It is possible to enumerate/discover IIS applications from outside?

Question

I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.

If yes, how? And how can I protect my IIS from this kind of enumeration?

Answer 1

Regardless the web server software used, web applications typically have a path and a hostname.

• If the web server is configured to serve an application using the default virtual host and the path to a common web application is the default, http://192.0.2.1/path/to/app type URLs alone could be used for enumeration.

• If the application is only available on a single virtual host, the correct Host: example.com header is required. For this, one would need to know all the hostnames associated with the IP address, but there are search engines like F-Secure Riddler that have probably already indexed it.

• Regular search engines may already have indexed the web application, especially if indexing is not limited with robots.txt, Robots meta tag or X-Robots-Tag header. E.g. Google search with site:example.com may find the application without enumerating directly against the web server at all!

  • If robots.txt was used for preventing indexing, it may contain useful information.

  • Bad robots might not obey any of these humble requests for not to index.

How to protect against this?

• Try these techniques yourself and if you find something disturbing, try to change it. Notice that you have more power over your own system than over all the search engines. (This question was already tagged as penetration-testing.)
• Do not think obscure URLs as protection! Depending on the purpose of the app you may add additional levels of authentication, allow connections only from trusted networks etc.