OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: H D Moore (hdm_at_digitaloffense.net)
Date: Mon Oct 14 2002 - 17:42:15 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    I get billions of these things too, its part of some MSN groups/chat
    thing, essentially it takes requests the "alias" of the email address
    (daveimmunitysec.com => /instmsg/alias/dave). Might be fun to send back
    some looooong responses ;) My favorites are all the ones that originate
    from microsoft "tide" addresses... They send me some funny referrers from
    their intranet servers once in a while too.

    ---
    "Immunity also gets a lot of requests for /instmsg/alias/dave, which 
    doesn't exist. I'm curious what web client plugin causes this behavior. 
    And, I've noticed FrontPage makes PROPFIND, /_vti_bin/shtml.dll, and 
    other FrontPage-style requests. Somewhere here I smell an exploitable 
    client-side vulnerability."
    ---