I mentioned yesterday that I found a flaw in IIS. It turns out it is a flaw in .NET framework. This flaw allows you to create as many URL’s as you want on somebodies website. All you have to do is link to them or submit a bunch of different URL’s to a zillion directories all linking to the same page. You can do even more damage if the site is using relative URL’s because this trick will change the base URL for that page. I have already seen sites listed in Google this way.
The trick is that you can put (X(aBc-123_ID$=1234)). This is not just some random thing. There are rules. The X has to a capital letter and can only be one letter. The 2nd part can be just about anything. You can’t use star, ampersand, or pound sign. This means you can use equal sign, period, underscore, dash, exclamation point, or comas. Percent sign can only be used when used with URL encoding like %20.
I can not find a way to turn this off. I don’t know enough about .NET to know how to catch it with programming. I am in the process now of finding out. I will post when I find a fix. One quick fix is to turn off .NET. If you are using classic asp there is no reason to have this installed.