RE: IIS log

["Michael Howard" <mikehow () microsoft com>]

Iis doesn't log credit card numbers!!! There's no concept of CCs in
HTTP!!! 

My guess, and it is a guess, is some other app running on top of iis is
logging the data, or the data is in the URI

Can you send me a snippet of the log?replace the CC# with something
bopgus

-----Original Message-----
From: Justin H Tran [mailto:justint () us ibm com] 
Sent: Tuesday, August 05, 2003 12:35 PM
To: webappsec () securityfocus com
Subject: IIS log





I just viewed an IIS log and I noticed that the credit card # is
loogged.
I beleive that this is a major flaw to log credit card # is clear text.
Does anyone have any advice?


Regards,
Justin