anyone heard of /escape vulnerability ?

Hi !

We recently had a network audit conducted on our network and I could
access the oral report. Unfortunately, the contact dit not seem to know
much about what was being told so...

As the subject says, what is a "slash escape" vulnerabiltiy ? The audit
was made on a IIS server. Googel searches are quite complex with such
term as I have to find a "/escape" pattern... = (

..antoine

.Saphyr

..Saphyr <> randomly produced:

:: Hi !
::
:: We recently had a network audit conducted on our network and I could
:: access the oral report. Unfortunately, the contact dit not seem to
:: know much about what was being told so...
::
:: As the subject says, what is a "slash escape" vulnerabiltiy ? The
:: audit was made on a IIS server. Googel searches are quite complex
:: with such term as I have to find a "/escape" pattern... = (
::
:: .antoine

I think you are possibly talking about breaking out of the root directory?

This is how most of the old web based exploits worked

e.g. on a Linux machine:

www.yourdomain.com/../../etc/passwd

or on Windows:

www.yourdomain.com/../../../WINNT/repair/sam

etc

Google a little on such things (Unicode exploits also work in a similar
fashion).

ST

--


..: http://www.security-forums.com :.

Share your knowledge
It's a way to achieve
Immortality.

Lord Shaolin