Re: ot? apache directory listing mysteries

2002-09-18 Thread Javier Fernández-Sanguino Peña
On Wed, Sep 18, 2002 at 04:33:25AM +0700, Jean Christophe ANDRÃ? wrote: Did you take a look at the Referer of those access? It might help you to track it down... That's just might be how they get them in the first place. If you buddy downloaded the file and then contacted google.com there

Re: ot? apache directory listing mysteries

2002-09-18 Thread Ralf Dreibrodt
Hi, Javier Fernández-Sanguino Peña wrote: On Wed, Sep 18, 2002 at 04:33:25AM +0700, Jean Christophe ANDRÃ? wrote: Did you take a look at the Referer of those access? It might help you to track it down... That's just might be how they get them in the first place. If you buddy

Re: ot? apache directory listing mysteries

2002-09-18 Thread Michael Renzmann
Hi. Javier Fernández-Sanguino Peña wrote: Did you take a look at the Referer of those access? It might help you to track it down... That's just might be how they get them in the first place. If you buddy downloaded the file and then contacted google.com there are chances that his browser sent

Re: ot? apache directory listing mysteries

2002-09-18 Thread Michael Renzmann
Hi. Ralf Dreibrodt wrote: at least netscape only sends a referer if i used a link. Right, that was one aspect that I forgot. what about the easiest questions: - did you used ssl or do you trust all the providers between your friend and your server? No SSL, but I don't trust any provider

Re: ot? apache directory listing mysteries

2002-09-18 Thread Javier Fernández-Sanguino Peña
On Wed, Sep 18, 2002 at 04:33:25AM +0700, Jean Christophe ANDRÃ? wrote: Did you take a look at the Referer of those access? It might help you to track it down... That's just might be how they get them in the first place. If you buddy downloaded the file and then contacted google.com there

Re: ot? apache directory listing mysteries

2002-09-18 Thread Ralf Dreibrodt
Hi, Javier Fernández-Sanguino Peña wrote: On Wed, Sep 18, 2002 at 04:33:25AM +0700, Jean Christophe ANDRÃ? wrote: Did you take a look at the Referer of those access? It might help you to track it down... That's just might be how they get them in the first place. If you buddy

Re: ot? apache directory listing mysteries

2002-09-18 Thread Michael Renzmann
Hi. Javier Fernández-Sanguino Peña wrote: Did you take a look at the Referer of those access? It might help you to track it down... That's just might be how they get them in the first place. If you buddy downloaded the file and then contacted google.com there are chances that his browser sent

Re: ot? apache directory listing mysteries

2002-09-18 Thread Michael Renzmann
Hi. Ralf Dreibrodt wrote: at least netscape only sends a referer if i used a link. Right, that was one aspect that I forgot. what about the easiest questions: - did you used ssl or do you trust all the providers between your friend and your server? No SSL, but I don't trust any provider

ot? apache directory listing mysteries

2002-09-17 Thread Michael Renzmann
Hi all. Maybe that's a little bit offtopic, but it is somehow related to security, so... :) I'm wondering if there is a way to get an directory listing from apache if there is an index.html available in that directory. The story behind that question: I put a large file on the webserver that

Re: ot? apache directory listing mysteries

2002-09-17 Thread Andrew Pimlott
On Tue, Sep 17, 2002 at 11:24:31PM +0200, Michael Renzmann wrote: I'm wondering if there is a way to get an directory listing from apache if there is an index.html available in that directory. Yes, if your apache isn't up-to-date.

Re: ot? apache directory listing mysteries

2002-09-17 Thread Jean Christophe ANDRÉ
Michael Renzmann écrivait : I'm wondering if there is a way to get an directory listing from apache if there is an index.html available in that directory. The story behind that question: I put a large file on the webserver that was intended for download for a friend. The only one I told

Re: ot? apache directory listing mysteries

2002-09-17 Thread Michael Renzmann
Hi. Jean Christophe ANDRÃ0/00 wrote: Are you using the VirtualHost capability on this server? Yes. If so, you should be aware of using some _default_:* entry to catch all access not using (or using a bad) hostname for VirtualHost. I just tried to forge a http request targetting at a

Re: ot? apache directory listing mysteries

2002-09-17 Thread Michael Renzmann
Hi. Andrew Pimlott wrote: Yes, if your apache isn't up-to-date. http://www.google.com/search?q=apache%20directory%20listing%20bug Is apache 1.3.26-0woody1 vulnerable to that? As far as I could see the answer should be no, right? Bye, Mike -- To UNSUBSCRIBE, email to [EMAIL PROTECTED]

ot? apache directory listing mysteries

2002-09-17 Thread Michael Renzmann
Hi all. Maybe that's a little bit offtopic, but it is somehow related to security, so... :) I'm wondering if there is a way to get an directory listing from apache if there is an index.html available in that directory. The story behind that question: I put a large file on the webserver

Re: ot? apache directory listing mysteries

2002-09-17 Thread Andrew Pimlott
On Tue, Sep 17, 2002 at 11:24:31PM +0200, Michael Renzmann wrote: I'm wondering if there is a way to get an directory listing from apache if there is an index.html available in that directory. Yes, if your apache isn't up-to-date.

Re: ot? apache directory listing mysteries

2002-09-17 Thread Jean Christophe ANDRÉ
Michael Renzmann écrivait : I'm wondering if there is a way to get an directory listing from apache if there is an index.html available in that directory. The story behind that question: I put a large file on the webserver that was intended for download for a friend. The only one I told

Re: ot? apache directory listing mysteries

2002-09-17 Thread Michael Renzmann
Hi. Jean Christophe ANDRÃ0/00 wrote: Are you using the VirtualHost capability on this server? Yes. If so, you should be aware of using some _default_:* entry to catch all access not using (or using a bad) hostname for VirtualHost. I just tried to forge a http request targetting at a

Re: ot? apache directory listing mysteries

2002-09-17 Thread Michael Renzmann
Hi. Andrew Pimlott wrote: Yes, if your apache isn't up-to-date. http://www.google.com/search?q=apache%20directory%20listing%20bug Is apache 1.3.26-0woody1 vulnerable to that? As far as I could see the answer should be no, right? Bye, Mike