2010-05-21 │nginx文件类型错误解析漏洞+IIS源码泄露及文件类型解析错误
作者:逍遥乾坤 | 发表时间:2010-05-21 21:10:15 | 分类:网络随笔 | 阅读:11789
| 评论:4722
事情起因是今天在群里的一个朋友说当当网被黑了,我查看了一下貌似是t00ls的人集体“路过”的。
不过我大致的看了一下了解到时论坛的问题,跟主站没有任何关系,后来群里又有人说是nginx的事。
随后看到80sec公布了其nginx的漏洞,感觉这个漏洞的范围还是比较广的,而且利用方法较为简单,并且后果严重。
详细的信息我就不转载了,大家可以登录80sec查看:http://www.80sec.com/nginx-securit.html
我个人感觉,利用这个漏洞拿下的站应该都是大服务器,呵呵,反正应该是比较重要的,毕竟一般的不用nginx。
貌似现在也已经有牛人写出了扫描器了。只是暂时还没有几个人拿到呢。
漏洞的发现者是第一波测试,核心圈里第二波分享,我还算比较早的,估计也要是第三波了,虽然说出来没几个人知道,不过还是感觉自己out了。
今天80sec在半年都没有更新的情况下突然一天发布了两个漏洞,感觉挺吃惊的!
IIS源码泄露及文件类型解析错误,这个洞貌似以前就听说过,我看80sec上也没有过多的说明漏洞的形成原因和利用方法,感觉不太好,既然公布了,还是原创,就应该写的详细一些,否则有什么用呢?
网络一天比一天复杂,安全一天比一天严重!
不过我大致的看了一下了解到时论坛的问题,跟主站没有任何关系,后来群里又有人说是nginx的事。
随后看到80sec公布了其nginx的漏洞,感觉这个漏洞的范围还是比较广的,而且利用方法较为简单,并且后果严重。
详细的信息我就不转载了,大家可以登录80sec查看:http://www.80sec.com/nginx-securit.html
我个人感觉,利用这个漏洞拿下的站应该都是大服务器,呵呵,反正应该是比较重要的,毕竟一般的不用nginx。
貌似现在也已经有牛人写出了扫描器了。只是暂时还没有几个人拿到呢。
漏洞的发现者是第一波测试,核心圈里第二波分享,我还算比较早的,估计也要是第三波了,虽然说出来没几个人知道,不过还是感觉自己out了。
今天80sec在半年都没有更新的情况下突然一天发布了两个漏洞,感觉挺吃惊的!
IIS源码泄露及文件类型解析错误,这个洞貌似以前就听说过,我看80sec上也没有过多的说明漏洞的形成原因和利用方法,感觉不太好,既然公布了,还是原创,就应该写的详细一些,否则有什么用呢?
网络一天比一天复杂,安全一天比一天严重!
mirkurortov http://www.mirkurortov.com/(2023-09-24 01:18:06)
snapitf http://www.snapitf.com/(2023-09-19 20:03:58)
tokensci http://www.tokensci.com/(2023-08-28 17:54:06)
emrefirin http://www.emrefirin.com/(2023-08-21 09:28:37)
bibuthomas http://www.bibuthomas.com/(2023-08-15 07:43:16)
gaianation http://www.gaianation.net/(2023-08-08 08:41:22)
makersfinds http://www.makersfinds.com/(2023-08-02 14:41:06)
transorgs http://www.transorgs.com/(2023-07-27 21:06:27)
declaromag http://www.declaromag.com/(2023-07-20 21:39:46)
balazskoren http://www.balazskoren.com/(2023-07-07 12:40:48)
lacarspotting http://www.lacarspotting.com/(2023-07-05 09:00:21)
hairulafiz http://www.hairulafiz.com/(2023-05-30 00:21:18)
caspigas http://www.caspigas.com/(2023-05-23 23:43:45)
thestmc http://www.thestmc.com/(2023-05-18 04:15:02)
webilla https://www.webilla.net/(2023-05-14 07:13:16)
jrtrojans https://www.jrtrojans.net/(2023-05-14 07:13:16)
submitwebsites https://www.submitwebsites.net/(2023-05-14 07:13:15)
fluteringtone https://www.fluteringtone.net/(2023-05-14 07:12:52)
withintemptation https://www.withintemptation.net/(2023-05-09 06:23:35)
bmesummit https://www.bmesummit.net/(2023-05-09 06:23:34)
stevierock https://www.stevierock.net/(2023-05-09 06:23:34)
jimmynapier https://www.jimmynapier.net/(2023-05-09 06:23:11)
crosslinkfoam https://www.crosslinkfoam.net/(2023-04-28 14:48:19)
augustahouse https://www.augustahouse.net/(2023-04-28 14:48:18)
mithriltelecom https://www.mithriltelecom.net/(2023-04-28 14:47:56)
kartalmeirim https://www.kartalmeirim.net/(2023-04-24 10:49:54)
cindybass https://www.cindybass.net/(2023-04-24 10:49:53)
outcastdigital https://www.outcastdigital.net/(2023-04-24 10:49:52)
