Re: Can any programs download actual ASP content?

Leif K-Brooks wrote:
I was talking to my host company representative this evening, and he thought that certain web crawlers (he mentioned Offline Explorer
/and/ Anawave WebSnake would be able to download the actual ASP pages
rather than simply downloading the page as modified by IIS.

There is no by-design way to do that. 

True

There could potentially be
security holes in IIS which would allow for direct file access

There were !
One of the most famous one was :
http://www.microsoft.com/technet/security/Bulletin/MS98-003.mspx (the well known $DATA hole)

But nowdays if you're using a well maintained server, there shouldn't be any risk about that.

However, it is still possible to open any file whose extension isn't mapped and located in a directory that is allowed to be readen. That is often a problem with *.inc (files included via SSI)... Note also if no custom ASP error message is defined, the default one includes the path of the concerned file - so it could include the path for the connexion.inc for exemple, which contains the name and password to connect to your database...
You could ask your host provider to disallow reading in a particular directory (IIS option, not to be confused with NTFS permissions) : the files in that directory could always be included in SSI, but any attempt to get them via the web server will be rejected.
.

Relevant Pages

  • Re: Can any programs download actual ASP content?
    ... Anything can download the ASP source _if_ the server can be persuaded to ... This is a server problem, ... Gross misconfiguration of an IIS server will permit this. ... It's _possible_ that some web crawlers automatically try the $DATA ...
    (comp.infosystems.www.authoring.html)
  • II6 and ASP Downloading problem
    ... We are using Windows 2003 with IIS 6. ... We could not be able to download the ... files through ASP that are more than 20 MB. ...
    (microsoft.public.inetserver.iis)
  • Re: Can any programs download actual ASP content?
    ... > thought that certain web crawlers (he mentioned Offline Explorer ... > /and/ Anawave WebSnake would be able to download the actual ASP pages ... security holes in IIS which would allow for direct file access, ...
    (comp.infosystems.www.authoring.html)
  • Download file from different server than IIS
    ... I am trying to use asp to download a file located on a different ... as a valid user on the other server to copy the file back to the IIS ...
    (microsoft.public.inetserver.asp.general)
  • Re: I Dont Know If Its Possible With VBasic, But...
    ... you could just simply place a .asp page on the server that lists ... all of the file's, and download them, with the path, to a temp file, and ... app to download ... Set fldr = Nothing ...
    (microsoft.public.vb.general.discussion)