I have found a arbitrary file download vulnerability in an asp.net application. I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: connecting to database)

This is an piece of web.config fiele:

  <add name="project" connectionString="Data Source=;Database=newdatabase;User ID=sa;Password=123456Aa" />



Prerequisite: Check the server if SQL access from hosts other than localhost is possible.

  1. Log in to the SQL Server and see if you have access to any other databases or tables that could be interesting. (User accounts,...)

  2. Authenticated SQL Exploits now become a possibility.

  3. Try this password on other known users as they might've been reused.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.