IIS double UTF decoding bug (old) exploit: IIS explorer

[full-disclosure () lists netsys com (Erik Fichtner)]

--3oCie2+XPXTnK5a5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Jul 11, 2002 at 11:00:47AM -0600, Steve wrote:
> So how hard is it going to be to take a tool/script that only tests
> localhost and modify it to test other hosts?  There is really no point in
> forcing localhost as it won't stop anyone.

That, and it's an extra time-wasting step for a lot of admins who want to=
=20
scan their entire network to make sure they know where everything they need
to go fix is.. (Not everyone has well documented networks.  I'd speculate
that most do not have well documented networks.)


That said, it might be nicer if more folks released Nessus NASL scripts for
testing purposes instead of half a dozen marginally broken tools, but that
probably won't ever happen.  [1]=20

Admins responsible for the security of their networks need to be made=20
aware that there are problems, and they need to have adequate tools to=20
tell them exactly what they need to fix, and to prove that it's been fixed.
This in a world where many admins know less about security then the average
script kiddie.=20

[1] In my perfect world, every responsible advisory for a remote attack=20
would come with both a working NASL script to test it, and a set of well
written snort signatures to spot the attack in progress.   C'mon guys,=20
you did all the work to discover and exploit the flaw, do a little more and
tell us how to watch for it while you're at it.

(if that doesn't start an argument of some sort, I don't know what will.)

--=20
                        Erik Fichtner; Unix Ronin
                    http://www.obfuscation.org/techs/
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."  -- Benjamin Franklin, 1759


--3oCie2+XPXTnK5a5
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj0txZ4ACgkQDf8awdbGHo0ecwCfREe2ZIkIW82ytRLb77z/lCZE
fN0An27wV1/YrqINzWC3ttGt2nxaSaPE
=dpKK
-----END PGP SIGNATURE-----

--3oCie2+XPXTnK5a5--