5

We're currently having our website pentested, and looking through our logs, a cookie we set (our allowCookies cookie) has had the value set to http%3a%2f%2fawebsite.net%2ff517a2bc19bdff66d7c64e8a7ad2f043.txt. That text file contains the string 3ac3bbfe0cb16c0ff90fc0c0fcb21764.

What kind of vulnerability would this exploit?

6

The intent would have been to exploit a server side include -- your webserver retrieving the URL and incorporating it into the web page.

This vulnerability isn't very common anymore.

  • Ahh I see. I thought it was maybe trying to get the file included in the webpage. Would that be an include coded by myself, or is it something older webservers used to do? – TMH Oct 6 '14 at 12:30
  • It would be something coded by yourself. The pentesting tool they're using likely attempts this with every cookie it sees being set. – kronicd Oct 6 '14 at 12:32
  • 2
    I've noticed the url did move between cookies. That will also explain why the url ../../../../../etc/passwd was tested a few times then! – TMH Oct 6 '14 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.