De naam van QCSec is veranderd in HackDefense.

U vindt onze site nu op HackDefense.nl.

QCSec's name was changed to HackDefense.

Please find our website at HackDefense.com.

Information disclosure vulnerability in Apache Tomcat

Mark Koek - 22-Feb-2016

On a pentest for a client we discovered a way to obtain information about a web application's internal structure from the network. We reported the issue to the vendor and a fix was released. The following security advisory details the vulnerability and how to resolve it.

Because the Apache Tomcat application server responds to HTTP requests for directories with a redirect (appending a trailing slash) if the directory exists in the application's .war file, remote unauthenticated users could detect the presence of an application, and map out the internal structure of the application using a dictionary attack. Lees verder...

• Google+
• Facebook
• LinkedIn
• Twitter