Re: Web Site Hacks

["-= ArkanoiD =-" <ark () mpak convey ru>]

nuqneH,

> Date: Tue, 2 Dec 1997 21:10:19 GMT
> From: Edward Cracknell <edward () securIT net>
> To: "Firewall Wizards (Marcus J. Ranum's new moderated mail list)" <firewall-wizards () nfr net>
> Subject: Web Site Hacks

[dd]

> Assuming the Web server is behind the firewall and only http is allowed:
>
> a) The ability to run cgi-bin scripts or html form processing in a way
> which will create an html page as output. (Many form-based pages take
> input and produce a page for output). As a result, it might be possible
> to create a page that contains a URL like:
>
> <A HREF=telnet://target.system.behi nd.firewall> Click here </A>
>
> This would generally allow a telnet session from the web server to the
> target system and the firewall rules of ONLY http allowed through would
> not stop this.

Hmmm from the web _server_? why?

--- 
                                       _     _  _  _  _      _  _
   Must be a visit from the dead..     _| o |_ | | _|| |   / _||_|   |_ |_ |_
   CU in Hell ..........  Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|