Shulou(Shulou.com)06/02 Report--

The restrictions on the type of MIME (Multipurpose Internet Mail extension) were first introduced by IIS 6.0. Using these restrictions, we can prevent IIS from providing files with undefined file types to the outside world, thus helping us to protect the server from malicious downloads of sensitive files (such as configuration files, data files, and system binaries, etc.).

Although these files are not usually saved in the root folder of the Web site, if we misconfigure the system, or if there is a loophole in the URL standard (for example, the Nimda worm can exploit this vulnerability), then people can access sensitive files. If a customer attempts to download a file that is not of a pre-defined MIME type, a 404.3 HTTP status is recorded in the IIS log file.

The security settings for the MIME type extension apply only to files processed by IIS Static File HTTP handlers. If the file extension is handled by a different handler (for example, the file extension is handled by an ISAPI extension, such as ASP or ASP.NET), then the file extension has no corresponding MIME type definition.

IIS 7.0 provides approximately 340 predefined MIME types, including text files (such as .txt, .CSS, .js files), HTML files (files with .HTML and .htm extensions), image files (.JPG files, .GIF files, and .PNG files), as well as common audio and video format files. During the installation of IIS 7.0, if we installed the static file option, these MIME types are automatically enabled.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.