Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Full Disclosure: Re: Fernando Gont remote command execution and big mouth vulnerability

Re: Fernando Gont remote command execution and big mouth vulnerability

From: Joxean Koret <joxeankoret_at_gmail.com>
Date: Thu, 4 Aug 2005 11:32:22 +0200

Oh I see... ppl loves to put ur name in their websites ... HEH!!!

u removed the link in the tools (dig) section of:
http://www.gont.com.ar nice try ....

http://thor.prohosting.com/fgont/cgi-bin/dig.pl
http://thor.prohosting.com/fgont/cgi-bin/whois.pl

also your dig script have a directory listing bug... just adding * in
the query....

   dig *
; <<>> DiG 8.3 <<>> cgi-lib.pl cli.pl dig.pl fuente.cgi p1.txt
p1dig.txt p1host.txt p1ns.txt p1whois.txt p2.txt p2dig.txt p2h
ost.txt p2ns.txt p2whois.txt whois.cgi whois.pl
;; res options: init recurs defnam dnsrch

------

                                                                Gont's
web site - Tools - whois (p1 of 13)

                    Web Hosting | Free Web Hosting | School Websites |
Teacher Websites | VChocolates
                    [banner_sign_up.gif]
                    Chocolates | Toffee | Caramels | Truffles | Search
| Heavy Equipment | Fitness |

                                                          Tools
                                                          whois

                            whois(1) manual page
     _______________________________________________________________________________________________________________

   whois ________________________________________
     _______________________________________________________________________________________________________________

   whois cat *
# Perl Routines to Manipulate CGI input
# cgi-lib_at_pobox.com
# $Id: cgi-lib.pl,v 2.17 1998/05/14 22:39:23 brenner Exp $
#
# Copyright (c) 1993-1998 Steven E. Brenner
# Unpublished work.
# Permission granted to use and modify this library so long as the
# copyright above is maintained, modifications are documented, and
# credit is given for any use of the library.
#
# Thanks are due to many people for reporting bugs and suggestions
....

 Gont's web site
   Contact Fernando Gont at fernando_at_gont.com.ar
     _______________________________________________________________________________________________________________

   Gont's web site
   Contact Fernando Gont at fernando_at_gont.com.ar
     _______________________________________________________________________________________________________________

   Gont's web site
   Contact Fernando Gont at fernando_at_gont.com.ar
     _______________________________________________________________________________________________________________

   Gont's web site
   Contact Fernando Gont at fernando_at_gont.com.ar
   ELF D4瞻4 (444獸@獸@繫繫繫````禮`禮T獸X
禮禮簞簞/usr/libexec/ld-elf.so.1FreeBSDS%+ ' )(!& $*%"
#繡穡織':獸D/獸T#禮簽藩,瓣%1
   8繕簽藩癒繕穡`禮
     糧Df聶繕獸RT獸Yt織穡簽藩獸Yd�t癟+禱簷繪瞻L藩織W獸
   W]$[h4繞libc.so.4warnx__stdoutpconnect_DYNAMICerrxoptargsocketfflushfreeaddrinfo_init_DefaultRuneLocalegai_strerrorenviron

......

"My site does not contan scripts" (since you removed the link).
"and is hosted on an OpenBSD server" Then fuck you and theo

Regards!!!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

fgont_jpg
Received on Aug 04 2005
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]