Well, this attack will never work because Wapiti is trying to include the
file boot.ini which is (as far as I know but I'm not a windows expert)
always on drive c:

The errormessage shows that the INETPUB Directory is on drive E: so
a simple directory traversal attack won't work (at least for this file).

--cut--
This runtime error, 800A000D occurs when you execute a VBScript. My
suggestion is that there is a VBScript statement that does not understand a
keyword you are using in your script. Alternatively, you may not be running
the script as an ordinary user and not as an Administrator.
--cut--
Source: http://www.computerperformance.co.uk/Logon/code/code_800A000D.htm

If you have access to the system you are testing, search for a file
on drive e: (maybe a txt or asp file which is part of the application) and
modify the wapiti URL.

Or (better) look at the soucecode of toplinks-archive-courses-spas.asp

... Read more »

____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
       \/         \/       \/         \/                              .OR.ID
ECHO_ADV_110$2009

------------------------------

Safari prior to version 4 may permit an evil web page to steal
arbitrary XML data cross-domain.

This is accomplished by abusing a relatively obscure cross-domain
access point which was completely missing a cross-domain access check.
The access point in question is the document() function in XSL. This
is best illustrated with a sample evil XSL file which abuses this
function:

<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:str="http://exslt.org/strings" extension-element-prefixes="