Hi,
I mistakenly forgot to provide the response? No I didn't the response has
"." in it... cause some sendmail/qmail to regard it as end of message.. (Bad
idea no?)
Here it is again (> is to stop this from recurring, it is not in the
response)
> GET /cgi-bin/nessus_is_probing_you_722269810 HTTP/1.1.
> Connection: Close.
> Host: host:8080.
> Pragma: no-cache.
> User-Agent: Mozilla/4.75 [en] (X11, U; Nessus).
> Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png,
*/*.
> Accept-Language: en.
> Accept-Charset: iso-8859-1,*,utf-8.
> .
>
> response: .PNG.
> .
>
....IHDR...............4V...3PLTE............................??.//.OO.......
>
...oo.__..~.....IDATx..W...(.......5.....n.f...-....r.lh.~.......e.w7.j....d
>
.......t..p.../@:>.,..>...9....m.D...w....fZ..V`&...Zp.....(U.)d.Q.f.'r.l.(.
>
..tV.q..R...wd}.....8...].....:.*=.7..&..r...a..r..k.(...../E.e}.......u../.
> ..o..PiH;..u.-(...4.=.{..C.....u..O.&.n.Za.0..7|N..(1.y|q...
> ....[t..
>
..-!...!.....{X..)/.[.....y-..o.r...s_.`.X..z..N=Rm.m.....i..Z.....W...Y...R
> Ml.W.U..t... .e.#.".._....c..v."j.[>
>
.[.E.[e.+L3.Z./..G;.a.Dr$...$]%....{......"?.|.ZAT....^*..:ch.R...&L]...]..S
>
..6.....).L.pR.Qpk.r+E.Yz.L..o..U"..#qL....{E..L..6..3..wE;.....>l.9.b.?=.Z.
> @.D.~..v...T.[!..C.......k...$..S...t.R...b-..M...Z...`F..|
>
[..#......"...._..a....M..;......I.t..JEc..|....B..Kv.Z..E.X...K.r..`..qS...
> ..IK.(.G....}M.FW.H..TO..r....jf]$a5....U.....f.S:..C1......b..W....dV?.
> ]....p...AM...4qt.J.lHtB.5..
>
..$.(.g8..[I.7P.....q....T8.f.L.h^@K?...u.l.x.<........q.{.B[0Q.h.9.j'....5.
> ..oT.. .J.......
>
..Xg.7m.7..I.&q=....i....)..D.9r].i...}...s3.g}<..as.q.O....=b....#_k....9#.
> .+.}.c......7...o...7Q.......e -...W....IEND.B`.....
Thanks
Noam Rathaus
CTO
Beyond Security Ltd.
http://www.BeyondSecurity.com
http://www.SecuriTeam.com
----- Original Message -----
From: "Michel Arboi" <[EMAIL PROTECTED]>
To: "Nessus Mailing List" <[EMAIL PROTECTED]>; "Nessus Plugins Writers"
<[EMAIL PROTECTED]>
Sent: Wednesday, July 17, 2002 09:42
Subject: Re: no404 and PNG (image) returning from web site
> "Noam Rathaus" <[EMAIL PROTECTED]> writes:
>
> > I came across a false positive generating server, the server will return
a
> > picture (that changes) for whatever request you give it. It seems that
no404
> > is not able to handle this. Here is an example:
> [snip]
>
> What does the server answer look like?
>
>
