Conversation

Notices

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Wednesday, 03-Jun-2026 06:24:20 JST Will Dormann

   In preparation for an upcoming blog post, I wondered about the various ways that Windows can refer to a remote WebDAV resource.

   These all work:

   \\example.com\pwned.exe
   \/example.com\pwned.exe
   file://example.com\pwned.exe
   file:/\example.com\pwned.exe
   file:\/example.com\pwned.exe
   file:\\example.com\pwned.exe
   file:////example.com\pwned.exe
   file:///\example.com\pwned.exe
   file://\/example.com\pwned.exe
   file://\\example.com\pwned.exe
   file:/\//example.com\pwned.exe
   file:/\/\example.com\pwned.exe
   file:/\\/example.com\pwned.exe
   file:/\\\example.com\pwned.exe
   file:\///example.com\pwned.exe
   file:\//\example.com\pwned.exe
   file:\/\/example.com\pwned.exe
   file:\/\\example.com\pwned.exe
   file:\\//example.com\pwned.exe
   file:\\/\example.com\pwned.exe
   file:\\\/example.com\pwned.exe
   file:\\\\example.com\pwned.exe
   

   These don't, presumably because windows treats the leading / as meaning it comes from the local filesystem:

   //example.com\pwned.exe
   /\example.com\pwned.exe
   
   • Embed this notice
     Will Dormann (wdormann@infosec.exchange)'s status on Wednesday, 03-Jun-2026 06:42:11 JST Will Dormann

     • Kevin Beaumont

     @GossiTheDog
     At least in my case, that's covered by the \\example.com\pwned.exe case.

   • Embed this notice
     Will Dormann (wdormann@infosec.exchange)'s status on Wednesday, 03-Jun-2026 08:17:08 JST Will Dormann

     • Kevin Beaumont

     @GossiTheDog
     I only ended up with my list after seeing lots of unexpected URIs in the samples I've been pulling from VT, and decided to do some testing.

     I recall something in my past where the use of \\example.com@80\DavWWWRoot\pwned.exe would be more likely to start the WebClient service automatically. But for .URL files, none of that is necessary.