Collected research
Multiviews Apache, Accept Requests and free listing
Wisec - The WIse SECurity
Apache MultiViews turns one request into a directory listing. Requesting /index with an unsatisfiable Accept header makes the server answer 406 and enumerate every same-named variant in its Alternates header, exposing index.bak and other backups. Di Paola argues scanners and the OWASP Testing Guide should check for the Content-Location/Vary/TCN fingerprint.
Record
- Document
- Wisec - The WIse SECurity
- Researcher
- Stefano Di Paola
- Published by
- wisec.it
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Stefano Di Paola, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .