bugtraq - Re: Re: IIS5.1 Directory Authentication Bypass by using ?:$I30:$Index

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100903165306.31915.qmail@securityfocus.com>
Date: 3 Sep 2010 16:53:06 -0000
From: steve.povolny@...com
To: bugtraq@...urityfocus.com
Subject: Re: Re: IIS5.1 Directory Authentication Bypass by using
 ?:$I30:$Index_Allocation?

There's not a lot in the way of information about IIS settings required to exploit this.  What I've gleaned so far is IIS 5.1, and a request to a directory using the :$i30:$INDEX_ALLOCATION in the request...Can't seem to replicate this though.  Are there any other settings that you are aware of for IIS?  Basic auth required?  I'd like to find a way to replicate this in our environment.  Thanks!