Full Disclosure mailing list archives
Re: Hotmail.com doesn't like russians, returns 500 internal server error.
From: Georgi Guninski <guninski () guninski com>
Date: Sun, 1 May 2005 22:27:20 +0300
On Thu, Apr 28, 2005 at 08:31:50PM -0700, auto491351 () hushmail com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 My friend blshkv showed me that he get hotmail.com to crash by just visiting the site! I used Paros Proxy to intercept the request and replayed it using telnet, with the same result.
i can reproduce it: fuck@bill:~$ cat ./fsckbll.pl #!/usr/bin/perl -w use IO::Socket; my $host=$ARGV[0] || "www.hotmail.com"; my $port=$ARGV[1] || 80; my $sock=IO::Socket::INET->new(Proto => 'tcp', PeerAddr => $host,PeerPort =>$port) || die("socket"); print "Connected to ${host}:${port}\n"; my $first="GET / HTTP/1.0\r\nAccept-Language: en;q=1.0,ru;q=0.9\r\n\r\n"; print $sock $first; while(<$sock>) {print $_;} fuck@bill:~$ ./fsckbll.pl www.hotmail.com 80 Connected to www.hotmail.com:80 HTTP/1.1 500 Internal Server Error Connection: close Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 3026 <html> <head> <title>Runtime Error</title> <style> ...snip... <b> Description: </b>An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, h owever, be viewed by browsers running on the local server machine.
I guess Hotmail.com's system administrators missed a few hardening steps, their developers forgot to have a default catch statement in their code and the QA people missed both of these issues in the UAT.
i guess hotmail missed the train. -- where do you want bill gates to go today? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Hotmail.com doesn't like russians, returns 500 internal server error. James Tucker (May 01)
- <Possible follow-ups>
- Re: Hotmail.com doesn't like russians, returns 500 internal server error. Georgi Guninski (May 01)