Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.

learn more… | top users | synonyms

1
vote
1answer
166 views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
1
vote
0answers
49 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
0
votes
2answers
56 views

Use the same IIS RSA key on all servers

I am working on standardizing our server builds where we currently have three different functional pools. For web pools I use the same IIS RSA key across all machines. It keeps life easy and ...
0
votes
1answer
66 views

Securing an IIS application with a complex configuration

I'm in a bit of a pickle. I've got an IIS application which accesses an SQL database (on a different machine). This already means that: a) the IIS application needs to have a connection string to ...
0
votes
1answer
61 views

Creating Client Certificates

Consider an application where client certificates are to be used for authentication. The application web server requires SSL and client certificates for all users. In this case, it's IIS 7. I've used ...
2
votes
1answer
102 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
0
votes
1answer
62 views

Encrypting data in a load-balanced application - am I doing this right?

A web application I'm developing needs to store some sensitive data in a database. I need to be able to retrieve and use this data later on so hashing isn't enough. The web application might, at some ...
2
votes
1answer
294 views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
2
votes
2answers
334 views

Unrestricted File Upload - Possible exploits

During a penetration test‎ (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file. So I have tried to upload a php ...
1
vote
1answer
43 views

Microsoft IIS Express

Does the United States Government Configuration Baseline allow for IIS Express installations as part of a software install (self-contained in the user's home account)? Is there a waiver process?
2
votes
2answers
309 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
0
votes
1answer
140 views

Installing SSL on load balancer and the internal IP

I have a server which has an internal IP (Used to access from local) and an external IP (accessed from Internet and placed in the load balancer). And both will use the same URL ...
1
vote
3answers
231 views

Pentesting my Own Server File Upload

I recently created my own IIS server (set on version 7.5) and I was going through checks to make sure my webdav is not vulnerable. My users need to upload files to their individual accounts and can ...
0
votes
0answers
23 views

IIS 7.5 WebDav with Student Security [duplicate]

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
1
vote
1answer
163 views

IIS 7.5 WebDav Security Issues with Students

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
1
vote
1answer
141 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
2
votes
2answers
335 views

DirBuster request found in my log files

I was going through the logs of my application hosted on IIS 7.5. I found a request like the following: 2013-08-19 08:14:10 192.168.200... HEAD //DSL/ - 80 - 115.114.27... ...
2
votes
1answer
183 views

Possible to detect and log CORS and preflight requests in IIS?

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing. My goal is to understand if clients are following our documentation ...
2
votes
2answers
270 views

Implications of using domain\computername$ account to serve SQL data to IIS

One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5). The application connects to a SQL Server database back-end ...
3
votes
1answer
113 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
121 views

Sending Digital Certificates

I used the makecert tool in order to create: a self-signed certificate a server certificate using the self-signed certificate a client certificate using the self-signed certificate I then ...
3
votes
2answers
386 views

IIS 7.5 impersonation threat?

I am using IIS 7.5 and I want to impersonate users for my different applications in an intranet environnement. To do so, I am considering using the asp.net mechanism with the user/password in the ...
4
votes
2answers
179 views

With full access to the disk of an IIS web server, could you access the database server?

Here is a theoretical setup: You have a web server running Windows Server with IIS You have a website running here which connects to a database This website can start automatically when the server ...
2
votes
2answers
529 views

For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?

I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of ...
2
votes
1answer
134 views

404s with /like and /undefined

We recently got hacked and after cleaning the virus from our machine we pushed out site to go through cloudflare. Although I've noticed scanning attempts on the site have dropped we do for some reason ...
6
votes
3answers
855 views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
3
votes
2answers
244 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
2answers
221 views

What is a better practice - RSA Encryption vs Windows authentication

I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I ...
2
votes
0answers
443 views

SSL Certificate Authentication Issue 403.7

I have been trying to configure SSL for authentication and was unable to resolve this error 403.7 on IIS 7.5 windows 2008r2 vps server. I would like to give access to few computers where client ...
3
votes
3answers
5k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
-1
votes
3answers
388 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...
0
votes
1answer
266 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
4
votes
1answer
759 views

IIS 6.0 - mitigating BEAST

Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
6
votes
1answer
584 views

What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?

In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever. As the ADFS server is ...
3
votes
3answers
216 views

Security issues in a Dotnet Web application

I was required to fix three low risk security issues of a Web Application on a Windows 2003 server, NetFramework 2.0, IIS/6.0. It is tracert-able. That may assist for crackers to know network ...
9
votes
2answers
467 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
4
votes
2answers
2k views

Test website for SSL 2.0

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled? The website is still in development so not visible outside our ...
2
votes
2answers
1k views

Is it harmful to allow http requests with very long querystrings in IIS?

I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
10
votes
6answers
4k views

Is this a ViewState attack?

I recently found this request in the event log: Client IP: 193.203.XX.XX Port: 53080 User-Agent: Mozilla/4.0 (compatible; Synapse) ViewState: -1' Referer: Now, the ViewState: -1' part combined ...
1
vote
4answers
246 views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
2
votes
1answer
1k views

What is the industry standard approach to disable weak ciphers to mitigate vulnerabilities?

Particularly this question is focused for Windows Server 2008 R2. I know the registry can be used to modify particular entries to disable weak ciphers if they are known. I saw this tool: ...
1
vote
1answer
2k views

What are the consequences of disabling ssl v2 and weak ciphers?

It is my understanding that IIS has ssl v2 enabled by default. Also, TLS 1.0, if enabled, allows for at least one known major vulnerability titled "beast attack". If the weak and vulnerable ciphers ...
2
votes
1answer
642 views

Encrypting configuration on shared IIS7 hosting that uses load balancing

When hosting a site on a cluster (or cloud configuration) we need to specify a Machine Key in the web.config file. This is needed to keep the machines in sync (often the first encounter with this is ...
1
vote
1answer
173 views

WEB long basic authorization string/Buffer Over Flow

I have a external user getting a weird error in the middle of using my website. The user authenticates, post a search for information, and then with the address of the search results page they get a ...
20
votes
3answers
19k views

How to fix SSL 2.0 and BEAST on IIS

As you can see on this post TeamMentor.net vulnerable to BEAST and SSL 2.0, now what? the app I'm currently development got flagged for SSL 2.0 and BEAST by SSL Labs. I'm using IIS 7.0 with the ...
11
votes
6answers
1k views

weird visitors to my website

For the last three months I have thousands of real visitors to a single page on my website. Those visits are recorded in Google Analytics and count as page views in adsense reports, but they are fake: ...
1
vote
1answer
903 views

IIS password protected website

I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows ...
6
votes
7answers
3k views

What is the danger of hosting your SSL certificate yourself?

I have Active Directory Certificate Services on my server, which makes it possible for me to deliver an SSL certificate for the websites hosted on the same server. I know that normally, I need to ...
3
votes
2answers
161 views

Multiple extension vulnerability. Is this malicious file triggered during form preview or after it has been uploaded?

I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the ...
5
votes
1answer
245 views

What is the security impact of changing PowerShell's PSLanguageMode?

A vendor is asking me to change the PSLanguageMode from within IIS on my Exchange server(s). What potential vulnerabilities am I opening myself up to? I'm surprised to see this option present within ...