@oxidecomputer The anecdote from Jeff about a misconfig leading to a missing mod_php exposing src at Facebook was amusing...
@oxidecomputer ...and was reminiscent of a common misconfig of IIS back in the early days of ASP and JSP. (around 1999 or 2000)
@oxidecomputer IIS (Microsoft's Internet Information Server)'s filename extension-based filter/dispatch was case-sensitive by default...
Ian Brown@igb
@oxidecomputer ...and if you toggled the case of the extension (index.JSP instead of index.jsp or hello.ASP instead of hello.asp) when making a request...
@oxidecomputer ...IIS would bypass the ASP interpreter or JSP servlet container and send the raw, uninterpreted page/code back to the browser.
@oxidecomputer This was at a time when it was not uncommon for ASPs or JSPs to have ODBC or JDBC connections (with passwords) embedded in the page source.