On 29 September 2010 12:52, silky <[email protected]> wrote: > My guess from reading the PDF I sent through is that they gain access > to the Web.config by manipulating WebResource somehow (they imply as > much I think). >
Yeah, that is as much as I could glean from the comments on the post. > So, of course it also follows that you should *not* store anything of > any importance in the web.config. This is not so hard. Just load the > important stuff from a file that is not in the web root. I think this > is even possible with one of the MS add-ins (configuration manager or > something, I forget its name sorry). > I agree in principle, but without knowing more about that part of the attack there are other issues: 1. What user is the thread running at at the time those files are read? The AppPool identity or something else? 2. Is there any opportunity for parent pathing out of the web root etc? -- *David Connors* | [email protected] | www.codify.com Software Engineer Codify Pty Ltd Phone: +61 (7) 3210 6268 | Facsimile: +61 (7) 3210 6269 | Mobile: +61 417 189 363 V-Card: https://www.codify.com/cards/davidconnors Address Info: https://www.codify.com/contact
