rendered paste bodyNikto v1.36/1.37
CIRT.net
--------------------------------------------------------------------------------
Target IP: 192.168.56.102
Target Hostname: www2.orange.corp
Target Port: 80
Start Time: Sun May 20 13:06:12 2007
--------------------------------------------------------------------------------
Scan is dependent on "Server" string which can be faked, use -g to override
Server: Apache/2.0.50 (Unix) PHP/4.3.11
No CGI Directories found (use '-C all' to force check all possible dirs)
Allowed HTTP Methods: GET,HEAD,POST,OPTIONS,TRACE
Apache/2.0.50 appears to be outdated (current is at least Apache/2.2.3). Apache 1.3.33 is still maintained and considered secure.
PHP/4.3.11 appears to be outdated (current is at least 5.1.6)
PHP/4.3.1 - PHP below 4.3.3 may allow local attackers to safe mode and gain access to unauthorized files. BID-8203.
/~root - Enumeration of users is possible by requesting ~username (responds with Forbidden for real users, not found for non-existent users) (GET).
/admin/config.php - Needs Auth: (realm "Admin Only")
/ - TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details (TRACE)
//admin/admin.shtml - Needs Auth: (realm "Admin Only")
//admin/aindex.htm - Needs Auth: (realm "Admin Only")
/admin/admin_phpinfo.php4 - Needs Auth: (realm "Admin Only")
/admin/admin.php?adminpy=1 - Needs Auth: (realm "Admin Only")
/admin/browse.asp?FilePath=c:\&Opt=2&level=0 - Needs Auth: (realm "Admin Only")
/admin/contextAdmin/contextAdmin.html - Needs Auth: (realm "Admin Only")
/admin/cplogfile.log - Needs Auth: (realm "Admin Only")
/admin/database/wwForum.mdb - Needs Auth: (realm "Admin Only")
/admin/db.php?dump_sql=1 - Needs Auth: (realm "Admin Only")
/admin/exec.php3?cmd=cat%20/etc/passwd - Needs Auth: (realm "Admin Only")
/admin/exec.php3?cmd=dir%20c:\\ - Needs Auth: (realm "Admin Only")
/admin/login.php?action=insert&username=test&password=test - Needs Auth: (realm "Admin Only")
/admin/login.php?path=\">
<script>alert('Vulnerable') - Needs Auth: (realm "Admin Only")
/admin/phpinfo.php - Needs Auth: (realm "Admin Only")
/admin/system_footer.php - Needs Auth: (realm "Admin Only")
/admin/system.php3?cmd=cat%20/etc/passwd - Needs Auth: (realm "Admin Only")
/admin/system.php3?cmd=dir%20c:\\ - Needs Auth: (realm "Admin Only")
/admin/wg_user-info.ml - Needs Auth: (realm "Admin Only")
/admin/ - Needs Auth: (realm "Admin Only")
/admin/auth.php - Needs Auth: (realm "Admin Only")
/admin/cfg/configscreen.inc.php+ - Needs Auth: (realm "Admin Only")
/admin/cfg/configsite.inc.php+ - Needs Auth: (realm "Admin Only")
/admin/cfg/configsql.inc.php+ - Needs Auth: (realm "Admin Only")
/admin/cfg/configtache.inc.php+ - Needs Auth: (realm "Admin Only")
/admin/cms/htmltags.php - Needs Auth: (realm "Admin Only")
/admin/credit_card_info.php - Needs Auth: (realm "Admin Only")
/admin/exec.php3 - Needs Auth: (realm "Admin Only")
/admin/index.php - Needs Auth: (realm "Admin Only")
/admin/modules/cache.php+ - Needs Auth: (realm "Admin Only")
/admin/objects.inc.php4 - Needs Auth: (realm "Admin Only")
/admin/script.php - Needs Auth: (realm "Admin Only")
/admin/settings.inc.php+ - Needs Auth: (realm "Admin Only")
/admin/templates/header.php - Needs Auth: (realm "Admin Only")
/admin/upload.php - Needs Auth: (realm "Admin Only")
2052 items checked - 2 item(s) found on remote host(s)
End Time: Sun May 20 13:12:03 2007 (351 seconds)
--------------------------------------------------------------------------------
1 host(s) tested
Test Options: -h www2.orange.corp -Format HTM -output scan3.htm
--------------------------------------------------------------------------------