Soroush Dalili (@irsdl) Blog

A web application security ninja 🥷, a semicolon enthusiast!

Skip to content
  • Home
  • Advisories
  • Privacy Policy
  • Bug Bounty Invites!
  • Work
  • Sponsorship

IE7-8 drive list enumeration!

Iframe delay in loading the local drives in IE7 and IE8 can cause drive list enumeration!
Proof of Concept is available from this link:
http://0me.me/demo/ie_drive_enum/IE-drive-enum-demo.html

Cheers,
Soroush Dalili

This entry was posted in My Advisories, Security Posts on March 4, 2010 by Soroush Dalili.

Post navigation

← Microsoft IIS Semi-Colon Vulnerability Improve File Uploaders’ Protections – Bypass Methods- Rev. 1.0 →
  • Twitter
  • GitHub
  • LinkedIn
  • MongoDB NoSQL Injection with Aggregation PipelinesJune 23, 2024
  • Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework (CVE-2023-36899 & CVE-2023-36560)August 8, 2023
  • Anchor Tag XSS Exploitation in Firefox with Target=”_blank”August 1, 2023
  • Thirteen Years On: Advancing the Understanding of IIS Short File Name (SFN) Disclosure!July 31, 2023
  • My MDSec Blog Posts so far in 2020/2021!October 31, 2020
  • File Upload Attack using XAMLX FilesSeptember 21, 2019
  • Uploading web.config for Fun and Profit 2August 15, 2019
  • IIS Application vs. Folder Detection During Blackbox TestingJuly 9, 2019
  • Danger of Stealing Auto Generated .NET Machine KeysMay 10, 2019
  • x-up-devcap-post-charset Header in ASP.NET to Bypass WAFs Again!May 4, 2019
  • Exploiting Deserialisation in ASP.NET via ViewStateApril 23, 2019
  • Yet Other Examples of Abusing CSRF in LogoutApril 23, 2019
  • How to win BIG and even more!April 17, 2019
  • Finding and Exploiting .NET Remoting over HTTP using DeserialisationMarch 26, 2019
  • More research on .NET deserializationDecember 19, 2018
  • Feel honoured to be there again after 8 years: Top 10 Web Hacking Techniques of 2017December 19, 2018
  • Story of my two (but actually three) RCEs in SharePoint in 2018December 19, 2018
  • ASP.NET resource files (.RESX) and deserialization issuesAugust 12, 2018
  • MS 2018 Q4 – Top 5 Bounty Hunter for 2 RCEs in SharePoint OnlineAugust 12, 2018
  • WAF Bypass Techniques – Using HTTP Standard and Web Servers’ BehaviourAugust 12, 2018

Blog Tags

  • .Net Framework
  • Anti-XSS bypass
  • AntiXSS bypass
  • ASP.NET
  • bug bounty
  • bugbounty
  • bypass
  • Challenge
  • deserialisation
  • deserialization
  • ecommerce
  • ExternalInterface
  • ExternalInterface.call
  • file upload
  • file upload bypass
  • file uploader bypass methods
  • file uploader security bypass
  • financial
  • flash
  • flash xss
  • guideline
  • iis
  • IIS File Extension Security Bypass
  • iis short file name
  • IIS Tilde bug
  • IIS tilde feature
  • IIS tilde vulnerability
  • jar protocol
  • machine.config
  • machinekey
  • penetration testing
  • RCE
  • request encoding
  • sharepoint
  • Short name scanner
  • SQL Injection
  • Unrestricted File Download
  • Unrestricted File Upload
  • viewstate
  • waf
  • WAF bypass
  • web.config
  • XSS
  • XSS Vulnerability
  • ysoserial.net

RSS REDDIT Web Security Research

  • The Ruby on Rails _json Juggling Attack December 10, 2024 /u/albinowax
  • Remote Code Execution with Spring Boot 3.4.0 Properties December 6, 2024 /u/Material-Beach13
  • Bypassing WAFs with the phantom $Version cookie December 4, 2024 /u/albinowax
  • XS-Leaks through Speculation Rules December 4, 2024 /u/albinowax
  • Gem::SafeMarshal escape December 4, 2024 /u/albinowax
  • Cross-Site POST Requests Without a Content-Type Header November 27, 2024 /u/albinowax
  • Turning an XML file write into RCE in Spring November 27, 2024 /u/albinowax
  • Ruby 3.4 Universal RCE Deserialization Gadget Chain November 25, 2024 /u/t0xodile
  • Exploring the DOMPurify library: Bypasses and Fixes November 17, 2024 /u/albinowax
  • Introducing lightyear: a new way to dump files in PHP November 4, 2024 /u/cfambionics

RSS Reddit netsec Channel Feed

  • CVE-2024-44825 - Invesalius Arbitrary File Write and Directory Traversal December 20, 2024
  • New Windows Privilege Escalation Vulnerability! December 19, 2024
  • I'm Lovin' It: Exploiting McDonald's APIs to hijack deliveries and order food for a penny December 19, 2024
  • Exploiting reflected input via the Range header December 19, 2024
  • How an obscure PHP footgun led to RCE in Craft CMS December 19, 2024

RSS Exploit-DB Feed

  • [webapps] SOPlanning 1.52.01 (Simple Online Planning Tool) - Remote Code Execution (RCE) (Authenticated)
  • [webapps] reNgine 2.2.0 - Command Injection (Authenticated)
  • [webapps] dizqueTV 1.5.3 - Remote Code Execution (RCE)
  • [webapps] openSIS 9.1 - SQLi (Authenticated)
  • [dos] Windows TCP/IP - RCE Checker and Denial of Service

Privacy Policy Proudly powered by WordPress