Developer's Guide to Web Application Security

■

Based on the results of the scans and the information discovered upon con-

necting with the target’s HTTP service, we know a number of elements

that will aid us in our attack plan:

■

The target system OS Microsoft 2000 Server

■

The target system services FTP, telnet, SSH, Finger, HTTP, IMAP

■

The Web server Microsoft IIS v5.0

With these three elements in mind, we can consult our own personal database of

vulnerabilities or similar databases on the Web such as the Common Vulnerabilities

and Exposures site (http://cve.mitre.org/cve), the vulnerability database and Bugtraq

archives at SecurityFocus (www.securityfocus.com), or the listings of exploits avail- ...