Re: Web App Script Capture

[Mike Duncan <Mike.Duncan () noaa gov>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

What you have to worry about in these situations is information
disclosure. Using the path traversal, an attacker can fingerprint the
OS, applications/daemons installed,  and even the versions in some
cases. Using this information, further attacks can be made on the system
itself.

Mike Duncan
ISSO, Application Security Specialist
Government Contractor with STG, Inc.
NOAA :: National Climatic Data Center


Jon Kibler wrote:
> All,
>
> If you have a web app that has path traversal and null byte vulnerabilities, but
> not remote command execution or file upload, is there any way to manipulate the
> web server to allow remote retrieval of script source code (e.g.,php, perl, asp)
> without it being executed by the web server?
>
> TIA!!
>
> Jon K.

==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.




- ------------------------------------------------------------------------

- ------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can
actually do a proper penetration test. IACRB CPT and CEPT certs require
a full practical examination in order to become certified.

http://www.iacertification.org
- ------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkrDaloACgkQnvIkv6fg9hYUhACgjxCHqsqn9kmmFtoVy0bn28wZ
yQMAoIY5zEvXtKo+t7p0jP1+QkT+rUrW
=F+/Q
-----END PGP SIGNATURE-----

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------