WebDAV Exploit Checking Tool

IIS 6 sites with the WebDAV extension enabled may be vulnerable to authentication bypass because of a bug in the way that the extension handles Unicode characters.

Cutting the URI path with random Unicode characters allows hackers to bypass the access control list. Depending on the permissions of the Web server files, a hacker would be able to retrieve user names and passwords, upload, overwrite and delete files, or run malicious code.



FAQs

Got questions about dotDefender? Please visit our knowledgebase for answers or contact Support at support@applicure.com.


Featured Blog Posts

The Most Vulnerable Programming Languages

Normally, studies of Web application security involves which type of vulnerability is most common or ... read more ...

Web Hacking Facts and Figures

According to a new Data Breach Investigations Report from global comms and IT provider Verizon ... read more ...

Risks in Social Network Security

In a recent article, Social networks face user content risks, Web application vulnerabilities, Robert Westervelt ... read more ...

Use the WebTuff utility to check your system vulnerability:

  1. Try to retrieve the file at the given URI using a simple WebDAV GET command
  2. Try to retrieve the file at the given URI using a simple WebDAV GET command, cutting the URI with these Hex | Unicode characters: %c0 and %af.
  3. Save the retrieved file locally and / or report server response

Download the Free WebTuff Tool:
WebTuff link (zip file containing win32 binary + Python source code)
WebTuff-MD5 (MD5 hash of WebTuff binary)


Related Articles:

DedicatedNOW and Applicure Partnership
QualiSpace Nova Secures Customers
Frost & Sullivan Award

Please Wait...