Closed 0xea31 closed 5 years ago
I investigated the issue and I discovered that both Rustbuster and the python IIS short name scanner implementation are bugged when multiple files with the same prefix exist.
Given two existing files web.config
and web.config.old
, we will see the following results:
web.config
web.config
and will match on the longer web.config.old
I fixed Rustbuster and I am going to release a patched version.
Thanks for the report.
https://github.com/phra/rustbuster/releases/tag/v3.0.2 was released to address this issue.
There might be a problem with files with multiple dots.
For instance,
web.config.old
is discovered asweb~1.con
iis_shortname_Scan.py finds the same file as *`webcon~1.old`**
Side question: is there room to spot file with multiple dots?