i question i found this site.. DONT POST ADDRESSES!!!!
and i look in the source..

<!--
DOCUMENT_ROOT = /usr/local/etc/httpd/htdocs
GATEWAY_INTERFACE = CGI/1.1
HTTP_ACCEPT = image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash, */*
HTTP_ACCEPT_LANGUAGE = en-us
HTTP_CONNECTION = Keep-Alive
HTTP_HOST = www.fantasy-967.de
HTTP_REFERER = http://www.fantasy-967.de
HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
HTTP_VIA = 1.0 PXYNLUT001, 1.0 PXYNLAD003
PATH = /bin:/usr/bin:/usr/ucb:/usr/bsd:/usr/local/bin
QUERY_STRING =
REDIRECT_STATUS = 200
REDIRECT_URL = /imanager/
REMOTE_ADDR = 144.44.150.151
REMOTE_PORT = 52204
REQUEST_METHOD = GET
REQUEST_URI = /imanager/
SCRIPT_FILENAME = /usr/local/etc/httpd/htdocs/imanager/index.cgi
SCRIPT_NAME = /imanager/index.cgi
SERVER_ADDR = 213.198.48.8
SERVER_ADMIN = service@kern.info
SERVER_NAME = fantasy-967.de
SERVER_PORT = 80
SERVER_PROTOCOL = HTTP/1.0
SERVER_SIGNATURE =
SERVER_SOFTWARE = Apache/1.3.27 OpenSSL/0.9.6 (Unix)
USER = fant45

-->

so i was wondering is there a exploit of vuln of these software?

well, i found an exploit, but it appears that 0.9.6 is the first version this doesn't work on here is the info if you want to check it out

http://www.securityfocus.com/bid/5363/info/

and here is the exploit if you want to try anyways too see what happens

http://www.securityfocus.com/data/vulnerab...ts/OpenFuckV2.c

i have some sites that i always go to to find exploits:

Security Focus
PacketStorm
K-otic
SecuriTeam

hope this bit of info helps

and a few good russian sites:
http://www.security.nnov.ru/
http://www.securitylab.ru/25224.html

Hi,

Any exploit or idea for an Apache 1.3.27 server running RedHat Linux (unknown version) with the following specifications:
mod_ssl/2.8.12
OpenSSL/0.96
DAV/1.0.2
PHP/4.1.2
mod_perl/1.24_01

i am searching also 4 a good one ...
i have only seen buffer overflows yet that only will crash the server and build over 1000 error msg


thx 4 help



gr€€tZ fL4Shb4Ck

has anybody an idea how to find out the Linux version?

thx

uname -a ... or something like that.. im not a linux fan, more unix/bsd

cat /proc/version

or

uname -a

both work

just check ICAT METABASE ?!

:apache 1.3.27
CAN-2003-0542

:openssl < 0.9.6
CAN-2003-0545
CAN-2003-0544
CAN-2003-0543
CAN-2003-0147
...
CAN-2002-0656
...

i think there are many exploits around
for the stuff mentioned above...

just search it | code it yourself?!