Legend
	no vulnerabilities       information acquisition       possible vulnerability       vulnerability       possible critical vulnerability       critical vulnerability		blocked service       not vulnerable service       not identified service       not scanned service		not scanned host       partially scanned host       license restriction

Vulnerabilities by Severity
high	36
high (possibly)	2
medium	25
medium (possibly)	1
low	65

Services by Severity
high	17
high (possibly)	1
medium	4
medium (possibly)	1
low	10
not vulnerable	61

Hosts by Severity
high	3
high (possibly)	0
medium	2
medium (possibly)	0
low	0
not vulnerable	0

Scanned Hosts

start

end

time

vulnerabilities

1

192.168.0.1 [border]

15.12.2005 13:14

15.12.2005 13:29

0:14

57

2

192.168.0.10 [xxx]

15.12.2005 13:14

15.12.2005 13:17

0:02

12

3

192.168.0.13 [KIREEV]

15.12.2005 13:14

15.12.2005 13:16

0:02

9

4

192.168.0.115 [MIKHAIL]

15.12.2005 13:14

15.12.2005 13:22

0:08

5

5

192.168.0.210 [SERVER]

15.12.2005 13:14

15.12.2005 13:40

0:25

46

1

192.168.0.1 [border] Default.prf

15.12.2005 13:14 15.12.2005 13:29 0:14 / MaxPatrol 7.0 Build 1554

System Kerio WinRoute Firewall Windows 5.0 21/tcp - Blocked 25/tcp - Blocked 53/udp - DNS Recursion Information 80/tcp - HTTP Directories with WRITE access found SQL Injection SQL Injection SQL Injection (blind) SQL Injection SQL Injection (blind) SQL Injection SQL Injection Directories with BROWSE access found Stored Cross Site Scripting (XSS) Cross Site Scripting (XSS) Cross Site Scripting (XSS) Cross Site Scripting (XSS) Cross Site Scripting (XSS) UTF-7 Cross Site Scripting (XSS) UTF-7 Cross Site Scripting (XSS) UTF-7 Cross Site Scripting (XSS) UTF-7 Cross Site Scripting (XSS) Unencrypted Data Transfering Existing but Unreachable Directories found Directories Requiring Authorization (NTLM) Directories Identified Directories Requiring Authorization (Basic) Script Error (type mismatch) Published E-Mail Addresses External Links Listed Scripts Cookies Links with Referrer Links with User-Agent Forms Listing Links with Parameters TRACK Method Allowed TRACE Method Allowed 110/tcp - Blocked 119/tcp - NNTP 135/tcp - Microsoft RPC Arbitrary Command Execution DCOM Service Started 137/udp - NetBIOS-SSN 139/tcp - NetBIOS Multiple Vulnerabilities (ms04-011) Arbitrary Command Execution (ms04-007) List of Users ( 1 - 10 ) Active Session List List of Resources LanManager and OS NULL Session Connection Transport Protocols List User Group List Computer Name and Domain MAC Address 445/tcp - Microsoft DS Arbitrary Command Execution (ms05-047) Arbitrary Command Execution (ms05-043) Arbitrary Command Execution (ms05-039) Arbitrary Command Execution (ms05-027) Unauthorized Access (Eventlog) 554/tcp - not identified 563/tcp - not identified 1025/tcp - RPC Windows Arbitrary Command Execution (ms05-051) 1026/tcp - RPC inetinfo.exe 1034/tcp - Blocked 1299/tcp - Blocked 1394/tcp - Blocked 1720/tcp - Blocked 1723/tcp - Blocked 1755/tcp - Blocked 2000/tcp - Blocked 3372/tcp - MsDTC 6666/tcp - Blocked 6667/tcp - Blocked 6668/tcp - Blocked 7643/tcp - TMeter 13266/tcp - Blocked 41234/tcp - Radmin Remote Control 44333/tcp - Kerio WinRoute

