- Posted by Admin on April 6, 2009
If you need a full trust level for your asp.net application, you just need to take the following steps at the server end.
1. Locate C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config
2. Add the below tag at the approprite location
<location path="yourdomain.com" allowOverride="true">
<system.web>
<trust level="Full" originUrl="*" />
</system.web>
</location>
CAUTIONS
Asp.NET full trust is a dangerous thing. If anyhow hacker manages to compromise your website then he/she can do anything with the server. Here are the a few actions that hacker may take.
1. Browse(create/edit and delete too) files in the Windows directory using the System.IO namespace.
2. Browse(create/edit and delete too) folders in the Program Files directory using the System.IO namespace.
3. Browse(create/edit and delete too) files in the System32 directory using the System.IO namespace.
4. Output of the OS name and version number using the System.Environment class.
5. Output of the server's local IP address using server variables, etc.
In short, full trust Asp.Net application can do anything with the server since it gains the full access of the server when run under the Full Trust.