RE: Double Slashes

[Jeff Robertson <Jeff.Robertson () DigitalInsight com>]

Might I ask why this application needs to use such URLs? I'm trying to guess
what purpose this could serve and coming up blank.

-----Original Message-----
From: Andres Molinetti [mailto:andymolinetti () hotmail com] 
Sent: Thursday, August 04, 2005 10:21 AM
To: Auri () auri net; pen-test () securityfocus com; Jeff Robertson
Cc: webappsec () securityfocus com
Subject: RE: Double Slashes


This IIS has no URLScan running. That's the odd thing. Therefore I think it 
may have been a patch or something.

What I need is a way that the server doesn't strip my slashes and let me 
send an url like this "www.example.com/dir//page.asp".

Any ideas?

> From: "Auri Rahimzadeh" <Auri () auri net>
> Reply-To: <Auri () auri net>
> To: 'Andres Molinetti' <andymolinetti () hotmail com>,    
> <pen-test () securityfocus com>,    Jeff Robertson 
> <Jeff.Robertson () DigitalInsight com>
> CC: <webappsec () securityfocus com>
> Subject: RE: Double Slashes
> Date: Thu,  4 Aug 2005 08:58:11 -0500
>
>
> Look at URLScan and the IIS Locktown Utility. Just search for it at
> Microsoft's web site.
>
> Best,
>
> -Auri
>  Author
>  "Geek My Ride" (available at Amazon and most bookstores!)
>  www.GeekMyRide.net
> ---------- Original Message ----------------------------------
> From: Jeff Robertson <Jeff.Robertson () DigitalInsight com>
> Date:  Thu, 4 Aug 2005 09:45:11 -0400
>
> > This is very similar to what is being talked about wrt to Apache in 
> > the thread of messaeges called "Heavy Security Issue" today. Maybe 
> > IIS had something similar, and this is how they fixed it.
> >
> > -----Original Message-----
> > From: Andres Molinetti [mailto:andymolinetti () hotmail com]
> > Sent: Thursday, August 04, 2005 9:30 AM
> > To: pen-test () securityfocus com
> > Cc: webappsec () securityfocus com
> > Subject: Double Slashes
> >
> >
> > Is there anyway to encode a "//" in a GET request to an .ASP page in 
> > IIS
> 5.0
> > (patched up2date)
> >
> > For example..
> >
> > GET /dir1//dir2.asp HTTP/1.0
> >
> > IIS seems to convert to a single slash the following ones: //
> > \\
> > /./
> > /../
> > ///////// ...
> >
> > Not sure if it is some fix to old unicode and double enconding bugs.
> >
> > Regards,
> >
> > Andy
> >
> > _________________________________________________________________
> > ¿Estás pensando en cambiar de coche? Todas los modelos de serie y 
> > extras
> en
> > MSN Motor. http://motor.msn.es/researchcentre/

_________________________________________________________________
Un amor, una aventura, compañía para un viaje. Regístrate gratis en MSN Amor

& Amistad. http://match.msn.es/match/mt.cfm?pg=channel&tcid=162349