Re: bug in IIS?

Josh Hillman ( (no email) )
Mon, 23 Jun 1997 16:31:52 -0400

> From: Troy T. Hall <troyh@lemoorecomputers.com>
> IS this a new bug in IIS?
> I found it in my log files.
> just type
> ../?
> and you will be instantly transported to the desktop :-{

Entering this in the address (URL) area in your webbrowser (at least with
MSIE 3.02 NT) displays the desktop contents of the user profile currently
logged in on that same machine. You can do something similar by typing in
a shared resource's UNC path (\\sharedresource) and it will display the
contents of that folder (if it's a folder/directory).

I don't know of any way for an outside user to use this sort of thing to
view the contents of your webserver (unless they were logged onto the
network and had sufficient rights, etc.)

Josh Hillman
hillman@talstar.com