I investigated a situation where 300+ websites hosted on an IIS server were pwned by a hacker. Investigation led me to a text file that contained malicious ASP-classic code. The file was named
dz.asp;.txt and I just realized that IIS happily executed this file without complaining.
So my question is: is this behavior normal? Shouldn't IIS treat this file as a
.txt file instead of