I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.
If yes, how? And how can I protect my IIS from this kind of enumeration?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Regardless the web server software used, web applications typically have a path and a hostname.
If the web server is configured to serve an application using the default virtual host and the path to a common web application is the default,
http://192.0.2.1/path/to/app type URLs alone could be used for enumeration.
If the application is only available on a single virtual host, the correct
Host: example.com header is required. For this, one would need to know all the hostnames associated with the IP address, but there are search engines like F-Secure Riddler that have probably already indexed it.
Regular search engines may already have indexed the web application, especially if indexing is not limited with
robots.txt, Robots meta tag or
X-Robots-Tag header. E.g. Google search with
site:example.com may find the application without enumerating directly against the web server at all!
robots.txt was used for preventing indexing, it may contain useful information.
Bad robots might not obey any of these humble requests for not to index.
How to protect against this?