3 ms·
This is a truly ancient attack vector and a solved one. It's good that the kids re-discover these things and keep knowledge alive, but why oh why do they always
by moe 17y ago
This is a truly ancient attack vector and a solved one. It's good that the kids re-discover these things and keep knowledge alive, but why oh why do they always have to make it sound like some sort of doomsday break-through? I suspect the the twitter disease.
Back in the day when these things were initially discussed (on phrack and the ilk) there was much less noise in favor to more technical insight. What do we get here? A pile of FUD based on half-knowledge.
So, I'd say +1 point for effort, -3 points for (lack of) research and presentation.
A simple search on packetstorm would have revealed that scripts like this were all the rage about 10 years ago (see octopus.c from 2001 and such).
- wmf 17y agoUnfortunately it isn't solved in the default configuration of the #1 Web server.
- moe 17y agoIt isn't solved there because it isn't a webserver problem but a general networking problem. Yes, you could go and add defensive measures to the listeners of your httpd, smtpd, sshd and all your other services. The rest of us just uses a firewall.