Other nomination

IIS6/ASP & file upload for fun and profit

Juan Galiana

IIS 6 decides whether ASP.dll should execute a request by scanning URL segments for executable extensions, so a directory named folder.asp makes IIS run any file beneath it - folder.asp/document.pdf executes as ASP. Combined with CVE-2009-4444 semicolons and NTFS alternate data streams (file.asp::$DATA, filename.asp:.jpg), it defeats extension filters in third-party upload components.

Record

Researcher

Juan Galiana

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Tags

• file-upload
• rce
• filter-bypass
• path-traversal
• url-parsing
• parser-differential
• cve
• aspnet
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Juan Galiana, first published at the original source. Preserved copies are kept so the citation survives its host.