RE: Double Slashes

[Jeff Robertson <Jeff.Robertson () DigitalInsight com>]

This is very similar to what is being talked about wrt to Apache in the
thread of messaeges called "Heavy Security Issue" today. Maybe IIS had
something similar, and this is how they fixed it.

-----Original Message-----
From: Andres Molinetti [mailto:andymolinetti () hotmail com] 
Sent: Thursday, August 04, 2005 9:30 AM
To: pen-test () securityfocus com
Cc: webappsec () securityfocus com
Subject: Double Slashes


Is there anyway to encode a "//" in a GET request to an .ASP page in IIS 5.0

(patched up2date)

For example..

GET /dir1//dir2.asp HTTP/1.0

IIS seems to convert to a single slash the following ones:
//
\\
/./
/../
///////// ...

Not sure if it is some fix to old unicode and double enconding bugs.

Regards,

Andy

_________________________________________________________________
¿Estás pensando en cambiar de coche? Todas los modelos de serie y extras en 
MSN Motor. http://motor.msn.es/researchcentre/