2

192.168.0.10 [xxx] Default.prf

15.12.2005 13:14 15.12.2005 13:17 0:02 / MaxPatrol 7.0 Build 1554

System Windows XP Professional ( Service Pack 2 ) 123/udp - NTP 135/tcp - RPC Windows 137/udp - NetBIOS-SSN 139/tcp - NetBIOS Weak Cryptography Unsecured Page File List of Resources LanManager and OS Scheduler Service Autorun Internet Explorer version IIS Version Windows Version Computer Name and Domain MAC Address 445/tcp - Microsoft DS 990/tcp - not identified 2002/tcp - PTsecurity Update 2005/tcp - Blocked

3

192.168.0.13 [KIREEV] Default.prf

15.12.2005 13:14 15.12.2005 13:16 0:02 / MaxPatrol 7.0 Build 1554

System ICMP Message Handling Denial of Service Windows 5.1 21/tcp - Blocked 135/tcp - Microsoft RPC DCOM Service Started 137/udp - NetBIOS-SSN 139/tcp - NetBIOS LanManager and OS Computer Name and Domain MAC Address 445/tcp - Microsoft DS Arbitrary Command Execution (ms05-043) Arbitrary Command Execution (ms05-027) 5000/tcp - HTTP Microsoft UPnP TCP helper

4

192.168.0.115 [MIKHAIL] Default.prf

15.12.2005 13:14 15.12.2005 13:22 0:08 / MaxPatrol 7.0 Build 1554

System Windows 5.1 21/tcp - not identified 137/udp - NetBIOS-SSN 139/tcp - NetBIOS List of Resources LanManager and OS Computer Name and Domain MAC Address 445/tcp - Microsoft DS

5

192.168.0.210 [SERVER] Default.prf

15.12.2005 13:14 15.12.2005 13:40 0:25 / MaxPatrol 7.0 Build 1554

System Windows 5.0 21/tcp - FTP FTP Bounce Attack Possible (firewall bypass) File and Directory List on an FTP Server Anonymous Access to an FTP Server 25/tcp - SMTP 42/tcp - WINS Arbitrary Command Execution (ms04-045) 53/tcp - DNS 53/udp - DNS 80/tcp - Not standard HTTP Directories with WRITE access found SQL Injection SQL Injection SQL Injection (blind) SQL Injection SQL Injection (blind) SQL Injection DoS Attack Possible Directories with BROWSE access found Cross Site Scripting (XSS) Cross Site Scripting (XSS) UTF-7 Cross Site Scripting (XSS) FrontPage Server Extensions Existing but Unreachable Directories found Directories Requiring Authorization (NTLM) Script Error (type mismatch) Scripts Cookies Published E-Mail Addresses External Links Listed Forms Listing Links with Referrer Links with Parameters FrontPage ShtmlScriptUrl information TRACK Method Allowed TRACE Method Allowed 88/tcp - Kerberos 111/udp - RPC Unix PortMapper 135/tcp - Microsoft RPC Arbitrary Command Execution DCOM Service Started 135/udp - Microsoft RPC 137/udp - NetBIOS-SSN 139/tcp - NetBIOS LanManager and OS MAC Address 389/tcp - LDAP Critical Information Acquisition 443/tcp - not identified 445/tcp - Microsoft DS 464/tcp - Kpasswd 593/tcp - HTTP RPC epmap Arbitrary Command Execution DCOM Service Started 636/tcp - Blocked 1026/tcp - RPC LSASS.exe 1029/tcp - HTTP RPC epmap 1040/tcp - RPC Windows 1047/tcp - RPC ismserv.exe 1055/tcp - RPC Windows 1062/tcp - RPC services.exe 1072/tcp - RPC dns.exe 1073/tcp - RPC ntfrs.exe 1120/tcp - RPC mqsvc.exe Arbitrary Command Execution (ms05-017) 1136/tcp - RPC inetinfo.exe 1138/tcp - RPC wins.exe 1755/tcp - Windows Media DoS Attack (Windows Media Services) 1801/tcp - not identified 2101/tcp - RPC mqsvc.exe Arbitrary Command Execution (ms05-017) 2103/tcp - RPC mqsvc.exe Arbitrary Command Execution (ms05-017) 2105/tcp - RPC mqsvc.exe Arbitrary Command Execution (ms05-017) 2107/tcp - RPC mqsvc.exe Arbitrary Command Execution (ms05-017) 3050/tcp - InterBase Default Password for User SYSDBA 3268/tcp - not identified 3269/tcp - Blocked 3306/tcp - MySQL 3372/tcp - MsDTC 4899/tcp - Radmin Remote Control 6666/tcp - not identified