myschoolinfo https://www.myschoolinfo.net/(2023-04-24 10:49:50)
bestpricemoving https://www.bestpricemoving.net/(2023-04-24 10:49:19)
paperrival https://www.paperrival.net/(2023-04-17 10:02:53)
tommydalton https://www.tommydalton.net/(2023-04-17 10:02:52)
webilla https://www.webilla.net/(2023-04-17 10:02:52)
taylorproductions https://www.taylorproductions.net/(2023-04-17 10:02:29)
passatturkiye https://www.passatturkiye.net/(2023-04-07 08:34:23)
jkhushaldas https://www.jkhushaldas.net/(2023-04-07 08:34:22)
findamarket https://www.findamarket.net/(2023-04-07 08:34:22)
gestiondenegocios https://www.gestiondenegocios.net/(2023-04-07 08:34:21)
fandomfam https://www.fandomfam.net/(2023-03-30 15:55:49)
bmesummit https://www.bmesummit.net/(2023-03-30 15:55:48)
enkitech https://www.enkitech.net/(2023-03-30 15:55:48)
drachenshop https://www.drachenshop.net/(2023-03-30 15:55:47)
westottawatest https://www.westottawatest.net/(2023-03-30 15:55:24)
depotwines https://www.depotwines.net/(2023-03-25 00:01:22)
elenacheney https://www.elenacheney.net/(2023-03-25 00:01:21)
ziemiaobiecana https://www.ziemiaobiecana.net/(2023-03-25 00:01:21)
booyahsmomma https://www.booyahsmomma.net/(2023-03-25 00:01:20)
wideodomofony https://www.wideodomofony.net/(2023-03-25 00:00:58)
windsorknolls https://www.windsorknolls.net/(2023-03-13 16:16:09)
crosslinkfoam https://www.crosslinkfoam.net/(2023-03-13 16:16:08)
knowledgecookie https://www.knowledgecookie.net/(2023-03-13 16:16:08)
loriallen https://www.loriallen.net/(2023-03-13 16:15:45)
marocindeed http://www.marocindeed.com/(2023-03-12 03:39:16)
muskegonjobsnow https://www.muskegonjobsnow.net/(2023-03-09 10:30:32)
cayzland https://www.cayzland.net/(2023-03-09 10:30:31)
scrompany https://www.scrompany.net/(2023-03-09 10:30:30)
ziemiaobiecana https://www.ziemiaobiecana.net/(2023-03-09 10:30:29)
partysanhomebase https://www.partysanhomebase.net/(2023-03-09 10:30:07)
islafuerteventura https://www.islafuerteventura.net/(2023-03-06 09:06:34)
stjohnsforkids https://www.stjohnsforkids.net/(2023-03-06 09:06:33)
scrompany https://www.scrompany.net/(2023-03-06 09:06:11)
luxiform https://www.luxiform.net/(2023-02-28 03:06:28)
sanifix https://www.sanifix.net/(2023-02-28 03:06:27)
bmesummit https://www.bmesummit.net/(2023-02-28 03:06:03)
tiopepi http://www.tiopepi.net/(2023-02-23 01:44:23)
sellergyllc http://www.sellergyllc.com/(2023-02-15 22:24:15)
efornak http://www.efornak.com/(2023-02-14 11:19:44)
execedits http://www.execedits.net/(2023-02-06 19:10:47)
workschon http://www.workschon.com/(2023-01-27 15:41:28)
rigwares http://www.rigwares.com/(2023-01-19 09:06:41)
nikknack http://www.nikknack.com/(2023-01-13 08:21:30)
resiliens https://www.resiliens.net/(2023-01-07 08:59:31)
finharmoni https://www.finharmoni.net/(2023-01-07 08:59:31)
yoursuperchef https://www.yoursuperchef.net/(2023-01-07 08:59:30)
