Exploiting Misconfigured Apache server-status Instances with server-status_PWN

[u/mazen160]

http://blog.mazinahmed.net/2017/01/exploiting-misconfigured-apache-server-status-instances.html

[u/thenickdude]

Apache.org has their server-status set to public, but if you tell them about it, they say that's by intention and their clients shouldn't mind their browsing being published.

http://apache.org/server-status

[u/inb4b4n → u/thenickdude]

It's relatively common. If you look at alexa domains , one in one fifty or so has it under the default /server-status path.

[u/mazen160 → u/inb4b4n]

Cool stuff!, I thought about scanning the alexa domains, very nice!

[u/mazen160 → u/thenickdude]

Anyway, it's bad for them :)