KPMG-2002004: Lotus Domino Webserver DOS-device Denial of Service

-------------------------------------------------------------------- -=Lotus Domino Webserver DOS-device Denial of Service=- courtesy of KMPG Denmark BUG-ID: 2002004 Released: 4th Feb 2002 -------------------------------------------------------------------- Problem: ======== The Domino Webserver...

Enumerating users on a Domino webserver

Hi, during a pen-test against a Domino 5.0.8 webserver, I was able to enumerate valid users. A simple "GET /mail/toto.nsf HTTP/1.0" redirects to the login page with a "200 OK" HTTP code if the user "toto" exists and a "404 File not Found" is returned if the user doesn't exist. This issue can allo...