Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.

learn more… | top users | synonyms

2
votes
0answers
26 views

How to prevent browser from prompting for a client certificate and allow the IIS to accept it (not require it)? [migrated]

In a web application, I have a WCF service uses Client Certificate authentication. I checked "Accept Client Certificate" in IIS - SSL Settings and it works fine. But some times, in some browsers, if a ...
-1
votes
0answers
18 views

Do I need to receive the private key from VeriSign? [migrated]

I requested a trial certificate from Verisign which I received via email and thus the intermediate and root ones. What I reveived was an PEM certificate, the one with BEGIN and END CERTIFICATE. I'm ...
0
votes
0answers
24 views

How to disable SSL version 2 on IIS/Window Server? [migrated]

How to disable SSL version 2 on IIS / Window Server?
1
vote
1answer
95 views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
2
votes
1answer
89 views

IIS 7 World Wide Web Publishing Service service account

We have a security requirement for IIS 7 (Windows 2008R2) that reads as follows: The service account ID used to run the web site must have its password changed at least annually. ...
2
votes
2answers
128 views

Is there any security concern to host Wordpress on the main web server?

We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com. Now there ...
2
votes
2answers
351 views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has SSL 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
4
votes
1answer
88 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
0
votes
0answers
36 views

IIS out-of-the-box security

we are currently starting a new project and require a freshly installed server (Windows 2008R2) with IIS (7.5) on it for hosting WCF services. For now this server will not be available from the ...
2
votes
1answer
135 views

certificate authentication between apps

I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I ...
2
votes
1answer
206 views

Hardening ciphersuites on Windows Server 2012 R2

I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers. In the past I've always manually applied the registry keys into SChannel ...
1
vote
2answers
75 views

Securing user supplied files in IIS

I have an Internet website running on IIS/Windows configured as follows: The website is publicly accessible for visitors to browse. A user can login and upload files. The user will be able to see ...
0
votes
1answer
412 views

Exploit HTTP PUT Method in Microsoft IIS 5.0

I'm trying to test if it's possible to use the PUT method to upload content to a IIS 5.0 server. The WebDav is actualy enabled and the PUT method is allowed for public/internet users: OPTIONS ...
1
vote
1answer
119 views

Is there any advantage in encrypting a password hash in my database?

I am hashing and storing the salt:hash of each user's password in our database. The web server is ASP.NET and the connection string to the database in web.config is encrypted using the IIS config ...
3
votes
1answer
117 views

Does encrypting a setting in web.config actually provide security?

Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, ...
0
votes
0answers
103 views

Windows User-Level RSA Key Container permissions issue

I have a simple question and I really don't know why it's not working. I've generated new RSA Keyset for user A, grant access for user B and getting error while trying to access that key. Quick ...
2
votes
1answer
314 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
0
votes
3answers
125 views

Is This A Website Attack/Vuln Test?

I have a specific IP that has been iterating through the directories on my site testing for something. Here is an example of what it keeps trying to hit: ...
1
vote
0answers
38 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
3
votes
1answer
188 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
2
votes
2answers
2k views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
3
votes
2answers
249 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
0
votes
2answers
94 views

Use the same IIS RSA key on all servers

I am working on standardizing our server builds where we currently have three different functional pools. For web pools I use the same IIS RSA key across all machines. It keeps life easy and ...
1
vote
1answer
224 views

Securing an IIS application with a complex configuration

I'm in a bit of a pickle. I've got an IIS application which accesses an SQL database (on a different machine). This already means that: a) the IIS application needs to have a connection string to ...
0
votes
1answer
2k views

Creating Client Certificates

Consider an application where client certificates are to be used for authentication. The application web server requires SSL and client certificates for all users. In this case, it's IIS 7. I've used ...
2
votes
1answer
571 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
0
votes
1answer
82 views

Encrypting data in a load-balanced application - am I doing this right?

A web application I'm developing needs to store some sensitive data in a database. I need to be able to retrieve and use this data later on so hashing isn't enough. The web application might, at some ...
3
votes
1answer
888 views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
2
votes
2answers
623 views

Unrestricted File Upload - Possible exploits

During a penetration test‎ (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file. So I have tried to upload a php ...
1
vote
1answer
55 views

Microsoft IIS Express

Does the United States Government Configuration Baseline allow for IIS Express installations as part of a software install (self-contained in the user's home account)? Is there a waiver process?
2
votes
2answers
774 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
0
votes
1answer
203 views

Installing SSL on load balancer and the internal IP

I have a server which has an internal IP (Used to access from local) and an external IP (accessed from Internet and placed in the load balancer). And both will use the same URL ...
1
vote
3answers
411 views

Pentesting my Own Server File Upload

I recently created my own IIS server (set on version 7.5) and I was going through checks to make sure my webdav is not vulnerable. My users need to upload files to their individual accounts and can ...
1
vote
1answer
280 views

IIS 7.5 WebDav Security Issues with Students

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
1
vote
1answer
189 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
2
votes
2answers
932 views

DirBuster request found in my log files

I was going through the logs of my application hosted on IIS 7.5. I found a request like the following: 2013-08-19 08:14:10 192.168.200... HEAD //DSL/ - 80 - 115.114.27... ...
2
votes
1answer
265 views

Possible to detect and log CORS and preflight requests in IIS?

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing. My goal is to understand if clients are following our documentation ...
2
votes
2answers
469 views

Implications of using domain\computername$ account to serve SQL data to IIS

One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5). The application connects to a SQL Server database back-end ...
3
votes
1answer
160 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
216 views

Sending Digital Certificates

I used the makecert tool in order to create: a self-signed certificate a server certificate using the self-signed certificate a client certificate using the self-signed certificate I then ...
3
votes
2answers
619 views

IIS 7.5 impersonation threat?

I am using IIS 7.5 and I want to impersonate users for my different applications in an intranet environnement. To do so, I am considering using the asp.net mechanism with the user/password in the ...
4
votes
2answers
248 views

With full access to the disk of an IIS web server, could you access the database server?

Here is a theoretical setup: You have a web server running Windows Server with IIS You have a website running here which connects to a database This website can start automatically when the server ...
2
votes
2answers
2k views

For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?

I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of ...
2
votes
1answer
143 views

404s with /like and /undefined

We recently got hacked and after cleaning the virus from our machine we pushed out site to go through cloudflare. Although I've noticed scanning attempts on the site have dropped we do for some reason ...
9
votes
3answers
2k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
3
votes
2answers
344 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
2answers
311 views

What is a better practice - RSA Encryption vs Windows authentication

I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I ...
2
votes
0answers
605 views

SSL Certificate Authentication Issue 403.7 [closed]

I have been trying to configure SSL for authentication and was unable to resolve this error 403.7 on IIS 7.5 windows 2008r2 vps server. I would like to give access to few computers where client ...
3
votes
3answers
7k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
-1
votes
3answers
511 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...