I investigated a situation where 300+ websites hosted on an IIS server were pwned by a hacker. Investigation led me to a text file that contained malicious ASP-classic code. The file was named dz.asp;.txt and I just realized that IIS happily executed this file without complaining.

So my question is: is this behavior normal? Shouldn't IIS treat this file as a .txt file instead of .asp?

1 Answer 1


It became known in 2009 that IIS had a vulnerability in that it determined filetype by the part of the filename preceeding a semicolon if there was one in the name.

See this NIST description for more details.

  • Did they ever fix it?
    – Salman A
    Commented Aug 30, 2012 at 12:31
  • This is a good example of why whitelists/blacklists just aren't good enough. You should always store user-uploaded data outside of the docroot and use a passthrough script to display it back to the user. Commented Sep 2, 2012 at 12:18
  • mgkrebbs - over at Area 51, you signed up as a follower on the Genealogy Q&A proposal. bit.ly/U3vnDX We're now in Commitment Phase. It would really help the proposal get to Beta if you could "Commit". Sorry to add this comment here, but it was the only way I could see to contact you.
    – lkessler
    Commented Sep 16, 2012 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.