1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
|
##
# This file is part of WhatWeb and may be subject to
# redistribution and commercial restrictions. Please see the WhatWeb
# web site for more information on licensing and terms of use.
# http://www.morningstarsecurity.com/research/whatweb
##
# Version 0.4 # 2011-03-03 #
# Merged x-aspnetmvc-version plugin
##
# Version 0.3 # 2011-02-19 #
# Added AnonymousIdentificationModule detection
##
# Version 0.2 # 2011-01-28 #
# Added version detection
##
Plugin.define "ASP_NET" do
author "Brendan Coles <bcoles@gmail.com>" # 2010-10-10
version "0.4"
description "ASP.NET is a free web framework that enables great Web applications. Used by millions of developers, it runs some of the biggest sites in the world. - homepage: http://www.asp.net/"
# The Global.asa file is an optional file that can contain declarations of objects, variables, and methods that can be accessed by every page in an ASP application. All valid browser scripts (JavaScript, VBScript, JScript, PerlScript, etc.) can be used within Global.asa. The Global.asa file must be stored in the root directory of the ASP application, and each application can only have one Global.asa file. - http://www.w3schools.com/ASP/asp_globalasa.asp
# Web.config is the main settings and configuration file for an ASP.NET web application. The file is an XML document that defines configuration information regarding the web application. The web.config file contains information that control module loading, security configuration, session state configuration, and application language and compilation settings. Web.config files can also contain application specific items such as database connection strings. - http://en.wikipedia.org/wiki/Web.config
# AnonymousIdentificationModule - http://msdn.microsoft.com/en-us/library/system.web.security.anonymousidentificationmodule.aspx
# Google results as at 2010-09-28 #
# 29 for inurl:web.config ext:config "ConnectionString"
# 31 for inurl:global.asa ext:asa "ConnectionString"
# ShodanHQ results as at 2011-01-28 #
# 3,356,722 for "asp.net"
# 254,949 for X-AspNet-Version
# 7,460 for Set-Cookie chkvalues anonymousID
# 2,4582 for "asp.net" -IIS
# Dorks #
dorks [
'inurl:web.config ext:config "ConnectionString"',
'inurl:global.asa ext:asa "ConnectionString"'
]
# Examples #
examples %w|
www.microsoft.com
www.asp.net
gymbox.co.uk
playnextlevel.com
rabotadoma-perm.ru
howlingsword.co.kr
205.178.163.82
205.178.185.168
206.188.222.247
205.178.158.154
205.178.172.179
205.178.175.96
205.178.180.82
205.178.166.182
205.178.159.235
69.161.209.78
80.169.204.34
216.58.235.82
81.17.69.182
81.173.203.162
83.66.57.34
98.129.142.219
200.29.69.35
174.143.14.66
216.37.57.82
117.53.170.221
96.0.207.194
81.33.11.112
173.230.226.92
560889223.net:86/DuolianProject/browser/trunk/DuoLianProject/CenterServer/Website/Web.Config
dev.tyzoh.jp/trac/kotodama/browser/branches/withweb/wk/web.config
github.com/mono/mvcwrench/blob/master/web.config
owu-dnn-clb.googlecode.com/svn-history/r13/trunk/owu-dnn-clb/web.config
riscoltd.com/skf/web.config
sourceforge.jp/projects/lightcrm/svn/view/web/Web.config
svn.koolkraft.net/nblogr/trunk/NBlogr.Web/Web.config
www.cs.odu.edu/~gpd/msprojects/balak_r.0/source/Application/Web.config
www.amlsn.org/web.config
www.danielgranados.net/Trac/axon/browser/trunk/axonweb/Web.config
auclebanon.com/aucchatroom/_vti_cnf/global.asa
buyinsuranceez.com/_vti_cnf/global.asa
globalytics.com/_vti_cnf/global.asa
hep.brown.edu/users/Greg/NP/_vti_cnf/global.asa
hep.brown.edu/users/Greg/Physics3_/_vti_cnf/global.asa
home.rmci.net/mgjurenka/_vti_cnf/global.asa
members.ziggo.nl/pvp128/_vti_cnf/global.asa
