Other nomination

Multiviews Apache, Accept Requests and free listing

Stefano Di Paola

Apache MultiViews turns one request into a directory listing. Requesting /index with an unsatisfiable Accept header makes the server answer 406 and enumerate every same-named variant in its Alternates header, exposing index.bak and other backups. Di Paola argues scanners and the OWASP Testing Guide should check for the Content-Location/Vary/TCN fingerprint.

Record

Researcher

Stefano Di Paola

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Tags

• info-leak
• http
• content-type
• mime
• abuse-of-functionality
• detection
• owasp-a04-2021
• owasp-a05-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Stefano Di Paola, first published at the original source. Preserved copies are kept so the citation survives its host.