[EMAIL PROTECTED] writes:
> I'm thinking of more or less the same functionality as (iirc) queso,
> which will guess a machine's OS from looking at responses to various
> interesting network packets.
There are only a few web servers in common use (Apache, IIS and
iPlanet (formerly Netscape) and Zeus.
I suppose you could start by constructing a few URLs which are likely
to incite the servers into different responses and testing those
against these servers in their default configurations.
Obvious things are is the response 200 or 404 for requests for
default.htm or index.html? It's probably best to concentration on
differences which are usually configuration independent.
Since Netcraft go around the net doing this stuff to others you could
start there and give them a taste of their own medicine by sending
those sort of URL requests beloved of CERT advisories like
'HEAD www.netcraft.com/../'
(which seems to give 200 on IIS and 400 on Apache).
Some things seem a dead giveaway to OS (or at least file system) like
'HEAD www.microsoft.com/\\'
You could also get clever and pretend to be a web proxy since there
are probably differences in the way these get treated. Also try to
find things which are due to basic server differences like threads or
whatever (simultaneous requests?)
You will probably find bugs in the way the servers operate this way.
--
1024/D9C69DF9 steve mynott [EMAIL PROTECTED]
i gained nothing at all from supreme enlightenment, and for that very
reason it is called supreme enlightenment. -- gotama buddha
