Initialization

Concat.cls

@@ -0,0 +1,48 @@
+VERSION 1.0 CLASS
+BEGIN
+ MultiUse = -1 'True
+ Persistable = 0 'NotPersistable
+ DataBindingBehavior = 0 'vbNone
+ DataSourceBehavior = 0 'vbNone
+ MTSTransactionMode = 0 'NotAnMTSObject
+END
+Attribute VB_Name = "Concat"
+Attribute VB_GlobalNameSpace = False
+Attribute VB_Creatable = True
+Attribute VB_PredeclaredId = False
+Attribute VB_Exposed = False
+Option Explicit
+
+Private Buffer As String
+Private BufferLen As Long
+Private Pointer As Long
+
+Public Sub Clear()
+ Pointer = 1
+End Sub
+
+Public Sub Concat(ByRef Value As String)
+ Dim PointerNew As Long
+
+ PointerNew = Pointer + LenB(Value)
+
+ If PointerNew > BufferLen Then
+ Buffer = Buffer & Space$(PointerNew)
+ BufferLen = LenB(Buffer)
+ End If
+
+ MidB$(Buffer, Pointer) = Value
+ Pointer = PointerNew
+End Sub
+
+Public Property Get Length() As Long
+ Length = Pointer \ 2
+End Property
+
+Public Property Get Value() As String
+ Value = LeftB$(Buffer, Pointer - 1)
+End Property
+
+Private Sub Class_Initialize()
+ Clear
+End Sub

config/default.cfg

@@ -0,0 +1,54 @@
+# httprecon 7.3 configuration file
+# 
+# Date 28.03.2010
+# Time 21:51:58
+# File C:\Users\mruef\development\httprecon-7.3\config\default.cfg
+# User mruef
+#
+# Disclaimer: This config file is generated automatically by the software
+# itself during runtime. Please do not manually edit these values unless you
+# do know what you are doing. Manual changes work only if the application is
+# not running.
+#
+# See the online help, documentation and the official project web site at
+# http://www.computec.ch/projekte/httprecon/ for more details.
+
+# Scan
+scan_targethost=www.scip.ch
+scan_targetport=80
+scan_targetsecure=0
+
+# Statistics
+app_hitpoints_minimum=7
+app_hitpoints_maximum=14
+
+# Tests
+scan_test_getexisting=1
+scan_test_getnonexisting=1
+scan_test_getlong=1
+scan_test_head=1
+scan_test_options=1
+scan_test_wrongmethod=1
+scan_test_nonexistingmethod=1
+scan_test_wrongprotocol=1
+scan_test_attack=1
+
+# Requests
+req_timeout_connect=4961
+req_timeout_send=4994
+req_timeout_receive=4952
+req_protocol_legitimate=HTTP/1.1
+req_protocol_wrong=HTTP/9.8
+req_resource_available=/
+req_resource_notavailable=/uB6zG0.html
+req_resource_attack=/etc/passwd?format=%%%%&xss="><script>alert('xss');</script>&traversal=../../&sql=' OR 1;
+req_longrequest_length=1024
+req_longrequest_char=u
+req_method_notallowed=DELETE
+req_method_notexisting=TEST
+req_agent_name=Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.12
+req_agent_noredirect=0
+
+# Timing
+time_decimals=3
+

config_templates/long_request_length.contem

@@ -0,0 +1,7 @@
+256
+512
+1024
+2048
+4096
+8192
+16384

config_templates/methods_not_allowed.contem

@@ -0,0 +1,13 @@
+DELETE
+PUT
+TRACE
+TRACK
+OPTIONS
+CONNECT
+PROPFIND
+PROPPATCH
+MKCOL
+COPY
+MOVE
+LOCK
+UNLOCK

config_templates/methods_not_existing.contem

@@ -0,0 +1,5 @@
+TEST
+FOO
+BLAH
+ABCDE
+QWERTY

config_templates/protocols_wrong.contem

@@ -0,0 +1,3 @@
+HTTP/9.8
+HTTP/1.9
+HTTP/X.Y

config_templates/resources_attack_item.contem

@@ -0,0 +1,6 @@
+/etc/passwd?format=%%%%&xss=""><script>alert('xss');</script>&traversal=../../&sql=' OR 1;
+../../etc/passwd
+/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
+/forum.php?user=<script>alert(document.cookie);</script>
+/forum.php?user=' OR 1;
+/%00

