IIS on Windows NT
File disclosure
File disclosure
No Source information
From: Thomas Lopatic (lopatic@dbs.informatik.uni-muenchen.de) Date: Fri, 26 Jul 1996 20:41:13 +0200 > > and there is another > >'..' error in their Internet Information Server. Anyone offering more? > > I have yet to see this error in IIS. Where and how does it exist? Sorry for not disclosing. I thought I had seen that one on bugtraq. Suppose there is a document 'http://dummy.com/Public/Index.htm' and 'Index.html' is 'C:\inetsrv\wwwroot\Public\Index.htm'. Then try getting 'http://dummy.com/Public/../../../autoexec.bat' which will give you 'C:\autoexec.bat'. It seems, however, that the first directory ('Public') will be necessary, i. e. 'http://dummy.com/../../autoexec.bat' won't work. But now back to the Unix things. -Thomas -- Thomas Lopatic lopatic@informatik.uni-muenchen.de
GET /Public/../../../autoexec.bat