Mailing List Archive: asp_net

asp_net_css.nasl

Mar 8, 2002, 9:02 AM

Post #1 of 4 (871 views)

I just had a positive with asp_net_css.nasl for a web server that is not a .NET server (it's Solaris/Tomcat). The CSS problem was also
successfully found with cross_site_scripting.nasl, which means one problem reported two results.

plugin requests:
/~/<script>alert(document.cookie)</script>.aspx?aspxerrorpath=null

Result is checked for:
<script>alert(document.cookie)</script>

I don't have ANYexperience with .NET, but does anyone know if there is an additional string present that the output can be checked for
(some .NET specific error message)? This might keep the plugin from evaluating true when it's not a .NET server.

-Sullo

Re: asp_net_css.nasl [ In reply to ]

deraison at cvs

Mar 8, 2002, 9:09 AM

Post #2 of 4 (848 views)

Permalink

On Fri, Mar 08, 2002 at 11:02:12AM -0500, Sullo wrote:
> I don't have ANYexperience with .NET, but does anyone know if there is an additional string present that the output can be checked for
> (some .NET specific error message)? This might keep the plugin from evaluating true when it's not a .NET server.

We could add a key so that this plugin is only tested against IIS.

-- Renaud

Re: asp_net_css.nasl [ In reply to ]

noamr at beyondsecurity

Mar 22, 2002, 3:38 AM

Post #3 of 4 (842 views)

Permalink

Hi,

Sorry for the late reply, I would guess that the problem isn't a false positive,
but rather a true positive, since the server IS vulnerable to CROSS site, but
not to the .NET issue. So adding an IIS check would hamper this test. I would
rather see a check for the .NET signature file (i.e. when this cross site
appears the .NET version is shown at the bottom of the file, thus allowing
positive detection of .NET files).

Thanks
Noam Rathaus
CTO
Beyond Security Ltd
http://www.SecurITeam.com
http://www.BeyondSecurity.com
----- Original Message -----
From: "Renaud Deraison" <deraison@cvs.nessus.org>
To: <plugins-writers@list.nessus.org>
Sent: Friday, March 08, 2002 18:09
Subject: Re: asp_net_css.nasl

> On Fri, Mar 08, 2002 at 11:02:12AM -0500, Sullo wrote:
> > I don't have ANYexperience with .NET, but does anyone know if there is an
additional string present that the output can be checked for
> > (some .NET specific error message)? This might keep the plugin from
evaluating true when it's not a .NET server.
>
>
> We could add a key so that this plugin is only tested against IIS.
>
>
> -- Renaud
>

Re: asp_net_css.nasl [ In reply to ]

sq at cirt

Mar 22, 2002, 5:50 AM

Post #4 of 4 (840 views)

Permalink

It could also be combined into the more generic
cross_site_scripting.nasl, which can also check for a
.aspx?aspxerrorpath=null "file extension"? That way the first true eval
can end the plugin & only one message is sent.

Let me know what you all think, I can update cross_site_scripting.nasl
if you want. A .NET signature should work just as well...(but I don't
know the proper match string).

-Sullo

> Hi,
>
> Sorry for the late reply, I would guess that the problem isn't a false
positive,
> but rather a true positive, since the server IS vulnerable to CROSS
site, but
> not to the .NET issue. So adding an IIS check would hamper this test.
I would
> rather see a check for the .NET signature file (i.e. when this cross site
> appears the .NET version is shown at the bottom of the file, thus allowing
> positive detection of .NET files).
>
> Thanks
> Noam Rathaus
> CTO
> Beyond Security Ltd
> http://www.SecurITeam.com
> http://www.BeyondSecurity.com
> ----- Original Message -----
> From: "Renaud Deraison" <deraison@cvs.nessus.org>
> To: <plugins-writers@list.nessus.org>
> Sent: Friday, March 08, 2002 18:09
> Subject: Re: asp_net_css.nasl
>
>
> > On Fri, Mar 08, 2002 at 11:02:12AM -0500, Sullo wrote:
> > > I don't have ANYexperience with .NET, but does anyone know if
there is an
> additional string present that the output can be checked for
> > > (some .NET specific error message)? This might keep the plugin from
> evaluating true when it's not a .NET server.
> >
> >
> > We could add a key so that this plugin is only tested against IIS.
> >
> >
> > -- Renaud