False positives due to Dual Behavior of ports

From: Noam Rathaus (noamrat_private)
Date: Mon May 05 2003 - 10:48:08 PDT

  • Next message: Renaud Deraison: "Re: False positives due to Dual Behavior of ports"

    Hi,
    
    I have seen the following in the wild, connecting to port X without the SSL
    environment will return:
    HTTP/1.0 200 Bad Request
    Server: Custom/0.01
    Date: Wed, 1 Jan 2003 19:43:50 GMT
    Content-type: text/html
    Connection: close
    
    <h1>Error - Bad Request</h1>
    <pre>This web server is running in SSL mode. Try the URL <a
    href='https://host:X/'>https://custom:X/> instead.<br></pre>
    
    And connecting with SSL, of course returns a different response.
    
    The problem is caused by the no404.nasl, as it appears to confuse the results of
    the same port X for the two different supports (with SSL, and without SSL).
    
    I am not sure if this has been seen before, or if anyone can come out with a
    solution to solve this issue.
    
    Thanks
    Noam Rathaus
    CTO
    Beyond Security Ltd
    http://www.SecurITeam.com
    http://www.BeyondSecurity.com
    



    This archive was generated by hypermail 2b30 : Mon May 05 2003 - 09:50:07 PDT