AOH :: HP Unsorted T :: BU-1355.HTM

Tests about semicolon zero-day (BID 37460)



Tests about semicolon zero-day (BID 37460)
Tests about semicolon zero-day (BID 37460)



Tests about semicolon zero-day (BID 37460)

Tests in Windows XP SP3 and IIS 5.1
The results are:
18:21:18 172.16.5.79 GET /t.asp;.jpg 200
The file founded,  but not interpreted! IIS print the asp souce code at screen.

Testing in 2003 Server IIS 6.0 SP 2 works perfect!  the .jpg is
interpreted as .asp
2009-12-28 18:56:37 W3SVC1 172.16.5.79 GET /t.asp;.jpg - 80 -
172.16.6.16 Mozilla/4.0+(compatible;+MSIE+
8.0;+Windows+NT+5.2;+Trident/4.0;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+.NET+CLR+3.0.04506.648;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729)
200 0 0

Testing in 2008 Server  IIS 7.0 SP1
Return same Windows XP, source code printed at screen.

-------------------
Crash
DcLabs

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.