Host 1

Initial name:	192.168.0.1	Scan start:	15.12.2005 13:14
Reverse name:	border	Scan end:	15.12.2005 13:29
IP address:	192.168.0.1	Scan time:	0:14
TTL:	200	Profile:	Default.prf
Max severity:	high	Scanner version:	7.0 Build 1554

 

1.1		System	192.168.0.1 [border]

 

1.1.1 Windows 5.0 192.168.0.1 [border], System Description Possible Operating System: Windows 5.0

 

1.1.2 Kerio WinRoute Firewall 192.168.0.1 [border], System Description Kerio WinRoute Firewall & Proxy Server is installed on this host.

 
 

1.2		Port 21/tcp - Blocked	192.168.0.1 [border]

Service breaks connection. Access for current IP may be denied. Unidentified Service. The default service for the port is: ftp

 
 

1.3		Port 25/tcp - Blocked	192.168.0.1 [border]

Service breaks connection. Access for current IP may be denied. Unidentified Service. The default service for the port is: smtp

 
 

1.4		Port 53/udp - DNS	192.168.0.1 [border]

BIND version : 9.2.3 Server Name determined by heuristic mechanisms. ISC BIND 9.2.x

 

1.4.1 Recursion 192.168.0.1 [border], 53/udp - DNS Description DNS supports request recursion. Under some conditions, this may results in DoS condition. DNS cache poisoning via BIND, by predictable query IDs. Solution Allow recursion for trusted addresses only. Links CVE (CVE-1999-0024) : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0024

 

1.4.2 Information 192.168.0.1 [border], 53/udp - DNS Description It is likely this service is not a true DNS, instead it is a mirror of the service installed on another computer in the same network.

 
 

1.5		Port 80/tcp - HTTP	192.168.0.1 [border]

Server name: Microsoft-IIS/5.0 - ASP.PT state : 200 (OK) current date/time : Thu, 15 Dec 2005 10:28:52 GMT content format : text/html content length : 1111 cache control : private The server name was confirmed by heuristic methods Microsoft IIS HTTP Server 5.x - 6.x

 

1.5.1 SQL Injection 192.168.0.1 [border], 80/tcp - HTTP Description SQL injection is an attack technique that can be used to extract, modify, add or delete information from database servers that are used by vulnerable web applications. SQL injection vulnerabilities are caused by an unsecured programming technique that allows client-supplied data to interfere with the syntax of SQL queries. SQL is a programming language that is used by applications to communicate with database systems. Request to perform attack: http://192.168.0.1/commentlink.asp?id=2'&hiddenname=hiddenvalue&button=GO1 GET /commentlink.asp?id=2'&hiddenname=hiddenvalue&button=GO1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> nt-Length: 358 Content-Type: text/html Cache-control: private <font face="Arial" size=2> <p>Microsoft OLE DB Provider for ODBC Drivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'id=2''.</font> <p> <font face="Arial" size=2>/commentlink.asp</font><font face="A <...> Solution Do not use this script or fix program code. Links http://www.securityfocus.com/infocus/1768 http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf http://www.nextgenss.com/papers/advanced_sql_injection.pdf

 

1.5.2 SQL Injection 192.168.0.1 [border], 80/tcp - HTTP Description SQL injection is an attack technique that can be used to extract, modify, add or delete information from database servers that are used by vulnerable web applications. SQL injection vulnerabilities are caused by an unsecured programming technique that allows client-supplied data to interfere with the syntax of SQL queries. SQL is a programming language that is used by applications to communicate with database systems. Request to perform attack: http://192.168.0.1/inject.asp?id=2'&hiddenname=hiddenvalue&button=GO1 GET /inject.asp?id=2'&hiddenname=hiddenvalue&button=GO1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> -Cookie: MyCookie2=SuperCookie2; path=/ Cache-control: private <font face="Arial" size=2> <p>Microsoft OLE DB Provider for ODBC Drivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'id=2''.</font> <p> <font face="Arial" size=2>/inject.asp</font><font face="Arial" <...> Solution Do not use this script or fix program code. Links http://www.securityfocus.com/infocus/1768 http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf http://www.nextgenss.com/papers/advanced_sql_injection.pdf

 

1.5.3 SQL Injection (blind) 192.168.0.1 [border], 80/tcp - HTTP Description SQL injection is an attack technique that can be used to extract, modify, add or delete information from database servers that are used by vulnerable web applications. SQL injection vulnerabilities are caused by an unsecured programming technique that allows client-supplied data to interfere with the syntax of SQL queries. SQL is a programming language that is used by applications to communicate with database systems. Request to perform attack: GET /injectblindstr.asp?id=[SQL]&button=GO1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Difference in results http://192.168.0.1/injectblindstr.asp?id=47900'+and+'1'='1&button=GO1 <...> <b>Result : </b> BMW 5 = 47900 <br> <br> <...> http://192.168.0.1/injectblindstr.asp?id=47900'+and+'1'='2&button=GO1 <...> <b>Result : </b> <br> <...> Solution Do not use this script or fix program code. Links http://www.securityfocus.com/infocus/1768 http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf http://www.nextgenss.com/papers/advanced_sql_injection.pdf

 

1.5.4 SQL Injection 192.168.0.1 [border], 80/tcp - HTTP Description SQL injection is an attack technique that can be used to extract, modify, add or delete information from database servers that are used by vulnerable web applications. SQL injection vulnerabilities are caused by an unsecured programming technique that allows client-supplied data to interfere with the syntax of SQL queries. SQL is a programming language that is used by applications to communicate with database systems. Request to perform attack: http://192.168.0.1/injectsession.asp?id=1'&button=GO1 GET /injectsession.asp?id=1'&button=GO1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> Set-Cookie: SessionCheck=true; path=/ Cache-control: private <font face="Arial" size=2> <p>Microsoft OLE DB Provider for ODBC Drivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'id=1''.</font> <p> <font face="Arial" size=2>/injectsession.asp</font><font face= <...> Solution Do not use this script or fix program code. Links http://www.securityfocus.com/infocus/1768 http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf http://www.nextgenss.com/papers/advanced_sql_injection.pdf

 

1.5.5 SQL Injection (blind) 192.168.0.1 [border], 80/tcp - HTTP Description SQL injection is an attack technique that can be used to extract, modify, add or delete information from database servers that are used by vulnerable web applications. SQL injection vulnerabilities are caused by an unsecured programming technique that allows client-supplied data to interfere with the syntax of SQL queries. SQL is a programming language that is used by applications to communicate with database systems. Request to perform attack: GET /injectblind.asp?id=[SQL]&button=GO1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Difference in results http://192.168.0.1/injectblind.asp?id=2-1+and+1=1&button=GO1 <...> <b>Result : </b> BMW 3 = 32500 <...> http://192.168.0.1/injectblind.asp?id=2+and+1=1&button=GO1 <...> <b>Result : </b> BMW 5 = 47900 <...> Solution Do not use this script or fix program code. Links http://www.securityfocus.com/infocus/1768 http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf http://www.nextgenss.com/papers/advanced_sql_injection.pdf

 

1.5.6 SQL Injection 192.168.0.1 [border], 80/tcp - HTTP Description SQL injection is an attack technique that can be used to extract, modify, add or delete information from database servers that are used by vulnerable web applications. SQL injection vulnerabilities are caused by an unsecured programming technique that allows client-supplied data to interfere with the syntax of SQL queries. SQL is a programming language that is used by applications to communicate with database systems. Request to perform attack: http://192.168.0.1/injectdot.asp?1' GET /injectdot.asp?1' HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> 4; path=/ Cache-control: private <p>For this value - 1'</p> <font face="Arial" size=2> <p>Microsoft OLE DB Provider for ODBC Drivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'id=1''.</font> <p> <font face="Arial" size=2>/injectdot.asp</font><font face="Ari <...> Solution Do not use this script or fix program code. Links http://www.securityfocus.com/infocus/1768 http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf http://www.nextgenss.com/papers/advanced_sql_injection.pdf

