Tagged Questions

Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.

learn more… | top users | synonyms

0
votes
0answers
16 views

IIS 7.5 + PHP + httpOnlyCookies + requireSSL [migrated]

How do I enable the httpOnlyCookies and requireSSL for all the cookie in IIS 7.5 ? I have tried adding <httpCookies httpOnlyCookies="true" requireSSL="true" /> within the ...
2
votes
1answer
126 views

Hardening ciphersuites on Windows Server 2012 R2

I'm currently in the process of compiling a Ciphersuite policy to be used on all of our new WS 12 & IIS 8.5 web servers. In the past I've always manually applied the registry keys into SChannel ...
0
votes
1answer
53 views

Securing user supplied files in IIS

I have an Internet website running on IIS/Windows configured as follows: The website is publicly accessible for visitors to browse. A user can login and upload files. The user will be able to see ...
0
votes
1answer
149 views

Exploit HTTP PUT Method in Microsoft IIS 5.0

I'm trying to test if it's possible to use the PUT method to upload content to a IIS 5.0 server. The WebDav is actualy enabled and the PUT method is allowed for public/internet users: OPTIONS ...
1
vote
1answer
91 views

Is there any advantage in encrypting a password hash in my database?

I am hashing and storing the salt:hash of each user's password in our database. The web server is ASP.NET and the connection string to the database in web.config is encrypted using the IIS config ...
3
votes
1answer
90 views

Does encrypting a setting in web.config actually provide security?

Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, ...
0
votes
0answers
68 views

Windows User-Level RSA Key Container permissions issue

I have a simple question and I really don't know why it's not working. I've generated new RSA Keyset for user A, grant access for user B and getting error while trying to access that key. Quick ...
1
vote
1answer
195 views

CSR from IIS 8 and Keeping my Private Key a Secret

I've been trying to understand something. When you generate a CSR from IIS, how is the private key kept as a secret, or is it? Do CA's email you a certificate that includes your private key? Because ...
0
votes
3answers
110 views

Is This A Website Attack/Vuln Test?

I have a specific IP that has been iterating through the directories on my site testing for something. Here is an example of what it keeps trying to hit: ...
1
vote
0answers
36 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
2
votes
1answer
143 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
2
votes
2answers
1k views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
2
votes
1answer
193 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
0
votes
2answers
83 views

Use the same IIS RSA key on all servers

I am working on standardizing our server builds where we currently have three different functional pools. For web pools I use the same IIS RSA key across all machines. It keeps life easy and ...
1
vote
1answer
177 views

Securing an IIS application with a complex configuration

I'm in a bit of a pickle. I've got an IIS application which accesses an SQL database (on a different machine). This already means that: a) the IIS application needs to have a connection string to ...
0
votes
1answer
835 views

Creating Client Certificates

Consider an application where client certificates are to be used for authentication. The application web server requires SSL and client certificates for all users. In this case, it's IIS 7. I've used ...
2
votes
1answer
467 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
0
votes
1answer
78 views

Encrypting data in a load-balanced application - am I doing this right?

A web application I'm developing needs to store some sensitive data in a database. I need to be able to retrieve and use this data later on so hashing isn't enough. The web application might, at some ...
3
votes
1answer
704 views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
2
votes
2answers
566 views

Unrestricted File Upload - Possible exploits

During a penetration test‎ (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file. So I have tried to upload a php ...
1
vote
1answer
53 views

Microsoft IIS Express

Does the United States Government Configuration Baseline allow for IIS Express installations as part of a software install (self-contained in the user's home account)? Is there a waiver process?
2
votes
2answers
664 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
0
votes
1answer
196 views

Installing SSL on load balancer and the internal IP

I have a server which has an internal IP (Used to access from local) and an external IP (accessed from Internet and placed in the load balancer). And both will use the same URL ...
1
vote
3answers
351 views

Pentesting my Own Server File Upload

I recently created my own IIS server (set on version 7.5) and I was going through checks to make sure my webdav is not vulnerable. My users need to upload files to their individual accounts and can ...
1
vote
1answer
236 views

IIS 7.5 WebDav Security Issues with Students

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
1
vote
1answer
175 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
2
votes
2answers
745 views

DirBuster request found in my log files

I was going through the logs of my application hosted on IIS 7.5. I found a request like the following: 2013-08-19 08:14:10 192.168.200... HEAD //DSL/ - 80 - 115.114.27... ...
2
votes
1answer
248 views

Possible to detect and log CORS and preflight requests in IIS?