accessibleberlin https://www.accessibleberlin.net/(2023-01-07 08:58:59)
peruconelmundo https://www.peruconelmundo.net/(2023-01-05 18:53:11)
iotnorway https://www.iotnorway.net/(2023-01-05 18:53:11)
matrxdoctors https://www.matrxdoctors.net/(2023-01-05 18:53:10)
ontidental https://www.ontidental.net/(2023-01-05 18:53:10)
hotelvitality https://www.hotelvitality.net/(2023-01-05 18:52:39)
trovic https://www.trovic.net/(2023-01-04 01:35:50)
brodheim https://www.brodheim.net/(2023-01-04 01:35:49)
judgeforhire https://www.judgeforhire.net/(2023-01-04 01:35:27)
dancegram https://www.dancegram.net/(2023-01-02 07:17:30)
derekessary https://www.derekessary.net/(2023-01-02 07:17:29)
sigmaturf https://www.sigmaturf.net/(2023-01-02 07:17:29)
carnetdeconducir https://www.carnetdeconducir.net/(2023-01-02 07:16:48)
realworldview https://www.realworldview.net/(2022-12-30 09:58:13)
helppier https://www.helppier.net/(2022-12-30 09:58:12)
theonebaja https://www.theonebaja.net/(2022-12-30 09:58:12)
telque https://www.telque.net/(2022-12-30 09:58:11)
wanderersguild https://www.wanderersguild.net/(2022-12-30 09:57:40)
batiservis http://www.batiservis.net/(2022-12-25 06:51:27)
resiliens https://www.resiliens.net/(2022-12-19 13:09:25)
ariumhamptonlake https://www.ariumhamptonlake.net/(2022-12-19 13:09:25)
peruconelmundo https://www.peruconelmundo.net/(2022-12-19 13:09:24)
deliveryslip https://www.deliveryslip.net/(2022-12-19 13:08:57)
theragnostic https://www.theragnostic.net/(2022-12-17 10:56:22)
atmosphile https://www.atmosphile.net/(2022-12-17 10:56:21)
rucibuzz https://www.rucibuzz.net/(2022-12-17 10:56:21)
branchandvines https://www.branchandvines.net/(2022-12-17 10:56:20)
probabilites https://www.probabilites.net/(2022-12-17 10:55:48)
sbtribalfarms http://www.sbtribalfarms.com/(2022-11-13 19:16:38)
edcialistop http://www.edcialistop.net/(2022-11-09 10:40:36)
fundamitre http://www.fundamitre.net/(2022-10-29 15:36:56)
felsefegram http://www.felsefegram.net/(2022-10-21 19:55:46)
marenahomes http://www.marenahomes.com/(2022-10-19 11:06:34)
fayamatt http://www.fayamatt.com/(2022-10-10 19:39:16)
daphucco https://www.daphucco.com/(2022-09-24 08:58:33)
vybzmedia https://www.vybzmedia.com/(2022-09-24 08:58:32)
sikaikhabar https://www.sikaikhabar.com/(2022-09-24 08:58:31)
valtercasini https://www.valtercasini.com/(2022-09-24 08:58:00)
freeskypeout https://www.freeskypeout.com/(2022-09-21 14:29:54)
aselresorthotel https://www.aselresorthotel.com/(2022-09-21 14:29:53)
nekojyujisya https://www.nekojyujisya.com/(2022-09-21 14:29:50)
blogchips https://www.blogchips.com/(2022-09-21 14:29:27)
saulamchic http://www.saulamchic.com/(2022-09-20 13:36:54)
crossfitolathe https://www.crossfitolathe.com/(2022-09-19 16:26:06)
lehuotao https://www.lehuotao.com/(2022-09-19 16:26:05)
atrapaniapp https://www.atrapaniapp.com/(2022-09-19 16:26:05)
