(NT) When exploit CGI's that allow viewing of files...

[marc () EEYE COM (Marc)]

I am trying to make a list of files, that can lead to the remote server
being compromised, to request if your exploiting a CGI/ASP/Whatever program
that allows you to read files on the remote web server etc...

For example:
http://[server]/cgi-bin/lame.cgi?../../../../../boot.ini

Two examples would be:
../../../../../../Program Files/Microsoft BackOFfice/reboot.ini - Some
BackOffice 4.0 service user/pass pairs
../../../../../../winnt/repair/sam - Duh.

Some other good paths would be paths to CuteFTP, WS_FTP etc... password
files.

If you can eMail me personally, I will compile one giant list and then send
it back to vuln-dev, to help cut down the amount of traffic like we saw with
the default password thread.

Signed,
Marc Maiffret
Chief Hacking Officer
eCompany / eEye
T.949.675.8160
F.949.675.8191
http://eEye.com

P.S.
Going to defcon? most of eEye will be there so drop an eMail to
roadtrip () eeye com if you want to hook-up.