I'm able to upload any file to an ASP webapp/IIS server. My first though is to upload an ASP shell but I don't know where the file has been uploaded.
I have written a Python script that beggining with the URLs dumped by ZAP, makes requests to any known folder looking for my ASP file. For example, if I have the following URLs /dashboard and /images and my shell is called myshell.asp my script requests for:
/dashboard/myshell.asp /dashboard/files/myshell.asp /dashboard/downloads/myshell.asp /images/myshall.asp /images/files/myshall.asp /images/downloads/myshell.asp
But I was unable to find the file.
I know that there exist certain special files that if present in a subdirectory have special meaning like: .htdocs. But if I don't know the path I don't know how to exploit this.
Is this scenario exploitable? How?