On a recent pen test I encountered a wierd thing. I discovered a code red vulnerability on a web server using a custom scanner that I modified from source. The check for code red sends the GET /x.ida (220 A’s) =x HTTP/1.0\r\n\r\n and checks for the string “c0000005″ in the return.

So, my app shows:

(more…)