lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 28 Dec 2009 19:27:51 -0300
From: Crash - DcLabs <>
Subject: Tests about semicolon zero-day (BID 37460)

Tests about semicolon zero-day (BID 37460)

Tests in Windows XP SP3 and IIS 5.1
The results are:
18:21:18 GET /t.asp;.jpg 200
The file founded,  but not interpreted! IIS print the asp souce code at screen.

Testing in 2003 Server IIS 6.0 SP 2 works perfect!  the .jpg is
interpreted as .asp
2009-12-28 18:56:37 W3SVC1 GET /t.asp;.jpg - 80 - Mozilla/4.0+(compatible;+MSIE+
200 0 0

Testing in 2008 Server  IIS 7.0 SP1
Return same Windows XP, source code printed at screen.


Powered by blists - more mailing lists