Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.

learn more… | top users | synonyms

0
votes
1answer
72 views

What type of attack can bring a website down by serving a redirect loop?

My website has been up for a year and all of a sudden is down with a too many redirect message. www.jdmxchange.com (classifieds for modified cars/parts) I tried to use fiddler to see if it was ...
2
votes
4answers
85 views

Public access to IIS Web server inside company network, for one specific service

I'm developing a mobile app which needs to access a specific server inside a company network, and should be able to do so from anywhere in the world. The app communicates via HTTP to a Web service on ...
0
votes
0answers
36 views

Validation client certificate for site in iis

Input: I send client certificate to client. He uses it to work with my web application which works in IIS. I installed CA certificate (which was used to create client certificate) on web server. AFAIK ...
3
votes
0answers
26 views

Secure IIS website from unauthorized writes

I am setting up windows EC2 server. I have created a website in that server using IIS. After creation IIS, assign them pool by default whose identity is ApplicationPoolIdentity. Website works fine. ...
3
votes
1answer
147 views

How to remediate TLS POODLE on IIS [duplicate]

I've been struggling to understand how to completely remediate TLS POODLE on IIS 7.5. I've already disabled SSLv3 support for SSL POODLE. But according to the information that I've get from plenty of ...
-5
votes
1answer
101 views

Security Setting up personal web server [closed]

I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like ...
0
votes
1answer
77 views

WebDAV automatically attempting to connect remotely because of DFS namespace?

I recently bought and Installed a WAF (after much begging). I have a DFS namespace called \\mycompany.com\ which is based on my Active Directory domain name mycompany.com. My website domain is ...
0
votes
0answers
29 views

“encrypted using an obsolete cypher suite” - After using IIS Crypto best practices [duplicate]

I've used the IIS Crypto tool, using best practices and I still get "encrypted using an obsolete cypher suite" In Google Chrome. There's so many various cypher suites, and I'm yet to find a ...
5
votes
4answers
2k views

Self-signed certificates not working over Internet?

My self-signed certificates are not working over Internet. What can be the problems? Here are the setup details: I have a Windows Virtual Machine in Azure with IIS, and a self-signed certificate ...
3
votes
4answers
99 views

How to avoid web service spam?

How can I restrict users from spamming my web service by sending thousands of requests? My web service is actually protected by a validation token only accessible through authentication, but I still ...
1
vote
0answers
44 views

Webserver | IIS | Configuring to not run certain files [closed]

I currently have a webserver running Windows Server 2012 which is running IIS as its webserver and using PHP. Lets assume the a user is able to upload a trojan onto my server, either through a ...
1
vote
2answers
49 views

IIS - RequestFiltering for #

I came across this link today that does run XSS on the site it was originally intended for: ...
0
votes
1answer
282 views

How to check the origin header server-wide in IIS to prevent CSRF

Whereas I'm aware that the synchronizer pattern is the recommended approach to prevent CSRF attacks, I am in a situation where it would be a lot faster to implement the origin header check. I was ...
1
vote
2answers
190 views

Make SERVER_NAME trustworthy in IIS

I am trying to correct a host header vulnerability from the server side as much as possible. The vulnerability is an HTTP host header attack. What I would like to do is only allow valid host headers ...
3
votes
3answers
170 views

How do I know how a file got onto my computer?

I would like to know if there is any way to know how a file was written onto my server (Windows server) i.e if a file X got written via http or via ftp or by simple network copy or someone manually ...
1
vote
1answer
102 views

Machine certificates for accessing a web app in IIS only from an specific PC client

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
2
votes
1answer
256 views

Client side certificates in IIS for accessing a web app only from an specific PC

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
0
votes
1answer
205 views

Security benefits to have IP-filter in HttpModule instead of Page-Load in asp.net pipeline?

