Yeah, they are the same plugin. What version of Nessus are you running and when did you last update the plugins? The duplicate does not exist in CVS current or part of any of the releases that I know of. Im not remembering why/how we submitted that plugin, could be Renaud caught the dupe immediately and didn't put it in CVS, but still listed it on the plugins page...
http://cgi.nessus.org/plugins/search.php3?search_query=full_name&search=codebrws There was a third plugin which was the "real" codebrws.asp source disclosure check, it specifically tested for the IIS 5.0 unicode trick instead of just the existence, I think thats what the DDI_IIS_* plugin should have been and somewhere things got confused. Just checking for the existence of the script is enough IMO, as now every available version has a method which allows arbitrary files to be viewed (whereas before only old IIS 4.0 installs were "vulnerable"). -HD On Tuesday 09 July 2002 09:33, Hemsley, Trevor wrote: > It seems to me that the plugins DDI_IIS_CodeBrws_Sample.nasl and > iis_codebrws.nasl are the same thing. Pluginid's 10956 and 10992.
