Fun with IIS

Hiya all :-)

Few days back i had post an article on how to bypass upload validation in php......

But the same i encountered with IIS.....It is quite old bug but thought of sharing with you as it was very helpful to me also......

Let's say there is a website and it allows only image file upload such as jpg, gif, png etc, than all you need to do is as follow

Step 1: Choose any of your shell, does not matter whether asp, aspx or php

step 2: Rename it to something.asp;.gif and upload it

Note: Check semicolon (;) after .asp

Take the direct link to your image and open it, instead of sending it to image handler IIS will treat it as asp script and it will get executed on the server.... ;-)

Countermeasure : Do not give execute permission to the folder where images are being uploaded....That's it....Quite simple yet effective way.....