Other nomination

IIS Application vs. Folder Detection During Blackbox Testing

Soroush Dalili · 10 July 2019

Requesting a built-in ASP.NET service endpoint such as profile_json_appservice.axd/jsdebug under any path reveals whether that path is an IIS application, which answers with 200 and JavaScript, or merely a folder, which answers 500. Knowing which decides whether an upload can become code execution via web.config and supplies the application path needed to forge ViewState payloads.

Record

Researcher

Soroush Dalili

Date

10 July 2019

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Tags

• info-leak
• aspnet
• dotnet
• file-upload
• rce

This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host.