trying to access web.config file using js and .net, and get the "error.html?aspxerrorpath=/testing2.aspx" error page.
<%@ Page Language="C#" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
<title>Untitled Page</title>
<script type="text/javascript" runat="server">
function ReadConfigSettings()
{
var v1 = '<%= ConfigurationManager.AppSettings["var1"].ToString() %>'
alert(v1);
}
</script>
</head>
<body>
<form id="form1" runat="server">
<div><asp:Button ID="Button1" runat="server" Text="Button" OnClientClick="ReadConfigSettings()" /></div>
</form>
</body>
</html>
web.configapp setting value. If someone is in there changing that value to something malicious then it's game over anyway wrt to the rest of the site. Also in ASP.NET 4.0 he could use the<%:syntax to Html Encode and sanitise anything malicious.