I currently have a webserver running Windows Server 2012 which is running IIS as its webserver and using PHP.

Lets assume the a user is able to upload a trojan onto my server, either through a vulnerable hosted site or perhaps some other exploit.

If the user is able to find the site directory the file was uploaded to, he can navigate to it, thus executing the virus.

Recently I talked about this possibility to my colleague and he stated that his server is configured in a way that would only allow the execution of php scripts.

How does one configure his/her server to only allow php scripts to be run or at the least disallow certain file types from being executed by the attacker.


closed as off-topic by Stephane, Graham Hill, schroeder, Mark, SilverlightFox Jul 8 '15 at 9:23

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.