Nikto v1.36/1.37
CIRT.net

--------------------------------------------------------------------------------

Target IP: 192.168.56.102

Target Hostname: www2.orange.corp

Target Port: 80

Start Time: Sun May 20 13:06:12 2007

--------------------------------------------------------------------------------

Scan is dependent on "Server" string which can be faked, use -g to override

Server: Apache/2.0.50 (Unix) PHP/4.3.11

No CGI Directories found (use '-C all' to force check all possible dirs)

Allowed HTTP Methods: GET,HEAD,POST,OPTIONS,TRACE 

Apache/2.0.50 appears to be outdated (current is at least Apache/2.2.3). Apache 1.3.33 is still maintained and considered secure.

PHP/4.3.11 appears to be outdated (current is at least 5.1.6)

PHP/4.3.1 - PHP below 4.3.3 may allow local attackers to safe mode and gain access to unauthorized files. BID-8203.

/~root - Enumeration of users is possible by requesting ~username (responds with Forbidden for real users, not found for non-existent users) (GET).

/admin/config.php - Needs Auth: (realm "Admin Only")

/ - TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details (TRACE)

//admin/admin.shtml - Needs Auth: (realm "Admin Only")

//admin/aindex.htm - Needs Auth: (realm "Admin Only")

/admin/admin_phpinfo.php4 - Needs Auth: (realm "Admin Only")

/admin/admin.php?adminpy=1 - Needs Auth: (realm "Admin Only")

/admin/browse.asp?FilePath=c:\&Opt=2&level=0 - Needs Auth: (realm "Admin Only")

/admin/contextAdmin/contextAdmin.html - Needs Auth: (realm "Admin Only")

/admin/cplogfile.log - Needs Auth: (realm "Admin Only")

/admin/database/wwForum.mdb - Needs Auth: (realm "Admin Only")

/admin/db.php?dump_sql=1 - Needs Auth: (realm "Admin Only")

/admin/exec.php3?cmd=cat%20/etc/passwd - Needs Auth: (realm "Admin Only")

/admin/exec.php3?cmd=dir%20c:\\ - Needs Auth: (realm "Admin Only")

/admin/login.php?action=insert&username=test&password=test - Needs Auth: (realm "Admin Only")

/admin/login.php?path=\">
<script>alert('Vulnerable') - Needs Auth: (realm "Admin Only")

/admin/phpinfo.php - Needs Auth: (realm "Admin Only")

/admin/system_footer.php - Needs Auth: (realm "Admin Only")

/admin/system.php3?cmd=cat%20/etc/passwd - Needs Auth: (realm "Admin Only")

/admin/system.php3?cmd=dir%20c:\\ - Needs Auth: (realm "Admin Only")

/admin/wg_user-info.ml - Needs Auth: (realm "Admin Only")

/admin/ - Needs Auth: (realm "Admin Only")

/admin/auth.php - Needs Auth: (realm "Admin Only")

/admin/cfg/configscreen.inc.php+ - Needs Auth: (realm "Admin Only")

/admin/cfg/configsite.inc.php+ - Needs Auth: (realm "Admin Only")

/admin/cfg/configsql.inc.php+ - Needs Auth: (realm "Admin Only")

/admin/cfg/configtache.inc.php+ - Needs Auth: (realm "Admin Only")

/admin/cms/htmltags.php - Needs Auth: (realm "Admin Only")

/admin/credit_card_info.php - Needs Auth: (realm "Admin Only")

/admin/exec.php3 - Needs Auth: (realm "Admin Only")

/admin/index.php - Needs Auth: (realm "Admin Only")

/admin/modules/cache.php+ - Needs Auth: (realm "Admin Only")

/admin/objects.inc.php4 - Needs Auth: (realm "Admin Only")

/admin/script.php - Needs Auth: (realm "Admin Only")

/admin/settings.inc.php+ - Needs Auth: (realm "Admin Only")

/admin/templates/header.php - Needs Auth: (realm "Admin Only")

/admin/upload.php - Needs Auth: (realm "Admin Only")

2052 items checked - 2 item(s) found on remote host(s)

End Time: Sun May 20 13:12:03 2007 (351 seconds)

--------------------------------------------------------------------------------

1 host(s) tested
Test Options: -h www2.orange.corp -Format HTM -output scan3.htm

--------------------------------------------------------------------------------