well yeah, agreed its a vuln not a threat. My mistake, actally i just spelt
it wrong, a twist of toungue?.. i always considered it as a vuln not a
threat. nyways thanks for pointing.
well in my tests, only 2 subdomains, suffered from this vuln, others had
been protected from directory traversal. So may be it was an overlook, or it
could have been done by different admins. I have informed them of the
situation.
I acknowledge that security through obscurity is just counterproductive, but
what i was meaning is that : The banner is not a thing which is "required"
to be open. We are not obscuring anything by removing the banner. Its just a
safe practise. Should we be lazy, to overlook it we might be exposing
ourselves to a pinch more of chances. Obscurity in my definition becomes
dangerous when we rely on it for protection. We arent trying to protect
anything here, by not displaying the banner. As someone rightly pointed out,
there are other parameters that an experienced person can always resort to
for service detections. By removing the banner we are just trying to comply
with safe practises, and may be "narrow" down our attacker to a competent
one.
joel.
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------------
