Wikipedia File Disclosure.

Tagged:  
574
vote

In the wake of the Google file disclosure, I show you the Wikipedia version. This isn't that bad as Google was, but it shows some juicy files that can be used to obtain intelligence of the server and used paths, or the programming architecture. A directory on static.wikipedia.org/scripts/ seems to be unprotected. I don't get the impression this directory is set readable on purpose. But, it is Wikipedia so one never knows for sure. In any case, it always is a bad idea to let the whole world know how you write scripts, where the proper paths are, which ports that are open and those who listen for incoming queries, and disclose script information that can be used to attack the server: like unset() passthru() and a few path variables that are being set in the script. Maybe not directly vulnerable, we can learn quite a bit. The /scripts/ directory contains PHP, Python and it also contains a few bash scripts that are probably used internally to automate stuff. A mistake? I don't know.http://static.wikipedia.org/scripts/queueController.phphttp://static.wikipedia.org/scripts/http://static.wikipedia.org/scripts/netqueue.pyhttp://static.wikipedia.org/scripts/queueSlave

Trackback URL for this post:

http://secgeeks.com/trackback/504