OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RE: getting an ASP file

From: Calderon, Juan C (CORP, DDEMESIS) (Juan.Calderonddemesis.ge.com)
Date: Tue Apr 22 2003 - 10:01:21 CDT

*************
         I don't remeber what version of IIS and service pack that had a
security flaw related to this.
         What I remember is that if you put ::$DATA before the file.asp the
server will let you download the source.
         I mean: http://some.server.com/main.asp::$DATA
         Will appear a box to save this file, like a download, but with the
source code of the asp page.
************

oh, that's an old trick, it is very improbable to get the file this way, since patch for this flaw was issued on July 1998

cheers :)