mfreitas.por.ulusiada.pt/accv/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/execjobs4u.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.advancedintegratedpestmanagement.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.affordableaviation.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.altmarketing.net/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.amandaandstephen.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.amandalynne.biz/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.americanhealthcare.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.andersonroofing.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.anglenfamilyfun.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.armbrusterassoc.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.artistkatiemiller.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.ashleyca.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.asusbilla23.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.aum-online.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.barrons-company.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.believershomepage.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.betterqualitywindows.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.bluemarblecommunications.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.bnctransit.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.bradrmiller.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.brutonsglass.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.brycom.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.cal-alliance.org/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.californiaforarnold.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.cartconst.com/_vti_cnf/global.asa
mywebspace.sac.winfirst.com/cds/DOMAINS/www.chezsoiinteriors.com/_vti_cnf/global.asa
niobio.grasa.csic.es/wmoreda/webdepca/_vti_cnf/global.asa
tars.rollins.edu/development/advserv/Frontpage%20Request%20Database/myweb/_vti_cnf/global.asa
users.connecttime.net/www/jrhorton/My%20Webs/_vti_cnf/global.asa
xbiker.kilu.de/_vti_cnf/global.asa
www.scarborough.me.us/safety/police/_vti_cnf/global.asa
www.usiu.ac.ke/usiu_old/events/sac_polls/_vti_cnf/global.asa
www.kyokushinkan.af/En/_vti_cnf/global.asa
www.translator-spanish-english.com/_vti_cnf/global.asa
www.tcaa.net.au/_vti_cnf/global.asa
www.cs.uofs.edu/~tjm5/myweb3/_vti_cnf/global.asa
www.dickwaddfetish.com/ad/_vti_cnf/global.asa
www.ratiolink.de/Admin/_vti_cnf/global.asa
www.chemengr.ucsb.edu/~ceweb/psec/psec06/_vti_cnf/global.asa
www.creationfood.ca/_vti_cnf/global.asa
www.dallas.net/~tommyt/myweb4/_vti_cnf/global.asa
www.dekanatsministranten.de/juref/_vti_cnf/global.asa
www.parrocchie.it/sarzana/carmine/_vti_cnf/global.asa
www.coop-anexa.com.ar/_vti_cnf/global.asa
www.pianreginaftp.it/test_locali/smart-forum/neurosmart/_vti_cnf/global.asa
www.viajesindaltravel.com/_vti_cnf/global.asa
www.senatordinniman.com/blog/_vti_cnf/global.asa
buyinsuranceez.com/_vti_cnf/global.asa
www.lexitron.net/_vti_cnf/global.asa
|
# Matches #
matches [
# Default web settings title
{ :text=>'vti_title:SR|Web Settings for Active Server Pages' },
# Get connection strings # global.asa
{ :string=>/connectionstring=DRIVER=([^\n]+)/ },
{ :string=>/connectionstring=Provider=([^\n]+)/ },
# Get connection strings # web.config
{ :string=>/connectionString="([^\"]+)/ },
{ :string=>/<add key="ConnectionString" value="([^\"]+)/ },
]
# Passive #
def passive
m=[]
# x-powered-by HTTP header
m << { :name=>"x-powered-by" } if @headers['x-powered-by'] =~ /asp\.net/i
# Version Detection # X-AspNet-Version HTTP header
m << { :version=>@headers['x-aspnet-version'].to_s } unless @headers['x-aspnet-version'].nil?
# Version Detection # X-AspNetmvc-version HTTP header
m << { :string=>"MVC"+@headers['x-aspnetmvc-version'].to_s } unless @headers['x-aspnetmvc-version'].nil?
# AnonymousIdentificationModule
m << { :module=>"AnonymousIdentificationModule" } if @headers['set-cookie'] =~ /^anonymousID=[^;]+; expires=[^;]+; path=[^;]+; HttpOnly/
m << { :module=>"AnonymousIdentificationModule" } if @headers['set-cookie'] =~ /^chkvalues=[^;]+; expires=[^;]+; path=[^;]+; HttpOnly/
# Return passive results
m
end
end
|
