Other nomination

IIS5.1 Directory Authentication Bypass by using ":$I30:$Index_Allocation"

Soroush Dalili

Appending the NTFS alternate data stream name ':$I30:$INDEX_ALLOCATION' to a directory in an IIS 5.1 URL reaches the same folder while defeating directory-based authentication, because IIS matches only the literal directory name. IIS 6 and 7 reject a colon before the query string, and '::$DATA' is already blocked in 5.1.

Record

Researcher

Soroush Dalili

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Related sources

• Technical report

Tags

• auth-bypass
• filter-bypass
• path-traversal
• url-parsing
• parser-differential
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host.