Re: Major Security Hole IIS NT
This WebDNA talk-list message is from 1998
It keeps the original formatting.
numero = 18630
interpreted = N
texte = And who could possible do that to all of their sites and all the tpl/asp/etc. My god what an awful patch to an ugly problem. Not to mention the customers who lease space on our servers. -----Original Message----- From: Raymond Hatch
To: WebDNA-Talk@smithmicro.com Date: Thursday, July 02, 1998 4:47 PM Subject: Re: Major Security Hole IIS NT >great idea but unfortunately the include tag will point to the file >location that they can go to and look at it there. > >Ray > >At 04:04 PM 7/2/98, you wrote: >>Another work around is to creat a file that has the search code it it and >>use the include tad. That way all they will see is the tag. >> >> >> >>At 11:13 AM 7/2/98, you wrote: >>>IIS reveals all special CGI Code >>> >>>Think no one can read your contextual searches, think again. >>> >>>Hit your webpage on an IIS server >>> >>>like http://www.yourdomain.com/special.tpl >>> >>>now try it like this >>> >>>http://www.yourdomain.com/special.tpl::$DATA >>> >>>All source code is revealed, even the special webdna data, >>> >>>this applies to all special CGI's running on IIS like ASP and Pearl. Try it. >>>Hit your favorite microsoft server and add the url ::$DATA and you will see >>>the special source code. >>> >>>Look here, this page is running Microsofts ASP and you can read it all. >>> >>>heheheh Pretty cool >>> >>>http://backoffice.microsoft.com/downtrial/default.asp::$DATA >>> >>>bummer is it also works on .tpl and the rest as well, I don't know about the >>>encrypted pages available with 3.0 but I would be interested in hearing from >>>others. >>> >>>Robert Minor >>>Cybermill Communications >>> >> > >Webmaster >Mind Information Systems > > >http://www.mindinfo.com >
Associated Messages, from the most recent to the oldest:
And who could possible do that to all of their sites and all the tpl/asp/etc. My god what an awful patch to an ugly problem. Not to mention the customers who lease space on our servers. -----Original Message----- From: Raymond Hatch To: WebDNA-Talk@smithmicro.com Date: Thursday, July 02, 1998 4:47 PM Subject: Re: Major Security Hole IIS NT >great idea but unfortunately the include tag will point to the file >location that they can go to and look at it there. > >Ray > >At 04:04 PM 7/2/98, you wrote: >>Another work around is to creat a file that has the search code it it and >>use the include tad. That way all they will see is the tag. >> >> >> >>At 11:13 AM 7/2/98, you wrote: >>>IIS reveals all special CGI Code >>> >>>Think no one can read your contextual searches, think again. >>> >>>Hit your webpage on an IIS server >>> >>>like http://www.yourdomain.com/special.tpl >>> >>>now try it like this >>> >>>http://www.yourdomain.com/special.tpl::$DATA >>> >>>All source code is revealed, even the special webdna data, >>> >>>this applies to all special CGI's running on IIS like ASP and Pearl. Try it. >>>Hit your favorite microsoft server and add the url ::$DATA and you will see >>>the special source code. >>> >>>Look here, this page is running Microsofts ASP and you can read it all. >>> >>>heheheh Pretty cool >>> >>>http://backoffice.microsoft.com/downtrial/default.asp::$DATA >>> >>>bummer is it also works on .tpl and the rest as well, I don't know about the >>>encrypted pages available with 3.0 but I would be interested in hearing from >>>others. >>> >>>Robert Minor >>>Cybermill Communications >>> >> > >Webmaster >Mind Information Systems > > >http://www.mindinfo.com >
Bob Minor
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
using showpage and showcart commands (1996)
no template caching (1997)
[Sum] function? (1997)
2.1 Stuff (1998)
Next X hits (1996)
Nested search (1997)
Spiders, robots, whatever you want to call them (1998)
legal html [ConvertChars] (2007)
redirect with frames (1997)
WebCatalog can't find database (1997)
[SHOWIF]s and empty arguments (1997)
Plugin or CGI or both (1997)
Protect Tag and Groups (1998)
RE:formula.db problems (1999)
RE: [redirect] w/o showing args? (1999)
ShowNext and random sort (1998)
Overseas project (2000)
[carts] and databases (1997)
problem serving foreign languages text (1997)
carriage returns in data (1997)