instepnews https://www.instepnews.com/(2022-09-19 16:25:33)
jessefarr https://www.jessefarr.com/(2022-09-15 20:44:59)
coffeecertified https://www.coffeecertified.com/(2022-09-12 15:58:32)
crossfitolathe https://www.crossfitolathe.com/(2022-09-12 15:58:31)
boxerpuppiessale https://www.boxerpuppiessale.com/(2022-09-12 15:58:30)
tidyweekender https://www.tidyweekender.com/(2022-09-12 15:58:29)
ukcopiersonline https://www.ukcopiersonline.com/(2022-09-10 13:17:08)
bestentnews https://www.bestentnews.com/(2022-09-10 13:17:07)
sajberblomma https://www.sajberblomma.com/(2022-09-10 13:17:07)
mrwhiterabbit https://www.mrwhiterabbit.com/(2022-09-10 13:17:06)
imwrks https://www.imwrks.com/(2022-09-10 13:16:34)
piarnet http://www.piarnet.com/(2022-09-08 03:36:15)
aeryhwryjdm https://www.aeryhwryjdm.com/(2022-09-05 23:21:35)
signplusplus https://www.signplusplus.com/(2022-09-05 23:21:35)
theboardwalknews https://www.theboardwalknews.com/(2022-09-05 23:21:33)
janesgallerie https://www.janesgallerie.com/(2022-09-05 23:20:58)
peccanada https://www.peccanada.com/(2022-09-01 01:50:27)
kuwaitwebinfo https://www.kuwaitwebinfo.com/(2022-09-01 01:50:25)
missheadtotoe https://www.missheadtotoe.com/(2022-09-01 01:50:24)
berhaninjection https://www.berhaninjection.com/(2022-09-01 01:49:52)
vamadisz http://www.vamadisz.com/(2022-08-31 05:04:03)
dinerwaresf https://www.dinerwaresf.com/(2022-08-29 06:01:43)
freephphostonline https://www.freephphostonline.com/(2022-08-29 06:01:42)
bettayourself https://www.bettayourself.com/(2022-08-29 06:01:10)
tobiconnors http://www.tobiconnors.com/(2022-08-13 07:53:17)
milumba http://www.milumba.com/(2022-07-12 05:04:41)
belljen http://www.belljen.net/(2022-07-02 09:01:02)
flatlandip http://www.flatlandip.com/(2022-06-30 03:19:18)
nnz-home http://www.nnz-home.net/(2022-06-18 02:58:04)
blminter http://www.blminter.net/(2022-05-04 08:08:45)
bibliowine http://www.bibliowine.com/(2022-04-22 15:05:32)
jazmarketingllc https://demo.jazmarketingllc.com/(2022-04-17 02:55:22)
innovafeline https://demo.innovafeline.com/(2022-04-17 02:55:22)
kacadodl https://demo.kacadodl.com/(2022-04-17 02:55:21)
eschoolman https://demo.eschoolman.com/(2022-04-17 02:54:57)
saponions http://www.saponions.com/(2022-04-16 09:56:43)
nevaktar https://www.nevaktar.com/(2022-04-15 20:20:20)
texhort https://www.texhort.com/(2022-04-15 20:20:18)
dubai-developer https://www.dubai-developer.com/(2022-04-15 20:20:17)
lottoguesses https://www.lottoguesses.com/(2022-04-15 20:20:12)
sureshbursu http://www.sureshbursu.com/(2022-04-09 08:08:45)
brownfont https://www.brownfont.com/(2022-04-05 03:57:16)
artemissuit https://www.artemissuit.com/(2022-04-05 03:57:15)
saharbeautytips https://www.saharbeautytips.com/(2022-04-05 03:57:15)
swejan https://www.swejan.com/(2022-04-05 03:56:51)
