• ActiveX vulnerability test (works only on IE5.x)
• CLSID extension vulnerability test
• CLSID extension vulnerability test (for Outlook 2002)
• Eicar anti-virus software test
• GFI's Access exploit vulnerability test
• Iframe remote vulnerability test
• Malformed file extension vulnerability test (for Outlook 2002)


• MIME header vulnerability test (Nimda testing)
• Object Codebase vulnerability test
• VBS attachment vulnerability test

Note: I didn't take all the tests, as some of them are Outlook specific.

After checking the appropriate boxes, entering your contact information and hitting submit button, you can check your mailbox for an e-mail with information on the address for confirming that the test was "ordered" by you. After visiting that URL, all the test e-mails are sent to your address. Information provided below is detailed in the test e-mails.

Ok, so let's start:



1) GFI's Access exploit vulnerability test E-Mail
(I passed this one without a problem)

GFI's Access exploit vulnerability test has just been performed on your computer. Opening this mail automatically activates the test.

* If you can see gfi-test.txt

If the text file gfi-test.txt appears on your desktop, then you are vulnerable to this exploit.

Embedded VBA code within an Access database file (.mdb) that in turn lies within an Outlook Express email file can circumvent security measures in certain circumstances. Vulnerabilities within Internet Explorer and Outlook allow such content to be executed automatically.


The text file demonstrates this: It has read vital information about your system, showing you that, in fact, it could have done anything it wanted on your system had it contained harmful code.

* If you cannot see gfi-test.txt

If you are cannot see the file, this means you have effective client-based email security. Note that, for your network to be secure, every machine on your network must have such client-based protection installed, including your servers. Server levelsecurity is recommended as additional protection.



2) CLSID extension vulnerability test E-Mail
(As the attached file didn't open after clicking on it, I presume I passed this one also. As a double-check, I opened it with ACDSee and nothing happened)



Your mail server has just accepted and sent you an email containing an attachment with a hidden CLSID extension! This means it is relying on desktop level security to protect you. You should now try to run the attachment.

* If you can run this file