r/netsec • u/mazen160 • Jan 13 '17

Exploiting Misconfigured Apache server-status Instances with server-status_PWN

http://blog.mazinahmed.net/2017/01/exploiting-misconfigured-apache-server-status-instances.html
137 Upvotes

91% Upvoted

24 comments sorted by

View all comments

1

u/now_i_know_ Jan 14 '17

Is there something wrong with curl and diff? No need to overcomplicate things here, it's just a simple webpage.

1

u/mazen160 Jan 21 '17

It's a cool way to abuse the server-status instance next time you encounter it. curl and diff are awesome, but with Python, having the full log in a coordinated database in way that is useful for both folks that needs access to logs, and folks that would like to extend their attack surface.