67
Script Source Disclosure
•Target: obtain source script (access to application logic, and goodies)
•
•How: exploit web/app server vulnerabilities in path, to reveal application (specific) script
•
•Log Manifestation:
–Request for “similar” but not identical resource to script in site – not THE script
•
•False Alarm: not likely
–
Variations:
suspicious encoding of script extension - /script%2ejsp  /script.js%70  /script%252ejsp
appending characters to script name - /script.asp::$DATA  /script.pl+.htr  /script.pl%20
using extensions for temporary/backup copies - /script.old  /script.pl~  /script.$$$  /script.pl.tmp  /script.pl.sav
uppercase extensions - /script.JSP
8.3 file name format - /longsc~1.jsp