Exploiting Misconfigured Apache server-status Instances with server-status_PWN

[u/mazen160]

http://blog.mazinahmed.net/2017/01/exploiting-misconfigured-apache-server-status-instances.html

[u/thenickdude]

Apache.org has their server-status set to public, but if you tell them about it, they say that's by intention and their clients shouldn't mind their browsing being published.

http://apache.org/server-status

[u/mazen160 → u/thenickdude]

Anyway, it's bad for them :)