Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.

learn more… | top users | synonyms

2
votes
1answer
168 views

Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)

My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model. After reading Qualys's blog regarding slow TCP reading, I ...
1
vote
2answers
150 views

What due diligence is required for HTTPModules that run within IIS?

I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it. Since there has already been an exploit with a similar component produced by Microsoft, what ...
3
votes
2answers
138 views

Website file being altered

I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack. The websites have very little in common other ...
-1
votes
1answer
487 views

IIS won't forward the logged on user credential to webservice request?

Ive enabled Windows authentication in my IIS. for the sample lets assume my Active directory username is \domain\John My task flow is like that : Iis won't forward the loged on user credential ...
1
vote
1answer
149 views

Does an exposed XMLRPC API in a web application pose a threat?

I'm given the assignment of testing one of our web-servers in regards to security. One of the servers run IIS 7 and its application relies extensively on XMLRPC calls. I found the API for those calls ...
4
votes
3answers
330 views

Locking down web-based admin areas with personal SSL certificates

I've been tasked to setup a secure platform, where I've been asked to assign personal SSL certificates to administrators, and have the server only allow persons into the administration areas that have ...
2
votes
1answer
2k views

Securing WCF service with X.509 cert [duplicate]

Possible Duplicate: What is the difference between an x.509 “client certificate” and a normal SSL certificate? I'm getting really confused with WCF and certs. I have a WCF ...
3
votes
3answers
1k views

Need to secure (and add SSL?) RPC port 443 on Win2003 server

So I received an email from my system administrator who wants me to secure a server I own that seems to have a vulnerability in port 443 (which is Windows RPC over HTTPS). Disabling it I know causes ...
8
votes
3answers
260 views

Verify a website user is behind corporate firewall?

We have a public ecommerce website hosted at our datacenter onsite. For people who are within the corporate firewall hitting the website I want to display profiling information about the request of ...
7
votes
2answers
1k views

IIS IP Adress Restriction - can I rely on it online?

I've been told that I might have more luck posting here than on Stack Exchange, so here goes: I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no ...
9
votes
3answers
7k views

SSL handshake failure modes

In SSL if the handshake is not succesful, does it always end with a handshake alert? Or are there other ways to finish the SSL connection (acceptable by standard). I am asking this, because in an ...
4
votes
3answers
358 views

How can IT audit for installation of IIS Express?

IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights. I've seen discussion by some developers who are ...
4
votes
2answers
466 views

how unsafe is it for Windows webserver IIS to have domain privileges

Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
1
vote
1answer
243 views

Effectiveness of Belarc Advisor

I have seen some people recommend Belarc Advisor for Windows hardening, especially for servers. It's supposed to check for stuff such as installed hotfixes and CIS benchmarks (<-- which are great, ...
6
votes
3answers
840 views

IIS and SQLServer Hardening

long story short: I'm an engineer doing development, not administration. I have no direct access to the production server, so I can only tell the administration team the best configurations for ...
5
votes
1answer
2k views

Does WebDAV pose an unreasonable risk in IIS7.5?

I'm looking for a bit of feedback on WebDAV, in this case running on IIS7.5. I've had an IBM Rational AppScan report come to me with a medium severity finding as a result of DAV entries in the ...