Use the URLScan tool to filter special characters in URLs (IIS6 only)--Resolve IIS short file name vulnerabilities

the IIS short file name vulnerability is very common on Windows servers, that is, using the "~" Word Fu Chai to expose short files/folder names, such as constructing url:http://aaa.com/abc~1/.aspx in this way, Depending on the error message returned by IIS, guess if the path or file exists, refer to this article: http://www.freebuf.com/articles/4908.html.

Simply to solve this problem, Microsoft's URLScan tool is the most suitable for a lightweight tool, the key is free, and the installation, configuration is very simple. The installation process is not said, the fool type. After installation, add an ISAPI filter in the properties of the site where you want to make the URL filter, where the DLL path is: C:windowssystem32inetsrvurlscan. This directory also has a configuration file: Urlscan.ini, Microsoft's article in the more detailed: HTTP://SUPPORT.MICROSOFT.COM/KB/326444/ZH-CN.

For the "~" character filtering is very simple, in the [DenyUrlSequences] section add a ~ on the line. Finish the call, scan through.

Ps:

1. This function has been built into the IIS7. (iis-"Request Filter-" url-"Add reject Sequence-" URL sequence set to "~")

2. If you use Chinese characters in the URL, you need to set Allowhighbitcharacters to 1.

Use the URLScan tool to filter special characters in URLs (IIS6 only)--Resolve IIS short file name vulnerabilities