Windows FTP "Network Place" Exposes Saved Passwords
19 Dec. 2001
When adding a "Network Place" to "My Network Places" with a saved username and password, it is possible to get Explorer to display the password in clear text format by altering the path in the address bar.
The information has been provided by Aaron Heck.
Windows XP Professional
FreeBSD server ftp.example.com
Home directory is /usr/home/someuser
Login name is someuser
Password is somepass
Double click on My Network Places.
Double Click on Add Network Place
Provide the internet address of ftp://ftp.example.com
Provide, when prompted, the username of someuser by deselecting anonymous login. Windows will inform you that you will be prompted for a password. You can select to "Open this network place when I click Finish" (although it does not make a difference if you open the network place from this dialog or later from the "My Network Places" window. When prompted, provide your password. Click the checkbox that says, "Remember my password".
You'll now be logged in and your address bar should read something like:
Note there is no password.
Click on the address bar and add, to the end of the address, ../ Your address bar will change again but will not reveal the password.
Click on the address bar yet again and add, to the end of the address, another ../ The title bar will now appear like this:
(NOTE: If you punch in the whole address complete with the dual ../../ at the end, it doesn't show the password. It only occurs if you actually enter the ../ once, press enter, add it again, and press enter again.)