Vulnerability Development: RE: script locations

[Alex Andrews <alex () binarygod co uk>]

Three points, possibly wrong come to mind.

--


1) is it not possible in apache or other server to set parse any form of page for php markup etc.
Even .html or htm endings can be set to be parsed.
2) if i create the following lines of perl:
#!/usr/bin/perl
print "content-type: text/html\n\n";
print "hello world";

and save it to a file named prog.al, and set apache and file permissions to the correct level, it will run as a 
cgi-script.

3) Techincally you can place a cgi script anywhere you desire, as long as said script/httpd user have the correct 
permissions. 

Just my 2 c.
Thanks
Alex