Re: IIS still revealing paths for web directories

[scott () AXE NET AU (Scott Buchanan)]

Georgi Guninski wrote:
> For Communicator:
> http://www.microsoft.com/%3CIMG%20SRC=javascript:alert("window.location:"+window.location)%3E.ida

This link comes out as:

http://www.microsoft.com/%3CIMG%20SRC=javascript:alert(

presumably because the quotes need to be % encoded as well.

http://www.microsoft.com/%3CIMG%20SRC=javascript:alert(%34window.location:%34%43window.location)%3E.ida

This link, while it seems to work in as far as you can go to the
correct link, the Javascript doesn't get executed on this copy of
Netscape 4.7

-Scott Buchanan
Axe Communications