full-disclosure-uk January 2010 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] iiscan results

Re: [Full-disclosure] iiscan results

From: Vincent Chao <zwell.nosec_at_nospam>
Date: Thu Jan 07 2010 - 01:49:57 GMT
To: "'mrx'" <mrx@propergander.org.uk>


Thank you for your analysis. It really helps me.

And I also found the PDF report mail to us is in Chinese, in the website of iiScan, however, to see the report of html or PDF format is English (of course can change to Chinese).

-----Original Message-----

From: Vincent Chao [mailto:zwell.nosec@gmail.com] Sent: Thursday, January 07, 2010 9:49 AM To: 'mrx'
Subject: RE: [Full-disclosure] iiscan results

Thank you for your analysis. It really helps me.

And I also found the PDF report mail to us is in Chinese, in the website of iiScan, however, to see the report of html or PDF format is English (of course can change to Chinese).

-----Original Message-----

From: full-disclosure-bounces@lists.grok.org.uk [mailto:full-disclosure-bounces@lists.grok.org.uk] On Behalf Of mrx Sent: Wednesday, January 06, 2010 8:45 PM To: full-disclosure@lists.grok.org.uk
Subject: [Full-disclosure] iiscan results

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

Well, this scanner managed to find a couple of low level vulnerabilities on my site which were missed by both Nikto and Nessus.

Two directories allowed a directory listing and a test.php file I created, an information disclosure vulnerability, was also detected. My dumb ass forgot to delete this "test.php" file after I finished testing the server.

Possible sensitive directories were also listed, however browsing to these directories returned 403 errors, blank pages or a wordpress logon prompt, which is what I expected.

So all in all this scanner seems to do it's job well. At least for a LAMP server running wordpress

Of course I have addressed the vulnerabilities reported.

My command of the Chinese language is limited to zero, so I cannot understand the pdf report emailed to me nor the information within the web based report. Hopefully the developers will address this language problem.

regards
mrx

iQEVAwUBS0SF07Ivn8UFHWSmAQJa6Af/SFXSbRfQHm79l+E8PKmlOo7Bs4mfk54Q SigZdLS6v0M4BXvUp3io7TvOBR7CD4p6JxCZLE9dHHrRIW9YMHqYxoPe/PY9CQGr G2yaovGV+nk33dcHJaEgI3LG12Ww3131dfpHX6FgZty8aEIeb16BBpKWPe6A2TUG 9FfPq6rL7DzO55rp1vbljIC2OToQN815LA6lOtYWDbbhzPVaMXARDK0r491mXX+O grgEchWlTwP4gXEgB299O6gCZCUaMlxYuWdKh43Rrnqm7l5aIG+fuJkomuy98kX3 nbjsem9AFwQqhGIoWxGlR5a1TC/SQCqgc38XufT4gr7RV+rKuoD3BA== =6cbx
-----END PGP SIGNATURE-----



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/