I'm working on implementing an IP-filter which blocks all requests by machines outside our IP-range. This is for an asp.net project (written in c#). I've read on multiple forums that the safest way ...
10
votes
3answers
543 views

External websites in logs [duplicate]

I have a website, let's call it www.good.com. I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site ...
6
votes
2answers
87 views

Could an attacker prevent IIS from logging requests

I've had an attacker try to gain access to one of my websites through a form using what looks like a blind SQL inject. It is a huge form, and every possible permutation of values has been tried - in ...
1
vote
0answers
24 views

Security issues IIS 7.5 with PHP 5.3 [duplicate]

We are facing alot of weird php files all over our WordPress websites on our IIS 7.5 server. The file look like XSS script and maybe that php code that the hacker use to send spam emails or something ...
0
votes
0answers
17 views

Identify and disable weak cipher suite On Windows Server 2012 [duplicate]

I failed a PCI Scan: server is susceptible to BEAST attack. Server accepted TLS 1.0 CBC cipher: TLS_RSA_WITH_AES_128_CBC_SHA I have a Windows Server 2012. I want to keep TLS 1.0 enabled but ...
1
vote
0answers
100 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
6
votes
1answer
932 views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
2
votes
1answer
1k views

IIS 7 World Wide Web Publishing Service service account

We have a security requirement for IIS 7 (Windows 2008R2) that reads as follows: The service account ID used to run the web site must have its password changed at least annually. ...
2
votes
2answers
275 views

Is there any security concern to host Wordpress on the main web server?

We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com. Now there ...
4
votes
2answers
6k views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has TLS 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
4
votes
1answer
110 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
2
votes
1answer
584 views

certificate authentication between apps

I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I ...
3
votes
1answer
495 views

Hardening ciphersuites on Windows Server 2012 R2

I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers. In the past I've always manually applied the registry keys into SChannel ...
1
vote
2answers
172 views

Securing user supplied files in IIS

I have an Internet website running on IIS/Windows configured as follows: The website is publicly accessible for visitors to browse. A user can login and upload files. The user will be able to see ...
0
votes
1answer
1k views

Exploit HTTP PUT Method in Microsoft IIS 5.0

I'm trying to test if it's possible to use the PUT method to upload content to a IIS 5.0 server. The WebDav is actualy enabled and the PUT method is allowed for public/internet users: OPTIONS ...
1
vote
1answer
166 views

Is there any advantage in encrypting a password hash in my database?

I am hashing and storing the salt:hash of each user's password in our database. The web server is ASP.NET and the connection string to the database in web.config is encrypted using the IIS config ...
3
votes
1answer
326 views

Does encrypting a setting in web.config actually provide security?

Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, ...
3
votes
1answer
990 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
0
votes
3answers
160 views

Is This A Website Attack/Vuln Test?

I have a specific IP that has been iterating through the directories on my site testing for something. Here is an example of what it keeps trying to hit: ...
1
vote
0answers
49 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
4
votes
1answer
370 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
2
votes
2answers
4k views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
3
votes
3answers
432 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
0
votes
2answers
124 views

Use the same IIS RSA key on all servers

I am working on standardizing our server builds where we currently have three different functional pools. For web pools I use the same IIS RSA key across all machines. It keeps life easy and ...
1
vote
1answer
461 views

Securing an IIS application with a complex configuration

I'm in a bit of a pickle. I've got an IIS application which accesses an SQL database (on a different machine). This already means that: a) the IIS application needs to have a connection string to ...
1
vote
1answer
5k views

Creating Client Certificates

Consider an application where client certificates are to be used for authentication. The application web server requires SSL and client certificates for all users. In this case, it's IIS 7. I've used ...
2
votes
1answer
938 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
0
votes
1answer
115 views

Encrypting data in a load-balanced application - am I doing this right?

A web application I'm developing needs to store some sensitive data in a database. I need to be able to retrieve and use this data later on so hashing isn't enough. The web application might, at some ...
3
votes
1answer
2k views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
2
votes
2answers
1k views

Unrestricted File Upload - Possible exploits

During a penetration test‎ (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file. So I have tried to upload a php ...
1
vote
1answer
60 views

Microsoft IIS Express

Does the United States Government Configuration Baseline allow for IIS Express installations as part of a software install (self-contained in the user's home account)? Is there a waiver process?
2
votes
2answers
1k views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
0
votes
1answer
250 views

Installing SSL on load balancer and the internal IP

I have a server which has an internal IP (Used to access from local) and an external IP (accessed from Internet and placed in the load balancer). And both will use the same URL ...