I\'m able to upload any file to an ASP webapp/IIS server. My first though is to

Question

I'm able to upload any file to an ASP webapp/IIS server. My first though is to upload an ASP shell but I don't know where the file has been uploaded.

I have written a Python script that beggining with the URLs dumped by ZAP, makes requests to any known folder looking for my ASP file. For example, if I have the following URLs /dashboard and /images and my shell is called myshell.asp my script requests for:

/dashboard/myshell.asp /dashboard/files/myshell.asp /dashboard/downloads/myshell.asp /images/myshall.asp /images/files/myshall.asp /images/downloads/myshell.asp

But I was unable to find the file.

I know that there exist certain special files that if present in a subdirectory have special meaning like: .htdocs. But if I don't know the path I don't know how to exploit this.

Is this scenario exploitable? How?

Explanation / Answer

It really all depends on the configuration of the system you are trying to attack. The fact that you are allowed to upload a file of any type or size (as indicated in your question) is promising. Most file upload vulnerabilities are stopped at the validation level. The most straightforward way is what you are doing right now, to see if you can access the file you uploaded, but there may be other unknown attack vectors present. For example, maybe the uploaded files are accessed by staff, or the owner of the web server and you can upload something that will help exploit when ran. For the time being, I recommend you keep trying directory busting to discover a possible directory where you can find your uploaded file. You can use tools such as Burp Suite's intruder or Dirbuster. To directly answer your question if it is exploitable or not is not possible. Stay vigilant and get creative with your exploits. Good luck!

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.