A safe dog approach

In the iis6.0environment of a website, the fckeditoreditor can successfully upload x.asp;.txt, and the script execution permission is not removed from the directory.
 

However, when a Dongle uploads a URL (x.asp;.txt), the script is automatically deleted. However, if the file in this directory is x. asp, it can be accessed normally and will not be deleted.

 

After my tests, we can break through the limits of safedog. I passed a large amount of x.asp;.txt. You can write a program. 1

The figure here is just an example of a small part. We have uploaded nearly 1000 images. Every x.asp.txt code generates a new 1. asp Trojan file in the current directory. Every x.asp;(n).txt
 

We use Firefox's downthemall plug-in for sequential access, 2

1. asp Trojan is generated successfully.
 

 

Whether your asp Trojan is safe is not covered in this article.