STM suffix asp ssi debugging upload Trojan

STMIs a fileSuffix

The request for test. STM in the browser is blank. But checkSource codeIs the actual content of the file.ASPFile, you can view the ASP source code.

Check the IIS server/main directory/configuration/ ing/STM and find that the file with this suffix resolved by IIS isC:/Windows/system32/inetsrv/ssinc. dll That is, server inclusion.

With this feature, you canDebuggingASPProgramFor example, an ASP file contains a lot of include file = "". If you want to see if there are any duplicates or other such files, you can change the suffix of this file to STM and browse it in a browser.Code.

Some websites are not allowed to upload ASP, aspx, htm, and HTML files, but there is no restriction on the file suffix. You can upload an X. stm file to the server. Write in code<! -- # Include file = "conn. asp" --> if you know the preparation position of conn. asp, you can use the relative path to locate it. Then, you can view the data at a glance. In this caseTrojan.

Note: You can use STM to debug ASP and delete this ing When configuring IIS. The last time a student tried to view all the code contained in an ASP file, he forgot the specific suffix even though he remembered it. At the moment, Google and Baidu could not find it, I forgot to check the IIS ing. Today, I think that good memory is not as good as bad writing. If you insist on seeing it, I believe this article is useful to you.