[Xitami] (no subject)

[Paul Reid]

> I have not seen anything run in the cgi-bin directory that wasn't a cgi or perl script, 

As Mr Shortis says, "CGI" is an interface between a web server
program and any other program. I don't think "a cgi" has much
meaning, except that it is probably -something- that can work
with the CGI protocol. 

>  I guess you could run about any exe file there. 

Yes. On a Windows machine, put Sol.exe in your cgi-bin folder. Go
to a browser on another machine and call
http://othermachine/cgi-bin/sol.exe. Nothing will happen in the
browser, it will time-out waiting for a reply; sol.exe is not
meant to read and write data according to the CGI protocol. But
when you go back to the server you will find Solitaire started
and ready to play. 

Which is a reason to be VERY careful what you put in the CGI
folder. Solitaire is pointless but safe (unless someone opens a
hundred copies of it and chokes the server RAM); but other
programs, especially ones that read and write to standard input
and output, can send back all sorts of information.

The testcgi.exe program that used to come with Xitami-Win is an
example. It shows anybody several bits of information about the
server machine's configuration, like PATH and where the HTTP
files are actually stored. In itself it isn't a lot of exposure,
but in conjunction with other info it could aid a hacker. 

BTW: in DOS/Win a BAT file can be a useful CGI program. It gets
awkward in a hurry (DOS BAT files eat "<" signs and aren't too
smart anyway) but I use a BAT file to call a filter and an
emailer  and a logger in sequence. In unix, shell-scripts can be
very useful CGI programs. (Also very dangerous because of the
power of the unix shell.)

 -PRR