I just popped over to the US Games Workshop site to try to figure out when will I be able to pre-order the Codex Eldar and this is what I saw:
Ooops! The whole site, including the online store. Judging from the vague error message, I’m guessing there is something wrong with the way they connect to the database. Either it is down, or someone did something to the code that prevents if from connecting correctly.
I’m glad I was not placing an order when that shit went down. I would be really pissed off if this would happen to me in mid order. I’m wondering if anyone is there to diagnose and fix this. Theoretically a big site like that should have 24h support – but who the hell knows.
I think the first thing they need to do is to mask these error messages. I mean, you just look at that thing, and you can plainly see they are using ADO connection which implies SQL server on a windows box with ASP. You can also see the path to the includes folder which may contain all kinds of juicy bits. If you do a portscan and OS fingerprint on that server you have a very solid base to start poking around.
Let’s see how long will it take them to get the site up.
Update Tue, June 27 2006, 12:00 AM
It seems that as I was typing this the main site went back up. The online store is still acting flaky though.
U don’t have to do a fingerprint. Just look at the response headers:
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Then you might ask yourself what an ASP.Net server is doing with Classic ASP code.
Heh, true. But a an OS fingerprint may tell you which version of Windows is running on the machine.
You can mix unmanaged code with .NET stuff, no? Not the best idea, but I think it can be done. My ASP skills are a bit rusty…
I’m guessing they are running some legacy code or something like that.
Well, if they are running IIS 6.0 then, inhertantly, they must be running Windows Server 2003. Isn’t that so? :)
Btw… Could you tell me more about this fingerprint business? Perhaps you even know how to do a backward dns-lookup to see what dns-servers the domain is registered on?
Indeed, you can run ASP 3.0 at the same time as .Net. The fact that you can saved me from many hours of boring coding a while ago when I was fixing an old CMS; with me using .Net of course.
Of course I mean “inherantly”, it’s been a hard day’s work. :D
By OS fingerprint I mean:
nmap -O targetYou must run that as root for some reason. It will try to tell you what ports are open, and attempt to identify the OS and it’s version. This doesn’t always give you clear results – especially if the target is well configured and locked down tight.
I usually use Apache + PHP for most of my coding. I forget that IIS is kinda “built into” windows. :P Sorry…
My preferred environment is LAMP (Linux, Apache, MySQL, PHP). I do work with one WIMP server (Windows, IIS, MySQL, PHP) but I really don’t do all that much with it.