J.A. Gutierrez found following. WWW HTTP/1.0 Server, as shipped with IRIX 6.2 (at least in low end machines) includes a perl script (wrap) which allows anyone on the net to get a listing for any directory with mode +755. Simply use: http://sgi.victim/cgi-bin/wrap?/../../../../../etc