Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>The main problem is to been able to upload a script, an aspx page, in this directory with the photo files, and runs it.</p> <p>Here is one case: <a href="https://stackoverflow.com/questions/4288362/ive-been-hacked-evil-aspx-file-uploaded-called-aspxspy-theyre-still-trying">I&#39;ve been hacked. Evil aspx file uploaded called AspxSpy. They&#39;re still trying. Help me trap them‼</a></p> <p>The solution to that is to add this extra <code>web.config</code> file on the directories that allow to upload files and not permit to run any aspx page. Also double check to allow only extensions that you permit and not allow to change that on the file name, if they have the opportunity to make rename.</p> <pre><code>&lt;configuration&gt; &lt;system.web&gt; &lt;authorization&gt; &lt;deny users="*" /&gt; &lt;/authorization&gt; &lt;/system.web&gt; &lt;/configuration&gt; </code></pre> <p>Also on the directories that you allow to upload files, do not permit to run any other script like simple asp, or php or exe, or anything.</p> <h2>general speaking</h2> <p>All your pages have permissions to run and manipulate many things on the server. What you give now is the ability of <code>write</code> on some directories, also by using some aspx page. The asp.net now have one more extra permission to write files there, on the photo folder. Also note here, that you asp.net page have this control, not the user. What you do there with your code can write on this directories, so must be carefuller there to double check where you write and not allow any other directories, not allow the user to manipulate the directory that can be written to.</p> <p>So this is the weak link. To been able to upload more script that can take control of the server, at least the part that can be access by the asp.net user of this pool.</p>
    singulars
    1. This table or related slice is empty.
    1. POWeb-enabled file storage and security implications of giving delete permission to IIS_IUSRS
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USCommunity
    1. USAristos
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COYes, very good points there. Thanks for the link. Didn't think about using web.config for disallowing aspx execution in sub-folders. So it could be placed in a sub-directory one level above the one with write permissions as an extra precaution in addition to not using original file names/extensions.
      singulars
      1. PO
      1. USconstantine g
    2. COSo what you're saying is that it's not in any way possible for a client to bypass the request pipeline and create/delete files inside a directory that allows it (assuming the person knows the directory structure)? Only the code that handles the request can do it? Any potential exploits? That's the essence of my question.
      singulars
      1. PO
      1. USconstantine g
    3. CO@constantineg The asp.net used did not have permission for write on directories, only permission to read and run. Actually there are two accounts that work together for the asp.net to run. The user, and the pool. Both of them have limited permissions, but if you allow to write on a directory, then there can create code to run and do more - open permissions etc... so there is the point to focus, to not allow to upload any script.
      singulars
      1. PO
      1. USAristos
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload