Developer's Guide to Web Application Security

■

ASP Calls to Server.CreateObject() that create Scripting.FileSystemObject

objects. Access to the file system is controlled via the use of the

Scripting.FileSystemObject; so if the application doesn’t use this object, you

don’t have to worry about file system vulnerabilities.The MapPath function

is typically used in conjunction with file system access, and thus serves as a

good indicator that the ASP page does somehow interact with the file

system on some level.

■

Uses of the ChooseContent method of an IISSample

.ContentRotator object (look for Server.CreateObject() calls for

IISSample.ContentRotator).

■

Perl Calls to the functions chmod, chown, link, lstat, ...