Re: Website "Scanner"

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 08 Jan 2003 14:21:16 -0800 sullo@cirt.net wrote:

>2) take all the files an mix them with all the directories from

Yes, this is more the idea. We are not looking for vulns. or xploits, rather trying to intelligently "guess" what else is in that directory. Either through dictionary use or other use. For example the following is publicly accessible:

http://www.microsoft.com/new_products/bigwinner2003.html

We want to find out what else might be in "new_products" so we plug in say the words "big" "winner" "2003" and let our dictionary spin:

 biggerwinner2003.html - nothing
 bigloser2002.html - hit

etc.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Combining the dictionary and words from a specific site or files visible publicly, we try to guess the names of whatever else might be in that directory.

You can do this manually with small time sites and obvious file names e.g. index1.html...index2.html etc. Even annualreport2002.html is visible, try annualreport.2003.html

You can guess and hit on files that are not intended for public consumption.

If it can be automated with user input for obvious keywords, you probably could strike many interesting and sensitive files in the directory.

-----BEGIN PGP SIGNATURE-----
Version: Hush 2.2 (Java)
Note: This signature can be verified at https://www.hushtools.com/verify

wnUEARECADUFAj4csi8uHGJhY2tlZC51cC5ieS4yMDQ4LmJpdC5lbmNyeXB0aW9uQGh1 c2htYWlsLmNvbQAKCRDEHQGvBp4eRGE4AJ4joBLhRlZYcBX7sxnOmgYPfbtYOgCfUFun Y0PA+csb++5g+pM+c/0Bkok=
=SFPk
-----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2

Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427 Received on Wed Jan 8 18:52:49 2003