Application mapping - how can I dig deeper?

From: Benman (bmannino_at_gmail.com)
Date: 02/16/05


Date: 16 Feb 2005 09:00:51 -0800

Hi,

I have been wrestling with IIS6 for some time now trying to figure out
my missing link.

I posted a question about 2 weeks ago, and the answer helped me get to
where I am now.

Our dBASE executable files (.DBW extension) were generating 404 Errors
before any Web Service Extensions were added. For testing purposes, I
changed the default 'Prohibit' setting for 'All Unknown CGI Extensions'
to 'Allow' and the .DBW file executed perfectly.

Just to paint a more complete picture, the .dbw was generated by dBASE
to add records to a simple table and output an HTML result.
All the necessary files were placed into the wwwroot folder of the
Win2K3 web server. Client browsers then pointed to
http://WEBSERVER/webtest.htm and users enter table data into a form.
This form then does a POST submission to 'webtest.dbw' in the same
wwwroot directory.

I would like to beef up the security by only allowing the dBASE runtime
to be executed. When I add a web service extension pointing to the
dBASE runtime executable (D:\Program
Files\dBASE\PLUS\Runtime\PLUSRun.exe) and set it to 'Allow' after
restoring all the other CGIs to their default 'Prohibit' setting, I get
the same 404 error.

I'm definitely missing something, but not sure exactly what it could
be.

In the IIS Manager default web site properties, I did map the .dbw
extension to the specific target:
"D:\Program Files\dBASE\PLUS\Runtime\PLUSRun.exe" "%s"

for all verbs as specified in the dBASE web connection documentation.

So my best assumption here is that the .dbw invokes other executables
besides the PLUSRun.exe. Since they are not listed in this web service
extension, it fails with the 404 error. This is the only thing that
makes sense to me why this fails, and 'All Unknown CGI Extensions'
works fine.

Is there any way to dig deeper into IIS (log files somewhere?) that
could tell me what other executable files it may be looking for?

Any help would be greatly appreciated.



Relevant Pages

  • Re: Why cant ISPs stop spam/virus ?!
    ... Both largely missing from your list above. ... then its extension can be considered ... for addition to one of the other lists. ... But you can allow zips while disallowing executables, ...
    (comp.os.linux.misc)
  • Re: File compatibility issues with LAN drive
    ... launch the application registered for that file extension. ... normally not make any difference from the point of view of windows. ... problem because Windows always wants to start them as executables. ... There are some really wild differences between *nix file permissions ...
    (sci.electronics.design)
  • Re: [SLE] CPU-Z For Linux?
    ... I went to my CLI and typed the /proc/cpu info. ... /proc/* are text files, not executables or scripts. ... extension. ... All the information is in KInfoCenter. ...
    (SuSE)
  • Re: Antivirus - AVG protection
    ... the puter by using a double extension. ... IMHO AVG is a decent prog. ... >> executables, the file extension you gave is NOT executable so wont be ... >> | Do you think it works fine because it doesn't report any ...
    (alt.computer.security)
  • Re: Antivirus - AVG protection
    ... the puter by using a double extension. ... IMHO AVG is a decent prog. ... >> executables, the file extension you gave is NOT executable so wont be ... >> | Do you think it works fine because it doesn't report any ...
    (microsoft.public.security.virus)