重写URL以删除波浪号

Question

During my company's annual security/penetration test, the following problem came up regarding tildes and shortname files for aspx pages:

Here is the white paper on the subject. It looks like a relatively newly discovered vulnerability (the paper is from June 2012) where inserting tildes in the right place in the url allows you to find the shortnames of your aspx files. I'm looking for a way to remove all tildes from a web request made to our website to prevent this.

The white paper suggests upgrading to IIS 7, but that's a major project that can't be completed very quickly. We're using C# .NET 4.0/IIS 6. Anyone with experience here that could point me in the right direction?

Answer 1

You could just add the following code to global.asax :

Protected Sub Application_BeginRequest(ByVal sender As Object, ByVal e As System.EventArgs)

    If HttpContext.Current.Request.RawUrl.Contains("~") Then
        'do whatever - eg: stip the ~ or redirect to error page
    End If

End Sub