/*
 * 
 * php
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>


#define NAME "Netscape Server ?PageServices bug"
#define DESC "\
Requesting an URL with '?PageServices' at its end\n\
makes some Netscape servers dump the listing of the\n\
page directory, thus showing potentially sensitive files\n\
Risk factor : Medium/High"
#define COPYRIGHT "no copyright"
#define SUMM "make a request like http://foo.bar.edu/?PageServices"


PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_ATTACK);
	plug_set_family(desc, "CGI abuses");
	return(0);
}



PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int soc;
        
	if(host_get_port_state(args, 80)<=0)return(0);
	soc = open_sock_tcp(args, 80);
        if(soc > 0)
	{
	char * buffer = emalloc(2000);
	int i;
        sprintf(buffer, "GET /?PageServices HTTP/1.0\n\n");
        send(soc, buffer, strlen(buffer), 0);
        bzero(buffer, strlen(buffer));
        recv(soc, buffer, 2000, 0);
        for(i=0;i<strlen(buffer);i++)buffer[i]=tolower(buffer[i]);
        if(strstr(buffer, "<title>index of /</title>"))
        {
        char* report = emalloc(1024);
        sprintf(report, "\
Requesting http://%s/?PageServices dumps\n\
the listing of the web server root, which\n\
may reveal sensitive files to the world.\n\
Solution : contact Netscape for a patch\n\
Workaround : set Directory Indexing to \"none\";", plug_get_hostname(args));
	post_hole(args, 80, report);
        efree(&report);
       }
        efree(&buffer);
        }
	return(0);
}

