all combinations, etc.
Difficult to do if directory listing is turned off. It can be done if the
site has a script/module that uses poor input:
http://www.securiteam.com/securitynews/5TP0B15DFI.html - 4D WebSTAR
http://www.osvdb.org/displayvuln.php?osvdb_id=7275 - PowerPortal Gallery
http://www.osvdb.org/displayvuln.php?osvdb_id=4946 - ADA Image Server
Or potentially server vulnerabilities:
http://www.securityfocus.com/bid/2503 - Apache /////////////////
--
When little kids ask where rain comes from, I think a cute thing to tell him
is "God is crying." And if he asks why God is crying, another cute things to
tell him is "Probably because of something you did." - Jack Handy
------------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. All of our class sizes are
guaranteed to be 12 students or less to facilitate one-on-one interaction
with one of our expert instructors. Check out our Advanced Hacking course,
learn to write exploits and attack security infrastructure. Attend a course
taught by an expert instructor with years of in-the-field pen testing
experience in our state of the art hacking lab. Master the skills of an
Ethical Hacker to better assess the security of your organization.
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
-------------------------------------------------------------------------------
