Hello,

I am doing a pentest on a Dominos server and have read access to many databases, among others the names.nsf, admin4.nsf, and log.nsf. I can read their contents but don't really know what I should do to come further. Does anyone have any tips?

Server: Lotus-Domino/0
OS: W2K Server

I can't really say what sort of setup they have due to the fact that it is my job to figure that out. I made a Lotus scanner and it found the following databases:

/domcfg.nsf
/admin4.nsf
/agentrunner.nsf
/bookmark.nsf
/busytime.nsf
/catalog.nsf
/certsrv.nsf
/cpa.nsf
/dirassist.nsf
/doc/dspug.nsf
/domcfg.nsf
/events4.nsf
/help/decsdoc.nsf
/help/dols_help.nsf
/help/help5_admin.nsf
/help/help5_client.nsf
/help/help5_designer.nsf
/help/lccon.nsf
/help/lsxlc.nsf
/help/readme.nsf
/homepage.nsf
/iNotes/Forms5.nsf/$DefaultNav
/iNotes/Forms5.nsf
/log.nsf
/mail.box
/mtatbls.nsf
/names.nsf
/reports.nsf
/statmail.nsf
/statrep.nsf
/vpuserinfo.nsf
/webadmin.nsf
/admin4.nsf
/AgentRunner.nsf
/bookmark.nsf
/busytime.nsf
/catalog.nsf
/certsrv.nsf
/cpa.nsf
/dirassist.nsf
/doc/dspug.nsf
/domcfg.nsf
/events4.nsf
/help/decsdoc.nsf
/help/dols_help.nsf
/help/help5_admin.nsf
/help/help5_client.nsf
/help/help5_designer.nsf
/help/lccon.nsf
/help/lsxlc.nsf
/help/readme.nsf
/homepage.nsf
/iNotes/Forms5.nsf
/log.nsf
/mail.box
/mtatbls.nsf
/names.nsf
/reports.nsf
/statmail.nsf
/statrep.nsf
/webadmin.nsf


I have read access to about 85% of them.


Regards,