Penetration Testing mailing list archives
Re: listing directory structure within webserver root
From: grutz () jingojango net
Date: Sun, 29 Aug 2004 12:34:06 -0700
On Sun, Aug 29, 2004 at 05:04:48AM +1000, Serg Belokamen brazenly wrote:
Is there a way to somehow enumerate a directory structur on a remote webserver? Brute force springs to mind but thats mathematically impossible, to go through all combinations, etc.
Difficult to do if directory listing is turned off. It can be done if the site has a script/module that uses poor input: http://www.securiteam.com/securitynews/5TP0B15DFI.html - 4D WebSTAR http://www.osvdb.org/displayvuln.php?osvdb_id=7275 - PowerPortal Gallery http://www.osvdb.org/displayvuln.php?osvdb_id=4946 - ADA Image Server Or potentially server vulnerabilities: http://www.securityfocus.com/bid/2503 - Apache ///////////////// -- When little kids ask where rain comes from, I think a cute thing to tell him is "God is crying." And if he asks why God is crying, another cute things to tell him is "Probably because of something you did." - Jack Handy ------------------------------------------------------------------------------ Ethical Hacking at the InfoSec Institute. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. Check out our Advanced Hacking course, learn to write exploits and attack security infrastructure. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. http://www.infosecinstitute.com/courses/ethical_hacking_training.html -------------------------------------------------------------------------------
Current thread:
- listing directory structure within webserver root Serg Belokamen (Aug 29)
- Re: listing directory structure within webserver root Jose Maria Lopez (Aug 29)
- RE: listing directory structure within webserver root Chuck Fullerton (Aug 29)
- Re: RE: listing directory structure within webserver root dietrich (Aug 30)
- Re: listing directory structure within webserver root Alexandre Verriere (Aug 30)
- Re: listing directory structure within webserver root Serg Belokamen (Aug 31)
- RE: listing directory structure within webserver root Chuck Fullerton (Aug 29)
- Re: listing directory structure within webserver root Jose Maria Lopez (Aug 29)
- Re: listing directory structure within webserver root grutz (Aug 29)
- Re: listing directory structure within webserver root Kurt Seifried (Aug 30)
- <Possible follow-ups>
- RE: listing directory structure within webserver root Sasa Jusic (Aug 30)