Oracle-L: Re: OT: user CGI-BIN directories

From: <Peter.McLarty_at_mincom.com>
Date: Tue, 13 Aug 2002 23:58:19 -0800
Message-ID: <F001.004B3EB2.20020813235819@fatcity.com>

With Apache it is fairly easy but why you would do it is beyond me as they will then run anything in those directories and that is how you mess with a web server by allowing users to freely run cgi scripts. This is why most free websites don't give you access to CGI stuff or other server side capabilities. Most of there sites would have been hacked by now with this enabled.

You need to modify the a Location section

Read up the Apache doco on this as it will explain how a user can use this to create exploits on the server

Cheers

Peter McLarty               E-mail: Peter.Mclarty_at_mincom.com
Technical Consultant        WWW: http://www.mincom.com
APAC Technical Services     Phone: +61 (0)7 3303 3461
Brisbane,  Australia        Mobile: +61 (0)402 094 238
                            Facsimile: +61 (0)7 3303 3048
=================================================

A great pleasure in life is doing what people say you cannot do.

Walter Bagehot (1826-1877 British Economist)
Mincom "The People, The Experience, The Vision"

This transmission is for the intended addressee only and is confidential information. If you have received this transmission in error, please delete it and notify the sender. The contents of this e-mail are the opinion of the writer only and are not endorsed by the Mincom Group of companies unless expressly stated otherwise.

"Alroy Mascranghe" <alroy_at_informatics.lk> Sent by: root_at_fatcity.com
14-08-2002 05:13 PM
Please respond to ORACLE-L

        To:     Multiple recipients of list ORACLE-L <ORACLE-L_at_fatcity.com>
        cc: 
        Fax to: 
        Subject:        OT:  user CGI-BIN directories

To execute the cgi scripts thru web/HTML forms we had to put them in the common cgi-bin directory. But is there a way to have these scripts in a user's home directory and still call them thru web/HTML forms?

TIA
--

Please see the official ORACLE-L FAQ: http://www.orafaq.com
--

Author: Alroy Mascranghe
INET: alroy_at_informatics.lk

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists


--------------------------------------------------------------------

To REMOVE yourself from this mailing list, send an E-Mail message

to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).

--

Please see the official ORACLE-L FAQ: http://www.orafaq.com
--

Author:
INET: Peter.McLarty_at_mincom.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists


--------------------------------------------------------------------

To REMOVE yourself from this mailing list, send an E-Mail message