 

1.5.7 SQL Injection 192.168.0.1 [border], 80/tcp - HTTP Description SQL injection is an attack technique that can be used to extract, modify, add or delete information from database servers that are used by vulnerable web applications. SQL injection vulnerabilities are caused by an unsecured programming technique that allows client-supplied data to interfere with the syntax of SQL queries. SQL is a programming language that is used by applications to communicate with database systems. Request to perform attack: POST /injectpost.asp HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 7.0) PTsecurity Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Content-Type: application/x-www-form-urlencoded Content-Length: 15 id='&button=GO1 Test details <...> -Cookie: MyCookie5=SuperCookie5; path=/ Cache-control: private <font face="Arial" size=2> <p>Microsoft OLE DB Provider for ODBC Drivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'id=''.</font> <p> <font face="Arial" size=2>/injectpost.asp</font><font face="Ari <...> Solution Do not use this script or fix program code. Links http://www.securityfocus.com/infocus/1768 http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf http://www.nextgenss.com/papers/advanced_sql_injection.pdf

 

1.5.8 Directories with WRITE access found 192.168.0.1 [border], 80/tcp - HTTP Description Write permissions on a directory could allow a malicious user to place malicious code or scripts into a directory, run arbitrary commands or exploit the server for malicious purposes. Web pages or scripts with legitimate purposes could also be modified. Web pages could be hijacked. The following directories were found with write access (file name example: PTNSSxxxxx.txt) : /admin/ Solution Deny write access to the listed directories. Links http://www.pcmag.com/article2/0,1759,11525,00.asp

 

1.5.9 Unencrypted Data Transfering 192.168.0.1 [border], 80/tcp - HTTP Description The forms which can post Unencrypted Sensitive data to the server detected. Forms listing: GET /commentlink.asp HTTP/1.1 id=2&hiddenname=hiddenvalue&button=GO1 GET /inject.asp HTTP/1.1 id=2&hiddenname=hiddenvalue&button=GO1 POST /injectpost.asp HTTP/1.1 id=1&button=GO1 Protocol HTTP is not secure: all traffic (including passwords) between computers is not encrypted and can be intercepted using a "sniffer" program. Solution Use SSL 3.0 or TLS 1.0 protocol for transferring sensitive user information.

 

