Re: [Full-Disclosure] Interesting chunk in the middle of search overflow attempt

[David Jacoby <dj@xxxxxxxxxxxxx>]

No idea what it is, but its alot of messages in different languages. The 
message says

"If you think this is an server problem please contact the administrator"

and then a link to the administrator.

<a href=\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
-->\">webmaster</a>

Uhm, how did you get this message?

Ive attached a message containing your output a little bit more sorted.

((D))




Jim Race wrote:

> Bounced off the Apache server with no troubles (414) but this was 
> somewhat new...
>
> AKA: Analyze "this":
>
> x90\x90\x90\x90\x90\x90=\"SERVER_ADMIN\" -->\">\xc0\xa5 
> \xb0\xfc\xb8\xae\xc0\xda</a>\xbf\x
> a1\xb0\xd4 \xbf\xac\xb6\xf4\xc7\xcf\xbd\xc3\xb1\xe2 
> \xb9\xd9\xb6\xf8\xb4\xcf\xb4\xd9.\r\n-
> ---------ko--\r\n\r\nContent-language: nl\r\nContent-type: text/html; 
> charset=ISO-8859-1\r
> \nBody:----------nl--\r\nIndien u van oordeel bent dat deze server in 
> fout is, gelieve\r\n
> de <a href=\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
> -->\">webmaster</a> te

>  contacteren.\r\n----------nl--\r\n\r\nContent-language: 
> pl\r\nContent-type: text/html; ch 
> arset=ISO-8859-2\r\nBody:----------pl--\r\nJe\xb6li my\xb6lisz, \xbfe 
> jest to b\xb3\xb1d t
> ego serwera, skontaktuj si\xea z\r\n<a href=\"mailto:<!--#echo 
> encoding=\"url\" var=\"SERV
> ER_ADMIN\" 
> -->\">administratorem</a>.\r\n----------pl--\r\n\r\nContent-language: 
> pt-br\r\n
> Content-type: text/html; 
> charset=ISO-8859-1\r\nBody:-------pt-br--\r\nSe voc&ecirc; acredi
> ta ter encontrado um problema no servidor,\r\npor favor entre em 
> contato com o \r\n<a href
> =\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
> -->\">webmaster</a>.\r\n-------p
> t-br--\r\n\r\nContent-language: ro\r\nContent-type: text/html; 
> charset=ISO-8859-1\r\nBody:
> ----------ro--\r\nVa rugam sa il contactati pe\r\n<a 
> href=\"mailto:<!--#echo encoding=\"ur
> l\" var=\"SERVER_ADMIN\" -->\">webmaster</a>\r\nin cazul in care 
> credeti ca aceasta este o
>  eroare a serverului.\r\n----------ro--\r\n\r\nContent-language: 
> sv\r\nContent-type: text/
> html; charset=ISO-8859-1\r\nBody:----------sv--\r\nOm du tror att 
> detta beror p&aring; ett
>  serverfel, v&auml;nligen kontakta \r\n<a href=\"mailto:<!--#echo 
> encoding=\"url\" var=\"S
> ERVER_ADMIN\" 
> -->\">webbansvarig</a>.\r\n----------sv--\r\n\r\nContent-language: 
> tr\r\nCon
> tent-type: text/html; 
> charset=ISO-8859-9\r\nBody:----------tr--\r\nBunun bir sunucu hatas&
> #305; oldu&#287;unu d\xfc&#351;\xfcn\xfcyorsan&#305;z, l\xfctfen\r\n<a 
> href=\"mailto:<!--#
> echo encoding=\"url\" var=\"SERVER_ADMIN\" 
> -->\">site\r\ny\xf6neticisi</a> ile ileti&#351;
> ime 
> ge\xe7in.\r\n----------tr--\r\nx02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\ 
>
> xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\ 
>
>
> -jim
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html



--
Best regards,
David Jacoby
Security Analysist

Outpost24 Security Team
Email : dj@xxxxxxxxxxxxx

No idea what it is, but its alot of messages in different languages. The 
message says"
If you think this is an server problem please contact the administrator" and 
then a link
to the administrator. 

<a href=\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
-->\">webmaster</a>

Uhm, how did you get this message?



((D))


---------------------- SNIP

x90\x90\x90\x90\x90\x90=\"SERVER_ADMIN\" -->\">\xc0\xa5 
\xb0\xfc\xb8\xae\xc0\xda</a>
\xbf\xa1\xb0\xd4 \xbf\xac\xb6\xf4\xc7\xcf\xbd\xc3\xb1\xe2 
\xb9\xd9\xb6\xf8\xb4\xcf\xb4\xd9.
\r\n----------ko--
\r\n
\r\n
Content-language: nl
\r\n
Content-type: text/html; charset=ISO-8859-1
\r\n
Body:----------nl--
\r\n
Indien u van oordeel bent dat deze server in fout is, gelieve
\r\n
de <a href=\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
-->\">webmaster</a>
te contacteren.
\r\n
----------nl--
\r\n
\r\n
Content-language: pl
\r\n
Content-type: text/html; charset=ISO-8859-2
\r\n
Body:----------pl--
\r\n
Je\xb6li my\xb6lisz, \xbfe jest to b\xb3\xb1d tego serwera, skontaktuj si\xea z
\r\n
<a href=\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
-->\">administratorem</a>.
\r\n
----------pl--
\r\n
\r\n
Content-language: pt-br
\r\n
Content-type: text/html; charset=ISO-8859-1
\r\n
Body:-------pt-br--
\r\n
Se voc&ecirc; acredi ta ter encontrado um problema no servidor
\r\n
por favor entre em contato com o
\r\n
<a href=\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
-->\">webmaster</a>.
\r\n
-------pt-br--
\r\n
\r\n
Content-language: ro
\r\n
Content-type: text/html; charset=ISO-8859-1
\r\n
Body:----------ro--
\r\n
Va rugam sa il contactati pe
\r\n
<a href=\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
-->\">webmaster</a>
\r\n
in cazul in care credeti ca aceasta este o eroare a serverului.
\r\n
----------ro--
\r\n
\r\n
Content-language: sv
\r\n
Content-type: text/html; charset=ISO-8859-1
\r\n
Body:----------sv--
\r\n
Om du tror att detta beror p&aring; ett serverfel, v&auml;nligen kontakta
\r\n
<a href=\"mailto:<!--#echo encoding=\"url\" var=\"SERVER_ADMIN\" 
-->\">webbansvarig</a>.
\r\n
----------sv--
\r\n
\r\n
Content-language: tr
\r\n
Content-type: text/html; charset=ISO-8859-9
\r\n
Body:----------tr--
\r\n
Bunun bir sunucu hatas&#305; oldu&#287;unu d\xfc&#351;\xfcn\xfcyorsan&#305;z, 
l\xfctfen
\r\n
<a href=\"mailto:<!--# echo encoding=\"url\" var=\"SERVER_ADMIN\" -->\">site
\r\n
y\xf6neticisi</a> ile ileti&#351;ime ge\xe7in.
\r\n
----------tr--
\r\n
\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\xb1\\x02\\