POET vs ASP.NET: don't waste time implementing useless workarounds - you should patch ;-)

We launch POET against the latest version of DotNetNuke which includes all Microsoft's recommended workarounds that supposed to prevent POET. They don't work as expected, and you should patch ;-).

Visit http://netifera.com/research to download the presentation we gave at EKOPARTY.

Category:

Science & Technology

Tags:

• POET
• ASP.NET

[cryptbe]

@eduncan911 What's wrong with you? Didn't you see that it's a virtual machine running Windows, and the exploit was launched from a Mac? How can that be "localhost"?

Please stop complaining, and start patching.

[newunderground]

When are you going to release the POET with the exploit? :P

[eduncan911]

And what happens when you change your customErrors to mode="On"?

What you show in the video is to your localhost. And you currently have customErrors="RemoteOnly", which means you are not getting custom errors - the "Microsoft Workaround" recommendation.

If you want to truly test this, please change mode="On" and re-run - you should not found any key then.