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing. My goal is to understand if clients are following our documentation ...
2
votes
2answers
422 views

Implications of using domain\computername$ account to serve SQL data to IIS

One of our coders is trying to get Windows Authentication to work on a new web app that he's developing (.Net 4.0, MVC, via IIS 7.0/7.5). The application connects to a SQL Server database back-end ...
3
votes
1answer
151 views

Clarification on Digital Certificates

I used the makecert tool to create: self-signed certificate client certificate These are the commands I used: makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
185 views

Sending Digital Certificates

I used the makecert tool in order to create: a self-signed certificate a server certificate using the self-signed certificate a client certificate using the self-signed certificate I then ...
3
votes
2answers
548 views

IIS 7.5 impersonation threat?

I am using IIS 7.5 and I want to impersonate users for my different applications in an intranet environnement. To do so, I am considering using the asp.net mechanism with the user/password in the ...
4
votes
2answers
227 views

With full access to the disk of an IIS web server, could you access the database server?

Here is a theoretical setup: You have a web server running Windows Server with IIS You have a website running here which connects to a database This website can start automatically when the server ...
2
votes
2answers
1k views

For TLS how to instruct IIS 7 to include Intermediate CAs to be included in the Certificate Request frame?

I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of ...
2
votes
1answer
137 views

404s with /like and /undefined

We recently got hacked and after cleaning the virus from our machine we pushed out site to go through cloudflare. Although I've noticed scanning attempts on the site have dropped we do for some reason ...
8
votes
3answers
1k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
3
votes
2answers
324 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
2answers
270 views

What is a better practice - RSA Encryption vs Windows authentication

I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I ...
2
votes
0answers
559 views

SSL Certificate Authentication Issue 403.7 [closed]

I have been trying to configure SSL for authentication and was unable to resolve this error 403.7 on IIS 7.5 windows 2008r2 vps server. I would like to give access to few computers where client ...
3
votes
3answers
6k views

BEAST: IIS6: Failing PCI scan - are these ciphers OK?

Our PCI compliance scanner, TrustWave, have failed our Win 2003/IIS6 site on BEAST because of the following cyphers: Cipher Suite: SSLv3 : DES-CBC3-SHA Cipher Suite: SSLv3 : RC4-SHA Cipher Suite: ...
-1
votes
3answers
481 views

How to increase Windows PowerShell WebAccess security?

What are some recommended techniques to improve the security of powershell? Google returns many articles about powershell security like these: PowerShell’s Security Guiding Principles TechNet Edge ...
0
votes
1answer
330 views

Configuring IIS SSL for PCI

Is there a clear, concise list of of SSL settings available for IIS which will pass my PCI audit scanning? Preferably something for both IIS 6 and IIS 7 I'm currently running into BEAST issues but ...
4
votes
1answer
887 views

IIS 6.0 - mitigating BEAST

Recently, my PCI assessor informed me that my servers are vulnerable to BEAST and failed me. I did my homework and I want to change our webservers to prefer RC4 ciphers over CBC. I followed every ...
7
votes
1answer
1k views

What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?

In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever. As the ADFS server is ...
3
votes
3answers
266 views

Security issues in a Dotnet Web application

I was required to fix three low risk security issues of a Web Application on a Windows 2003 server, NetFramework 2.0, IIS/6.0. It is tracert-able. That may assist for crackers to know network ...
9
votes
2answers
576 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
4
votes
2answers
3k views

Test website for SSL 2.0

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled? The website is still in development so not visible outside our ...
2
votes
2answers
2k views

Is it harmful to allow http requests with very long querystrings in IIS?

I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
11
votes
6answers
5k views

Is this a ViewState attack?

I recently found this request in the event log: Client IP: 193.203.XX.XX Port: 53080 User-Agent: Mozilla/4.0 (compatible; Synapse) ViewState: -1' Referer: Now, the ViewState: -1' part combined ...
1
vote
4answers
330 views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...