Re: pen testing iis

From: Enrique A. Sanchez Montellano (enrique.sanchezat_private)
Date: Mon Jun 25 2001 - 00:35:35 PDT

  • Next message: Venkat RK Reddy: "finding out all the files on a webserver's directory"

    If you cannot tftp or ftp (happens) just echo the debug equivalent .... 
    =) ... long live debug since its on all windows machines ... then just 
    compile it on the server and VOILA!!!
    
    debug is your friend!!!
    
    Enrique A. Sanchez Montellano
    
    suntzu wrote:
    
    > If you have control of cmd.exe in the web root directory ( via unicode
    > ) you can usually make nt tftp a file to the server of where you nc.exe my
    > live...
    > 
    > just a suggestion...
    > 
    > 
    > -suntzu 
    > 
    > On Mon, 18 Jun 2001, ExpLiciT wrote:
    > 
    >> Greetings.
    >> I am pen-testing IIS 5 [no hotfixes] running in WinNT 4.0 with no fixes.  At
    >> this point I want to upload a file to the box [nc.exe] and then I will
    >> definately have the box.  How can I go about doing this?
    >> 
    >> Thanks
    >> 
    >> --ExpLiciT
    >> 	'Firewalls are speed bumps not brick walls'
    >> 
    >> 
    
    
    --------------------------------------------------------------------------------------
    
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service
    For more information on SecurityFocus' SIA service which automatically alerts you to 
    the latest security vulnerabilities please see:
    
    https://alerts.securityfocus.com/
    



    This archive was generated by hypermail 2b30 : Wed Jun 27 2001 - 12:00:40 PDT