NET IIS暴绝对路径漏洞（netIink）学会了吗

🌐 经济型：买域名、轻量云服务器、用途：游戏网站等《腾讯云》特点：特价机便宜适合初学者用点我优惠购买

🚀 拓展型：买域名、轻量云服务器、用途：游戏网站等《阿里云》特点：中档服务器便宜域名备案事多点我优惠购买

🛡️ 稳定型：买域名、轻量云服务器、用途：游戏网站等《西部数码》特点：比上两家略贵但是稳定性超好事也少点我优惠购买

文章摘要

这篇文章揭示了Microsoft ASP.NET 1.1版本中一个潜在的安全漏洞，当错误配置启用并访问以~开头的不可用文件时，可能会导致远程用户获取完整的目录信息。例如，点击链接后在URL后输入如"~fly_ocean.aspx"，即可暴露出绝对路径。该漏洞已被修复于版本2，并可通过启用错误过滤或其他安全补丁来解决。文章提醒用户注意ASPx文件的使用，并建议在开发中避免此类做法。

Title:Microsoft ASP.NET May Disclose Web Directory to Remote Users in Certain Cases

Description: If the ASP.NET application does not filter the error message, the web

directory information may be disclosed to remote users by using an unavailable file

which start with “~”.

Hi, I’m Soroush Dalili from GrayHatz Security Group(GSG).I found new thing in .NET

Framework Version:1.1 (.ASPX Files).

If error mode in .net configuration is on, Run an unavailable aspx file that start with

“~” can cause showing full path in browsers.

For Example: Http://[URL]/~foo.aspx

————————————————————————

Note:Version 2 have not this bug and it return file does not exist

Vendor URL: www.microsoft.com