From: Marc Bown (marcsjointgmail.com)
Date: Mon Jun 13 2005 - 13:59:40 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi All,

Was using Spike on a large-ish job today and it worked its magic and
came up with a number of XSS and ODBC type errors for me to check out
(I was using the argscan function).

My understanding of the argscan function (which is based purely on
reading the source) is that successfull exploitation results in a log
message (in the log frame of the GUI) and also results in the relevant
request object being "stored" for later reference.

Unfortunately in this case I can't see that the objects have been
stored - they certainly don't appear in the GUI or on the filesystem.
Spike didn't throw any Python exceptions when storing the files - so
where are they? Some inspection of Dave's path functions in
daveutil.py has only served to hurt my brain (this however says more
about me than about the code).

Any ideas? FYI: I'm running OSX Tiger with Python 2.3.5.

Also - In my foolishness I didn't redirect the output of the console
in which spkproxy.py was running, so all of that output is gone - is
this saved anywhere by default or should I just remember to stick it
into a file from now on?

Thanks for a great tool Dave - this is the first problem I've ever had.

Marc
_______________________________________________
Spike mailing list
Spikelists.immunitysec.com
https://lists.immunitysec.com/mailman/listinfo/spike

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]