Re: [W3af-users] Filename bruteforce with mod_negotiation

2009-06-02 Thread Andres Riancho
Stefano, On Tue, Jun 2, 2009 at 3:45 PM, Stefano Di Paola wrote: > Hi Andres, > good finding, but if you were subscribed to my blog > http://www.wisec.it/sectou.php >  you'd see that I wrote about it a couple of years ago: > http://www.wisec.it/sectou.php?id=4698ebdc59d15 hehe, nice! > Obviousl

Re: [W3af-users] Filename bruteforce with mod_negotiation

2009-06-02 Thread Stefano Di Paola
Hi Andres, good finding, but if you were subscribed to my blog http://www.wisec.it/sectou.php you'd see that I wrote about it a couple of years ago: http://www.wisec.it/sectou.php?id=4698ebdc59d15 Obviously I'm just kidding, every research is good research when you find it by yourself. BTW that f

Re: [W3af-users] Filename bruteforce with mod_negotiation

2009-06-02 Thread Matt Tesauro
Andres Riancho wrote: > Matt, > > On Tue, Jun 2, 2009 at 11:12 AM, Matt Tesauro wrote: >> Andres Riancho wrote: >>> List, >>> >>> Yesterday I found out a new trick, and I would like to share it with >>> you ;) >>> >>> HTTP Request >>> >>> >>> GET /backup HTTP/1.0 >>> Accept: foobar

Re: [W3af-users] Filename bruteforce with mod_negotiation

2009-06-02 Thread Andres Riancho
Matt, On Tue, Jun 2, 2009 at 11:12 AM, Matt Tesauro wrote: > Andres Riancho wrote: >> List, >> >>     Yesterday I found out a new trick, and I would like to share it with you >> ;) >> >> HTTP Request >> >> >> GET /backup HTTP/1.0 >> Accept: foobar/xyz >> User-Agent: w3af >> Host: 192.16

Re: [W3af-users] Filename bruteforce with mod_negotiation

2009-06-02 Thread Matt Tesauro
Andres Riancho wrote: > List, > > Yesterday I found out a new trick, and I would like to share it with you > ;) > > HTTP Request > > > GET /backup HTTP/1.0 > Accept: foobar/xyz > User-Agent: w3af > Host: 192.168.150.2 > Connection: Close > > HTTP Response > = > > HTTP/1.1

[W3af-users] Filename bruteforce with mod_negotiation

2009-06-02 Thread Andres Riancho
List, Yesterday I found out a new trick, and I would like to share it with you ;) HTTP Request GET /backup HTTP/1.0 Accept: foobar/xyz User-Agent: w3af Host: 192.168.150.2 Connection: Close HTTP Response = HTTP/1.1 406 Not Acceptable ... 406 Not Acceptable Not Acceptabl