1.5.10 UTF-7 Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Request to perform attack: GET /xssutf1.asp?str=%2BADw%2Dscript%2BAD4%2Dalert(document%2Ecookie)%2BADsAPA%2D%2Fscript%2BAD4XSS@%2Bxscript-XSS%2B/xscript-.com&button=GO HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> <html> String : <b>+ADw-script+AD4-alert(document.cookie)+ADsAPA-/script+AD4XSS@+xscript-XSS+/xscript-.com</b> </html> <...> Solution Do not use this script or fix program code. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.11 UTF-7 Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Request to perform attack: GET /commentlink.asp?id=2XSS@%2Bxscript-XSS%2B/xscript-.com&hiddenname=hiddenvalue&button=GO1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> rivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'id=2XSS@+xscript-XSS+/xscript-.com'.</font> <p> <font face="Arial" size=2>/commentlink.asp</font><font face="Arial" size=2>, line 11</font> <...> Solution Do not use this script or fix program code. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.12 UTF-7 Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Request to perform attack: GET /inject.asp?id=2XSS@%2Bxscript-XSS%2B/xscript-.com&hiddenname=hiddenvalue&button=GO1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> rivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'id=2XSS@+xscript-XSS+/xscript-.com'.</font> <p> <font face="Arial" size=2>/inject.asp</font><font face="Arial" size=2>, line 15</font> <...> Solution Do not use this script or fix program code. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.13 UTF-7 Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Request to perform attack: GET /injectsession.asp?id=1XSS@%2Bxscript-XSS%2B/xscript-.com&button=GO1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> rivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'id=1XSS@+xscript-XSS+/xscript-.com'.</font> <p> <font face="Arial" size=2>/injectsession.asp</font><font face="Arial" size=2>, line 14</font> <...> Solution Do not use this script or fix program code. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.14 Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Request to perform attack: GET /xss.asp?str=exampleXSS@<xscript>XSS</xscript>.com&button=GO HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> <html> String : <b>exampleXSS@<xscript>XSS</xscript>.com</b> </html> <...> Solution Do not use this script or fix program code. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.15 Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Request to perform attack: GET /injectdot.asp?1XSS@<xscript>XSS</xscript>.com HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> <p>For this value - 1XSS@<xscript>XSS</xscript>.com</p> <font face="Arial" size=2> <p>Microsoft OLE DB Provider for ODBC Drivers</font> <font face="Arial" size=2>error '80040e14'</font> <p> <font face="Arial" size=2>[Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'id=1XSS@&l <...> Solution Do not use this script or fix program code. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.16 Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Request to perform attack: GET /xssreferer.asp?print=1 HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Referer: XSS@<xscript>XSS</xscript>.com Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> <html> URL of page : <a href='XSS@<xscript>XSS</xscript>.com'>XSS@<xscript>XSS</xscript>.com</a><br> <br> <b>Version for printing</b> <br> <h2>Some text for viewing and printing ...</h2> </html> <...> Solution Do not use this script or fix program code. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.17 Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Request to perform attack: GET /useragent.asp HTTP/1.1 Host: 192.168.0.1 User-Agent: <xscript>XSS</xscript> (compatible; <xscript>XSS</xscript>; <xscript>XSS</xscript>) <xscript>XSS</xscript> Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> <html> Your User-Agent: <xscript>XSS</xscript> (compatible; <xscript>XSS</xscript>; <xscript>XSS</xscript>) <xscript>XSS</xscript> </html> <...> Solution Do not use this script or fix program code. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.18 Stored Cross Site Scripting (XSS) 192.168.0.1 [border], 80/tcp - HTTP Description It is possible to perform Cross Site Scripting attack. Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message. Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on. After the data is collected by the web application, it creates an output page for the user containing the malicious data that was originally sent to it, but in a manner to make it appear as valid content from the website. Stored XSS attacks are those where the injected code is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc. The victim then retrieves the malicious script from the server when it requests the stored information. Request to check attack: http://192.168.0.1/storedxss.asp GET /storedxss.asp HTTP/1.1 Host: 192.168.0.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0) Cookie: SessionCheck=false; ASPSESSIONIDASDQQSBA=PIKNCIIDEHLBFDEPMGLKLBFO; MyCookie4=SuperCookie4; MyCookie3=SuperCookie3; MyCookie2=SuperCookie2; MyCookie=SuperCookies; Accept: text/html, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Test details <...> le' and '1'='1exampleexample" and "1"="1http://www.ptsecurity.com/codeinject/codeexampleexampleXSS@<xscript>XSS</xscript>.comexampleexample><!--#printenv --><example'><!--#printenv --><example"><!--#printenv -->< Content-Length: 0 HTTP/1.0 200 OK Content-Type: text/html Content-Length: 34 <html>Scanned by PTsecurity</html> example/boot.ini/boot.ini../../../../../../../../../boot.ini../.. <...> Solution Find a script through which performance of this attack is possible. Links http://www.cgisecurity.com/articles/xss-faq.shtml http://www.cert.org/advisories/CA-2000-02.html http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985 http://httpd.apache.org/info/css-security/apache_specific.html

 

1.5.19 Directories with BROWSE access found 192.168.0.1 [border], 80/tcp - HTTP Description Malicious users or attackers could use the information gained by browsing the directory structure of a website to refine an attack, locate unprotected directories or gain access directories and files that should not be publicly accessible. The structure of a websites directory could give a potential attacker insight into the type of web server, operating system or other software running on the system. Directories with browse access: /admin/ Solution Deny BROWSE access to all directories unless completely necessary.