tzpoker http://www.tzpoker.com/(2022-03-11 10:07:00)
fabelkart https://demo.fabelkart.com/(2022-03-09 12:24:34)
eachenhome https://demo.eachenhome.com/(2022-03-09 12:24:33)
n-norton https://demo.n-norton.com/(2022-03-09 12:24:33)
basignon https://demo.basignon.com/(2022-03-09 12:24:32)
srsearthing https://demo.srsearthing.com/(2022-03-09 12:24:10)
kaisarbandar https://demo.kaisarbandar.com/(2022-03-09 05:41:04)
theopenmark https://demo.theopenmark.com/(2022-03-09 05:41:04)
abaa-salon https://demo.abaa-salon.com/(2022-03-09 05:41:03)
cerocreativos https://demo.cerocreativos.com/(2022-03-09 05:41:02)
n-norton https://demo.n-norton.com/(2022-03-09 05:40:39)
saemmit http://www.saemmit.com/(2022-03-08 23:04:26)
codexivetech https://demo.codexivetech.com/(2022-02-27 00:39:51)
mihaipascal https://demo.mihaipascal.com/(2022-02-27 00:39:50)
ahuela https://demo.ahuela.com/(2022-02-27 00:39:28)
hbstimes https://demo.hbstimes.com/(2022-02-23 18:52:09)
younglifenorthdekalb https://demo.younglifenorthdekalb.com/(2022-02-23 18:52:09)
ejobstore https://demo.ejobstore.com/(2022-02-23 18:52:08)
gorselzeka https://demo.gorselzeka.com/(2022-02-23 18:51:46)
nexiasjokergaming https://www.nexiasjokergaming.com/(2022-02-20 20:06:12)
roadrunneremaill https://www.roadrunneremaill.com/(2022-02-20 20:06:11)
ieltstoabroad https://www.ieltstoabroad.com/(2022-02-20 20:06:11)
justoneknow https://www.justoneknow.com/(2022-02-20 20:06:10)
dooduangmanman88 https://www.dooduangmanman88.com/(2022-02-20 20:05:46)
be-timeless-hair https://www.be-timeless-hair.com/(2022-02-20 00:37:02)
homestorymarket https://www.homestorymarket.com/(2022-02-20 00:37:01)
quickloan-24 https://www.quickloan-24.com/(2022-02-20 00:36:52)
seninandroidin https://www.seninandroidin.com/(2022-02-20 00:36:51)
mydayinlosangeles https://www.mydayinlosangeles.com/(2022-02-20 00:36:50)
mysummervilleford https://www.mysummervilleford.com/(2022-02-15 02:46:06)
getesionow https://www.getesionow.com/(2022-02-15 02:46:05)
uvabrand https://www.uvabrand.com/(2022-02-15 02:46:04)
simmonslabtop https://www.simmonslabtop.com/(2022-02-15 02:45:42)
rightwaysport https://demo.rightwaysport.com/(2022-02-11 18:15:41)
villahomeinteriors https://demo.villahomeinteriors.com/(2022-02-11 18:15:40)
enduratexuk https://demo.enduratexuk.com/(2022-02-11 18:15:40)
sigsalesinc https://demo.sigsalesinc.com/(2022-02-11 18:15:18)
draculovely https://www.draculovely.xyz/(2022-02-10 09:22:29)
liseliresimarsivi https://www.liseliresimarsivi.xyz/(2022-02-10 09:22:27)
tiancaic https://www.tiancaic.xyz/(2022-02-10 09:22:26)
buy-atarax https://www.buy-atarax.xyz/(2022-02-10 09:22:26)
levelxxx https://www.levelxxx.xyz/(2022-02-10 09:22:04)
temasyazilim https://www.temasyazilim.com/(2022-02-10 02:26:41)
buy-stealth-account https://www.buy-stealth-account.com/(2022-02-10 02:26:40)
