why does Webresource.axd attempt to 'download' when I reference it in this URL?
I have someone doing a penetration test on a site and they are trying to exploit WebResource.axd
I'm confused because whenever I try his URL I either get it trying to download to a text file in IE or displaying as text on FF

    https://www.abc.com/admin/WebResource.axd?d=RwbBVERJr4odqFAEhrTxZocB3t466Wz_wzC0J-SrAE-W4xu-AzmjqZkrwGODx5_afw_duUtD5UrVO_hDOpznd5ZG60E1&t=634219309938290489&%3E%27%22%3E%3Cscript%3Ealert%2816146%29%3C%2Fscript%3E=123

He says that it is giving him an alert with 16146 in it, I can't fix it because I can't even duplicate it.

I have customErrors defined within web.config, everything is going to the same concise error page.  I kind of get how you COULD exploit this file but I just want to know what I managed to do that causes it to come across text.

HELP?!?

why does Webresource.axd attempt to 'download' when I reference it in this URL?
===

I have someone doing a penetration test on a site and they are trying to exploit WebResource.axd
I'm confused because whenever I try his URL I either get it trying to download to a text file in IE or displaying as text on FF

    https://www.abc.com/admin/WebResource.axd?d=RwbBVERJr4odqFAEhrTxZocB3t466Wz_wzC0J-SrAE-W4xu-AzmjqZkrwGODx5_afw_duUtD5UrVO_hDOpznd5ZG60E1&t=634219309938290489&%3E%27%22%3E%3Cscript%3Ealert%2816146%29%3C%2Fscript%3E=123

He says that it is giving him an alert with 16146 in it, I can't fix it because I can't even duplicate it.

I have customErrors defined within web.config, everything is going to the same concise error page.  I kind of get how you COULD exploit this file but I just want to know what I managed to do that causes it to come across text.

HELP?!?
