Re: Major Security Hole IIS NT
This WebDNA talk-list message is from 1998
It keeps the original formatting.
numero = 18598
interpreted = N
texte = Holy Crap...........quick PCS, release that unix port!!!At 11:13 AM 7/2/98, you wrote:>IIS reveals all special CGI Code>>Think no one can read your contextual searches, think again.>>Hit your webpage on an IIS server>>like http://www.yourdomain.com/special.tpl>>now try it like this>>http://www.yourdomain.com/special.tpl::$DATA>>All source code is revealed, even the special webdna data,>>this applies to all special CGI's running on IIS like ASP and Pearl. Try it.>Hit your favorite microsoft server and add the url ::$DATA and you will see>the special source code.>>Look here, this page is running Microsofts ASP and you can read it all.>>heheheh Pretty cool>>http://backoffice.microsoft.com/downtrial/default.asp::$DATA>>bummer is it also works on .tpl and the rest as well, I don't know about the>encrypted pages available with 3.0 but I would be interested in hearing from>others.>>Robert Minor>Cybermill Communications> WebmasterMind Information Systemshttp://www.mindinfo.com
Associated Messages, from the most recent to the oldest:
Holy Crap...........quick PCS, release that unix port!!!At 11:13 AM 7/2/98, you wrote:>IIS reveals all special CGI Code>>Think no one can read your contextual searches, think again.>>Hit your webpage on an IIS server>>like http://www.yourdomain.com/special.tpl>>now try it like this>>http://www.yourdomain.com/special.tpl::$DATA>>All source code is revealed, even the special webdna data,>>this applies to all special CGI's running on IIS like ASP and Pearl. Try it.>Hit your favorite microsoft server and add the url ::$DATA and you will see>the special source code.>>Look here, this page is running Microsofts ASP and you can read it all.>>heheheh Pretty cool>>http://backoffice.microsoft.com/downtrial/default.asp::$DATA>>bummer is it also works on .tpl and the rest as well, I don't know about the>encrypted pages available with 3.0 but I would be interested in hearing from>others.>>Robert Minor>Cybermill Communications> WebmasterMind Information Systemshttp://www.mindinfo.com
Raymond Hatch
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
Almost a there but..bye bye NetCloak (1997)
sort problems....bug or brain fart? (1997)
Search in 2 or more catalogs (1997)
WebTen and WebCat (1997)
Help name our technology! (1997)
WebCat2b12 Mac.acgi--[searchstring] bug (1997)
Comments Convertion (1998)
Sku numbers (1997)
migrating from MacOS to unix (2000)
WebCatalog/WebMerchant 2.1 (1998)
WebCatalog [FoundItems] Problem - AGAIN - (1997)
Car Database (2002)
date (1999)
WebCat/CyberStudio Compatibility (1998)
2.0 Info (1997)
Re:quit command on NT (1997)
Math Problem - Format? (1997)
Mac: LModelDirector bug fix (1997)
Re:2nd WebCatalog2 Feature Request (1996)
E-Mailer (WebCatb15acgiMac) (1997)