katalog-nasa https://www.katalog-nasa.com/(2022-02-10 02:26:39)
tigerjed https://www.tigerjed.com/(2022-02-10 02:26:39)
kiddreamisdream https://www.kiddreamisdream.com/(2022-02-10 02:26:17)
desertaerie https://www.desertaerie.com/(2022-02-04 08:38:16)
florusbrazil https://www.florusbrazil.com/(2022-02-04 08:38:16)
luststyle https://www.luststyle.com/(2022-02-04 08:37:53)
thestorypole https://www.thestorypole.com/(2022-02-01 07:41:04)
enduratexuk https://www.enduratexuk.com/(2022-02-01 07:41:03)
tuffease https://www.tuffease.com/(2022-02-01 07:40:41)
celebum http://www.celebum.com/(2022-01-25 08:34:54)
evrimindustry https://www.evrimindustry.com/(2022-01-22 02:48:42)
amanahrasulullah https://www.amanahrasulullah.com/(2022-01-22 02:48:42)
ufundogs https://www.ufundogs.com/(2022-01-22 02:48:41)
teknobam https://www.teknobam.com/(2022-01-22 02:48:19)
ischool-bus https://www.ischool-bus.com/(2022-01-15 01:56:58)
tgiinfo https://www.tgiinfo.com/(2022-01-15 01:56:57)
jxjtncw https://www.jxjtncw.com/(2022-01-15 01:56:57)
curatorstl https://www.curatorstl.com/(2022-01-09 13:23:31)
malatyaneykursu https://www.malatyaneykursu.com/(2022-01-09 13:23:31)
arbogabyggtjanst https://www.arbogabyggtjanst.com/(2022-01-09 13:23:30)
tbaexploration https://www.tbaexploration.com/(2022-01-09 13:23:08)
pergolasense https://www.pergolasense.com/(2022-01-08 17:38:58)
thmeylike https://www.thmeylike.com/(2022-01-08 17:38:57)
sixxtees https://www.sixxtees.com/(2022-01-01 17:28:13)
lhroot https://www.lhroot.com/(2022-01-01 17:28:13)
stene-consulting https://www.stene-consulting.com/(2022-01-01 17:28:12)
vireeshbasavaraj https://www.vireeshbasavaraj.com/(2022-01-01 17:28:12)
curaakademiet https://www.curaakademiet.com/(2022-01-01 17:27:50)
lutaniccreations https://www.lutaniccreations.com/(2021-12-30 04:51:19)
reine-spa https://www.reine-spa.com/(2021-12-30 04:50:55)
debagliano http://www.debagliano.com/(2021-12-28 17:17:41)
desertaerie https://www.desertaerie.com/(2021-12-28 13:00:54)
austinaame https://www.austinaame.com/(2021-12-28 13:00:53)
misterphonie https://www.misterphonie.com/(2021-12-28 13:00:53)
kelleyyachtsales https://www.kelleyyachtsales.com/(2021-12-28 13:00:30)
spurtwelt http://www.spurtwelt.com/(2021-12-19 19:26:13)
thbogota https://www.thbogota.com/(2021-11-20 06:09:19)
gocstech https://www.gocstech.com/(2021-11-20 06:09:19)
oientalrugauction https://www.oientalrugauction.com/(2021-11-20 06:09:18)
loslunasdental https://www.loslunasdental.com/(2021-11-20 06:09:17)
kokomocanoe https://www.kokomocanoe.com/(2021-11-20 06:08:54)
paulbennison http://www.paulbennison.net/(2021-11-07 23:23:58)
eligro http://www.eligro.net/(2021-11-07 23:23:58)
ornyadams http://www.ornyadams.net/(2021-11-07 23:23:56)
midsland http://www.midsland.net/(2021-11-07 23:23:34)
czaterianie http://www.czaterianie.com/(2021-11-06 18:09:08)