[thegreatbeast666]

Well I just said that I was going to earn my membership by posting useful things but I have a question that I can't seem to answer on my own. I am currently in the process of developing my personal website and blog. I just picked up a host yesterday that supports asp.net and dot net framework 4.0 While I was working on some code today that was intended to write data to an xml file on the fly to update a silver light app I made I ran into a problem with the code (c#). I couldn't seem to point to the directory on the server where the xml file was stored. I turned on remote debugging and was looking at my error messages when I discovered something very strange (to me). For whatever reason I was able to see the full path name. I didnt think this should be the case because even when I run my own server I cant do this. So I built a very VERY simple app that let me mimic a shell to view the directory structure so I could navigate the file system. To my surprise I was able to open and see the contents of a bunch of folders I didnt think I should be able to. Now I confirmed that the user is in fact the NT AUTHORITY\NETWORK SERVICE but I dont think I should be able to see the ROOT folder for all the hosts clients folders. Not only that, I dont think I should be able to navigate to those folders and view the content and write that content out to a text box in this simple app. Maybe I am wrong and this is normal but I just dont think so.

So my first question is: Is this normal?

Second: Is it wise for me to keep looking? I dont think I am doing anything wrong because I am only using the permission I was given but I am not sure so I stopped.

Third: The fact that the root folders for each website is named the USER NAME (I know because mine is listed as well) does that mean this now opens the door to brute force on Every single site hosted here?? (a little over a thousand) (The user name is the same for the FTP log)

I will save all other questions for later, after I find out if this is in fact anything worth talking about :0) Sorry if I am a total Noob and this is all lame. lol

Peace

[1llusion]

Well, now it depends what you wanna do. You were somehow lucky to get the access, I don't think its normal.

So, if you wanna be polite, you could report this "bug" and if you are lucky again, you could gain some bonus.

Or you can build a new app to use this and go blackhat and set-up java drive-by on all other sites and build a huge botnet - I don't suggest this option.

Or you can ignore it... but if they find out, you might get into trouble.

On your other question- In theory, yes. Now, do they have some anti-bruteforce protection?

[thegreatbeast666]

I don't know how I find out for sure if they have brute force protection but I just tried logging in via the windows console FTP client using my username but bad passwords and I failed 10 times. I would have thought after so many bad passwords it would have kicked me off, maybe I am wrong. As far as the black hat stuff goes, I am very interested in all of it and learning everything there is to learn. However, I have no intention on doing anything that would be illegal. I've already been in trouble once and I would rather not have that happen again. I think its ironic that this would happen to me while I was trying to work on and develop my personal web site where I want to tell my story and track my learning and progress. Some might think it's fate :0) I was thinking that maybe my best approach might be to contact any interesting looking<- (Read: looks like they have money to spend) site admins and let them know they are at risk. Then again, I'm not even 100% sure if I can do anything with this yet. I am a little worried about trying to test the limits of this problem.