Collected research
IIS Application vs. Folder Detection During Blackbox Testing
Requesting a built-in ASP.NET service endpoint such as profile_json_appservice.axd/jsdebug under any path reveals whether that path is an IIS application, which answers with 200 and JavaScript, or merely a folder, which answers 500. Knowing which decides whether an upload can become code execution via web.config and supplies the application path needed to forge ViewState payloads.
Record
- Researcher
- Soroush Dalili
- Published by
- soroush.me
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .