Have Geek Brain

Is it possible for IIS 6 to serve raw ASP / ASPX pages?

The only thing I could find on this subject is posting from 1997 ( http://insecure.org/sploits/microsoft.asp.iis.html ) so I was hoping someone here might have more recent knowledge on this topic:

Does anyone know if there are any known vulnerabilities in IIS6 that would allow a user to view a raw ASP or ASPX page, other than gaining control of the server?

+1


source to share


4 answers


IIS will only serve raw asp or aspx if those extensions are removed from the application mappings for the site or if you've done some other nebulous thing to configure it that way.



+4


source


Why do you need raw ASP pages? You can only have a link that exits the page and puts it in the web page for the user.



For me, this would be a potential security risk, because if you forgot and left a security vulnerability, it would be visible.

+1


source


If you didn't have your script mappings set up, this might be a problem, but it is more of a deployment time issue than a runtime issue.

I think any other vulnerabilities in this area would be application related (choosing a file to download the server side ...) not much platform related.

+1


source


Are you worried that people can see your source code? If so, I wouldn't worry too much about it, especially with .net and using code behind the files and a well-formed n-tier site.

Indeed, the only time it is of concern is if you have a bug in your page and you spit out debug code even with classic asp.

+1


source






More articles:


All Articles