Re: Major Security Hole IIS NT
This WebDNA talk-list message is from 1998
It keeps the original formatting.
numero = 18630
interpreted = N
texte = And who could possible do that to all of their sites and all the tpl/asp/etc. My god what an awful patch to an ugly problem. Not to mention the customers who lease space on our servers. -----Original Message----- From: Raymond Hatch
To: WebDNA-Talk@smithmicro.com Date: Thursday, July 02, 1998 4:47 PM Subject: Re: Major Security Hole IIS NT >great idea but unfortunately the include tag will point to the file >location that they can go to and look at it there. > >Ray > >At 04:04 PM 7/2/98, you wrote: >>Another work around is to creat a file that has the search code it it and >>use the include tad. That way all they will see is the tag. >> >> >> >>At 11:13 AM 7/2/98, you wrote: >>>IIS reveals all special CGI Code >>> >>>Think no one can read your contextual searches, think again. >>> >>>Hit your webpage on an IIS server >>> >>>like http://www.yourdomain.com/special.tpl >>> >>>now try it like this >>> >>>http://www.yourdomain.com/special.tpl::$DATA >>> >>>All source code is revealed, even the special webdna data, >>> >>>this applies to all special CGI's running on IIS like ASP and Pearl. Try it. >>>Hit your favorite microsoft server and add the url ::$DATA and you will see >>>the special source code. >>> >>>Look here, this page is running Microsofts ASP and you can read it all. >>> >>>heheheh Pretty cool >>> >>>http://backoffice.microsoft.com/downtrial/default.asp::$DATA >>> >>>bummer is it also works on .tpl and the rest as well, I don't know about the >>>encrypted pages available with 3.0 but I would be interested in hearing from >>>others. >>> >>>Robert Minor >>>Cybermill Communications >>> >> > >Webmaster >Mind Information Systems > > >http://www.mindinfo.com >
Associated Messages, from the most recent to the oldest:
And who could possible do that to all of their sites and all the tpl/asp/etc. My god what an awful patch to an ugly problem. Not to mention the customers who lease space on our servers. -----Original Message----- From: Raymond Hatch To: WebDNA-Talk@smithmicro.com Date: Thursday, July 02, 1998 4:47 PM Subject: Re: Major Security Hole IIS NT >great idea but unfortunately the include tag will point to the file >location that they can go to and look at it there. > >Ray > >At 04:04 PM 7/2/98, you wrote: >>Another work around is to creat a file that has the search code it it and >>use the include tad. That way all they will see is the tag. >> >> >> >>At 11:13 AM 7/2/98, you wrote: >>>IIS reveals all special CGI Code >>> >>>Think no one can read your contextual searches, think again. >>> >>>Hit your webpage on an IIS server >>> >>>like http://www.yourdomain.com/special.tpl >>> >>>now try it like this >>> >>>http://www.yourdomain.com/special.tpl::$DATA >>> >>>All source code is revealed, even the special webdna data, >>> >>>this applies to all special CGI's running on IIS like ASP and Pearl. Try it. >>>Hit your favorite microsoft server and add the url ::$DATA and you will see >>>the special source code. >>> >>>Look here, this page is running Microsofts ASP and you can read it all. >>> >>>heheheh Pretty cool >>> >>>http://backoffice.microsoft.com/downtrial/default.asp::$DATA >>> >>>bummer is it also works on .tpl and the rest as well, I don't know about the >>>encrypted pages available with 3.0 but I would be interested in hearing from >>>others. >>> >>>Robert Minor >>>Cybermill Communications >>> >> > >Webmaster >Mind Information Systems > > >http://www.mindinfo.com >
Bob Minor
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
Search/sort in URL Was: GuestBook example (1997)
Programmer Needed (1998)
[WC 2.1.30] Stack overflow. (2000)
http://www.teamorganizer.net/tour5.html (2000)
Potential Conflicts? (1997)
[OT] SMTP gateway software for Mac (1999)
& Aftermath (1999)
attn: smitmicro - cart limitation (2002)
Generating unique SKU from [cart] - Still Stumped... (1997)
[SEARCH] Context for SKU prices not working... (1998)
PCS Frames (1997)
Who is doing sign-ups-got it (1998)
Forms Search Questions (1997)
Logical and or in [hideif] (1997)
Re:redirect from the errorsMessages.db entry (1997)
relational db question (2002)
Limitations on fields? Server is crashing (1997)
Modifying order output (1997)
The List is Changing (1997)
Upgrading old WebCat Database Files (1997)