config_templates/resources_available.contem

@@ -0,0 +1,15 @@
+/
+/index.html
+/index.htm
+/index.php
+/index.php3
+/index.php4
+/index.php5
+/index.jsp
+/index.cgi
+/default.html
+/default.htm
+/default.asp
+/default.aspx
+/default.jsp
+/action.do

config_templates/resources_not_available.contem

@@ -0,0 +1,5 @@
+/404test_.html
+/foo_.html
+/blah_.html
+/abcde_.html
+/qwerty_.html

database/attack_request/accept-range.fdb

@@ -0,0 +1,62 @@
+4D WebSTAR 4.5;bytes
+4D WebSTAR 5.3.3;bytes
+Apache 1.3.26;bytes
+Apache 1.3.27;bytes
+Apache 1.3.33;bytes
+Apache 1.3.37;bytes
+Apache 2.0.45;bytes
+Apache 2.0.46;bytes
+Apache 2.0.49;bytes
+Apache 2.0.50;bytes
+Apache 2.0.51;bytes
+Apache 2.0.52;bytes
+Apache 2.0.53;bytes
+Apache 2.0.54;bytes
+Apache 2.0.59;bytes
+Apache 2.2.2;bytes
+Apache 2.2.3;bytes
+Apache 2.2.4;bytes
+Apache 2.2.6;bytes
+Apache 2.2.9;bytes
+Ashleys Webserver;bytes
+Barracuda Networks Spam Firewall;bytes
+Boa 0.94.14rc21;bytes
+Caudium 1.4.9;bytes
+IBM HTTP Server 2.0.47.1;bytes
+IBM HTTP Server 6.0.2.19;bytes
+lighttpd 1.4.16;bytes
+Lotus Domino Go Webserver 4.6.2.5;bytes
+Microsoft IIS 6.0;bytes
+Microsoft IIS 7.0;bytes
+NetBotz 320 thttpd 2.25b;bytes
+NetBotz 420 thttpd 2.25b;bytes
+NetBotz 500 thttpd 2.25b;bytes
+Oracle Application Server 10g 10.1.2.2.0;bytes
+Oracle Application Server 10g 10.1.3.1.0;bytes
+Orion 2.0.7;bytes
+QNAP GNS-8000A 4.1.4.0118;bytes
+QNAP NAS-2108R 2.27.1024;bytes
+QNAP NAS-4010 4.2.0.0606;bytes
+QNAP NAS-4100 2.26.0517;bytes
+QNAP TS-101 2.0.1.0302;bytes
+QNAP TS-101 2.1.0.612T;bytes
+QNAP TS-101 Turbo Station 1.2.0.0629;bytes
+QNAP TS-109 1.1.2.1009T;bytes
+QNAP TS-109 1.1.3.1101T;bytes
+QNAP TS-209 1.1.1.0831T;bytes
+QNAP TS-209 1.1.3.1101T;bytes
+QNAP TS-40IT Turbo Server 1.1.0.0425;bytes
+QNAP TS-411U 1.2.0.0531;bytes
+Roxen 2.2.213;bytes
+Roxen 4.5.111;bytes
+Roxen 4.5.145;bytes
+Sun ONE Web Server 6.1;bytes
+thttpd 2.19-MX;bytes
+thttpd 2.20b;bytes
+thttpd 2.23beta1;bytes
+thttpd 2.24;bytes
+thttpd 2.26;bytes
+Virtuoso 5.0.3;bytes
+WallBotz 500 thttpd 2.25b;bytes
+Zeus 4.3;bytes
+Zeus 4.41;bytes