From: Michael Howard (mikehowmicrosoft.com)
Date: Wed Jun 09 2004 - 12:09:28 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Iis won't serve up global.asa to users, that said, you shouldn't store sensitive data in there either!

[Writing Secure Code 2nd Edition] http://www.microsoft.com/mspress/books/5957.asp
[Protect Your PC] http://www.microsoft.com/protect
[Blog] http://blogs.msdn.com/michael_howard
[Annual Security Training] http://mste/training/offerings.asp?offeringid=7142

-----Original Message-----
From: Bénoni MARTIN [mailto:Benoni.MARTINlibertis.ga]
Sent: Tuesday, June 08, 2004 1:18 AM
To: webappsecsecurityfocus.com; pen-testsecurityfocus.com
Subject: Global.asa security under IIS 6.0

Hi list !

I am wondering about how much secure is the "global.asa" file in ASP. It = seems that we can gather there most of the parameters used with our ASP = pages, but it can be also a weakness if a malicious guy gets access to = it !

So anyone one knows how secure is it to use global.asa, how can we get = it from a website (IIS refuses access to it with an = http://blahblahblah.com/global.asa)...and how can we avoid people = stealing if ?

Thanks in advance!

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]