http-frontpage-vuln

[Aleksandar Nikolic <nikolic.alek () gmail com>]

I have commited this script as r28891.

This one is an oldie but a goodie:)

Description and sample output follow:

description = [[
Check if target machines are vulnerable to anonymous Frontpage login.

Older, default configurations of Frontpage extensions allow
remote user to login anonymously which may lead to server compromise.

 ]]

---
-- @usage
-- nmap.exe <target> -p 80 --script=http-frontpage-login
--
-- @args http-frontpage-login.path Path prefix to Frontpage
directories. Defaults
-- to root ("/").
--
-- @output
-- PORT   STATE SERVICE REASON
-- 80/tcp open  http    syn-ack
-- | http-frontpage-login:
-- |   VULNERABLE:
-- |   Frontpage extension anonymous login
-- |     State: VULNERABLE
-- |     Description:
-- |       Default installations of older versions of frontpage
extensions allow anonymous logins which can lead to server compromise.
-- |
-- |     References:
-- |_      http://insecure.org/sploits/Microsoft.frontpage.insecurities.html


I've tested it against default frontpage extensions installation on
win2k IIS server.

Aleksandar
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/