[Xitami] New User Question - Server Intrusion

[Paul Reid]

> responses to the script are other than 404 indicating, I assume,
> that some response was obtained.

Those URLs are invalid syntax. They are carefully crafted to confuse
MS IIS webserver. They work up out of the wwwroot directory then
down into the Windows directory and run programs. That's what can
happen when children write webservers: other smarter children find
ways to break their toys.

Xitami can't be tricked that way.

On a few of those it does show other than "404". What's happening:
Xitami tries to parse the invalid URL, chokes on the illegal part
"%%", and simply truncates the URL at that point. The result is
"/scripts/..", which simplifies to "/", so Xitami delivers your top
home page and calls it a success. The attacker, who had hoped for a
file-listing (thus proving that he or she could access CMD and
execute arbitrary commands) will not consider this a success.

 -PRR