Awhile back we were talking about the use of Alternative Data Streams in NTFS for hiding files (see ). I was thinking about what I could do in a tutorial about Alternative Data Streams that would make it somewhat original, which brought to mind a question: Does IIS look at Alternative Data Streams? So I did the following commands to see:

W:\>echo the text file>t.txt

W:\>type xx.php >t.txt:x.php
xx.php being an php file with the following code:

echo "If I see this I know it worked"

Then I when to try and see if it would see the text file (Tiger Shark, please forgive me for posting the URL of my student site, I know I should be more worried about stalking but Iím an open sort of guy):

That worked as expected. Next I tried to see if IIS would parse out the colon and parse the PHP file in the Alternative Data Stream:

What do you know, it works! I could think of a few things that students at a university might want hide it a webpages like this (moves, porn, scripts and such). Maybe I should ask my Webmaster to run a tool like LADS( ) on the web docs directories. Just thought some of you might find this interesting, could be a nice thing for an admin to look out for. Now back to my research.