Parsons Software Security Consulting Blog

Archive for December 2010

How to find Robots.txt with 02

with 2 comments

We already discussed a script to find the crossdomain.xml file with 02.  Today we are going to talk about how to find the Robots.txt file.  Many websites have Robots.txt file but sometimes they contain sensitive information inside of these files.   Today we are going to write a script that searches Google for these files.



Below is a sample Robots.txt from a sample web application.







var ie = panel.clear().add_IE().silent(true);"");
ie.field("Search").value("inurl:robots.txt filetype:txt");

ie.button("Google Search").click();
var targetUrls = new List<string>();

foreach(var link in ie.links().urls())
 if (link.ends("robots.txt"))

return targetUrls;
return targetUrls;
return targetUrls;
return ie.buttons();

//using  O2.XRules.Database.Utils.O2





I don’t plan on showing you how to exploit robots.txt.  But the 02 script is a simple one to find robots.txt  out in the wild.


Parsons Software Security Consulting, LLC

Securing the Internet one Application at a time.


mparsons [at]


Written by mparsons1980

December 8, 2010 at 11:07 pm

Etherpad 02 scripting to search and click on a link in Google

leave a comment »

I was on an Etherpad session with Dinis and Sarah from OWASP.   Below is the link to Etherpad.   Etherpad is a great tool for programmers and for us to help write scripts together and trouble shoot.

We used the free version.

Below are our Etherpad sessions from December, 3, 2010.

Dinis blogs about it on his blog.

Below is today’s 02 script.  Dinis is the original author but I tweaked it to do some shameless self promoting.

var ie = panel.add_IE().silent(true);
ie.disableFlashing(); // use this when developing the script to make it faster
Action<string> searchGoogle =
 (searchText)=> {"");
 searchText = searchText.line();       // here......  <----
 ie.button("Google Search").Click();
Action<string> clickOnLink =
 (linkToClick)=> {
 if (ie.hasLink(linkToClick));
 "Error: could not find link: {0}".error(linkToClick);

searchGoogle("Parsons Software Security Consulting, LLC");
clickOnLink("Parsons Software Security Consulting, LLC - Home");

return"Parsons Software Security Consulting, LLC - Home").click();

//using O2.XRules.Database.Utils.O2

This code opens Google.  Disables flashing to make the search faster.  Then searches for my company, Parsons Software Security Consulting, LLC and clicks on the first link then opening my company’s website.

There is the script. Feel free to email me at for comments.

Matt Parsons, CISSP, MSM,
Parsons Software Security Consulting, LLC
Securing the Internet one Application at a time.

Written by mparsons1980

December 4, 2010 at 4:05 am

How to find Crossdomain.xml Cross Site Request Forgery with 02

with one comment

Lately it seems that a lot of people are talking about the potential security vulnerabilities of having an unrestricted crossdomain.xml.   It’s public knowledge that this can be abused by an attacker setting up Cross Site Request Forgery.

Below is the sample code in the crossdomain.xml.   This is a simple one.  Some of the big websites that have these crossdomain.xml’s unrestricted have alot more data in the xml file.   From the blogs that I have read in the community and from HP Web Inspect Remediation Guide “Exploiting a Vulnerability Involves crafting a custom Flash Application”.


<site-control permitted-cross-domain-policies="all"/>

<allow-access-from domain="*"/>


The fix is “not to design and deploy Flash APIS meant to be accessible to arbitrary third parties.   It is also recommended “to host these on a sub domain”. We are not going to discuss how to exploit this vulnerability but rather to find it in the wild with 02.

So lets open up 02.   I like using Dinis Cruz’s version because it is more powerful.

Then lets open IE Automation.

Below is the default script in IE Automation that Dinis Created.  The default website is Google.

var ie = panel.add_IE().silent(true);"");

//using O2.XRules.Database.Utils.O2

var topPanel = panel.<strong>clear</strong>().<strong>add_Panel</strong>();
var ie = topPanel.<strong>add_IE</strong>().<strong>silent</strong>(<strong>true</strong>);
ie.<strong>field</strong>("Search").<strong>value</strong>("inurl:crossdomain.xml filetype:xml");
ie.<strong>button</strong>("Google Search").<strong>click</strong>();
var targetUrls = <strong>new </strong>List<string>();
<strong>foreach</strong>(var link <strong>in </strong>ie.<strong>links</strong>().<strong>urls</strong>())
<strong>if </strong>(link.<strong>ends</strong>("crossdomain.xml"))
var listOfUrls = topPanel.insert_Left<Panel>(250).<strong>add_TextArea</strong>().<strong>wordWrap</strong>(<strong>false</strong>);
return targetUrls;

//using  O2.XRules.Database.Utils.O2

var topPanel = panel.clear().add_Panel();
var ie = topPanel.add_IE().silent(true);"");
ie.field("Search").value("inurl:crossdomain.xml filetype:xml");
ie.button("Google Search").click();

var listOfUrls = topPanel.insert_Left<Panel>(350).add_TreeView();
var fileContents =listOfUrls.insert_Below<Panel>(200).add_SourceCodeViewer();

 (selectedUrl)=> {
 var html = selectedUrl.uri().getHtml();

foreach(var link in ie.links().urls())
 if (link.ends("crossdomain.xml"))


//using  O2.XRules.Database.Utils.O2

If the script executes properly it displays all the potential websites that are vulnerable to this vulnerability and then puts them inside of 02.  In order for them to be vulnerable allow-access-from-domain has to be set to *.    I don’t want to expose which sites are vulnerable due to legal reasons.   What is missing from the script is  is the rule that checks for the * value.

Many thanks to Dinis, all the security researchers that have been blogging about this vulnerability, HP, IBM and the Netsparker crew.

Matt Parsons, CISSP, MSM

mparsons [at]

Parsons Software Security Consulting, LLC Securing the Internet one Application at a time.

Written by mparsons1980

December 2, 2010 at 7:40 pm