IIS Virtual Directory Hacks

I am publishing a web application in asp that will allow my users to access
a sql database, each user will have a virtual directory that will give them
an interface to access their respective database.

My worry is that they will be able to access each others virtual directories
and hence modify the respective database.

I want to test the application and ensure that users cannot access each
others virtual directories and databases.

I have already tested that they cannot insert the name of another users
virtual directory followed by a file name, that they can find out from their
own virtual directory.

The users have no access to the IIS server apart from via their Virtual
directory. I need to secure this application and make it water tight.

I am looking for some suggestions for how to possibly hack another users
virtual directory.

Any help here would be greatly appreciated.

Many thanks in advance.


.

Relevant Pages

  • Re: Asp.net Portal start kit
    ... different name for the 2nd portal's database. ... Make sure you use a different virtual directory name, ... "Juan Gil" wrote in message ... >> Usually, you need to install the portal to the new location, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: simulate virtual directory for each user
    ... > I need different virtual directory for different customer with their names ... > of that user's web pages from database. ... > After writing the agent Id to client's cookie, ... I read cookie and get agent id and bring the agent info ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: simulate virtual directory for each user
    ... Attach an event handler to the HttpApplication object's BeginRequest ... >>> I need different virtual directory for different customer with their ... >>> of that user's web pages from database. ... >>> After writing the agent Id to client's cookie, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Application structure for NLB
    ... An associate of mine was arguing that we should store images, ... > it's seldom appropriate to store object in the database and would rather ... > virtual directory mapping to provide mirrored access to the same file ... File references are already stored ...
    (microsoft.public.inetserver.asp.general)
  • simulate virtual directory for each user
    ... I need different virtual directory for different customer with their names ... and get the id of the user from database and bring the content ... After writing the agent Id to client's cookie, I redirect to agent home page ... I read cookie and get agent id and bring the agent info ...
    (microsoft.public.dotnet.framework.aspnet)