Remote IIS patch level detection.

From: Haroon Meer (haroonat_private)
Date: Mon Aug 11 2003 - 09:12:32 PDT

Next message: Paul Johnston: "Plugin 10369 - dvwssr.dll backdoor"

Previous message: Renaud Deraison: "Re: Private plugin IDs"
In reply to: Paul Johnston: "Private plugin IDs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi..

[This has been around in perl scripts for a while now..]

IIS throws a different (predictable) Content-Length value based on its
applied Service pack level.

The attached .nasl makes a guess @ remote IIS sp-version based on the
returned Content Length. (This only tested on English versions..)
(Thanks muchly to robat_private for most of the signatures / initial
.pl)

/mh

======================================================================
Haroon Meer                                                         MH
SensePost Information Security                          +27 83786 6637
PGP : http://www.sensepost.com/pgp/haroon.txt     haroonat_private
======================================================================

TEXT/PLAIN attachment: iis_ver_check.nasl

Next message: Paul Johnston: "Plugin 10369 - dvwssr.dll backdoor"
Previous message: Renaud Deraison: "Re: Private plugin IDs"
In reply to: Paul Johnston: "Private plugin IDs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Aug 11 2003 - 08:59:09 PDT