spyshow 0 Report post Posted September 26, 2004 gosper is credited with disclosing this to securiteam on 9-24-02 along with a working exploit and he probably discovered it too. I wrote this because his exploit didn't URL encode all the characters that needed to be URL encoded in order for some of the inputted commands to work properly. I added a date argument which is essential for exploiting the security hole. I also used an fdopen() and fgets() to make sure all the output was recieved and displayed correctly, at least I hope it works better . Last thing I built in was HTTP version 1.1 support so that you can use this against virtual hosts. Yeah... and you can exploit this with a web browser too, its just easier to use this program, most of the time. Share this post Link to post Share on other sites
