Using the web.exe CGI Program


Files in the "sigma-web" directory are not accessible directly from the browser. (By default the "sigma-web" folder is not one of the virtual folders of the HTTP server, and it is probably a security concern to make that directory visible in most situations) The processing to create the navigation tabs takes place in the "web.exe" program, launched as a CGI executable by the HTTP server.

The "web.exe" program accepts as an argument the pathname to one of the above objects, starting with the "./sigma-web" directory. For example, to view the "100_Welcome.html" screen, the following URL can be used:

http://hostname/s-cgi/web.exe?100_Welcome.html

Note that the pathname to the object is revealed (although the location of the "sigma-web" directory is hidden, which is good.) For a better effect, the URL following the "?" character is generally encrypted and encoded, beginning with "//" characters. (This is described in more detail within subsequent sections.)

If the "Web.exe" program is executed with no arguments, it searches the "Sigma\sigma-web" directory for the first file in the directory, possibly recursively descending into any other directories to find that first file. That file is displayed, along with various navigation tabs at the same level as the file.

If the user is launching a program, rather than a file, the URL can contain arguments to the program, separated by ampersands. For example, the URL to launch a program called "120_Hello.bat" the following URL can be used: /s-cgi/web.exe?120_Hello.bat&Arg1&Arg2

The above arguments are passed to the %1 and %2 variables of the "120_Hello.bat" file, where they can be processed. Note that the arguments must be simple, or must contain HTML character codes for special characters (including the HTML "+" character for any spaces.) Also note that the program receives the arguments as double quoted strings (which may cause difficulties in Batch files, but not necessarily in other programming languages.)


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC Defender SIEM Correlation Server 6.2