Questions tagged [iis]
Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.
1
vote
2answers
64 views
IIS Application - service account permissions
My company is looking to install a 3rd party application on our infrastructure and this application will be installed on an IIS Server with a connection to a SQL server. They require an AD service ...
1
vote
1answer
75 views
It is possible to enumerate/discover IIS applications from outside?
I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.
If yes, how? And how can I protect my IIS from this ...
2
votes
1answer
114 views
How could ASP.NET forms authentication session leak into a different site?
We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur
Steps:
Login to ...
0
votes
0answers
72 views
Windows Firewall blocking local access to SQL Server?
I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
1
vote
2answers
252 views
2-way SSL - is it possible to accept multiple client certs on one IIS site?
A client has asked us to build an API which requires two-way SSL. Will we be able to expose that same API to other clients with different certificates? Or will we have to set up a different endpoint ...
2
votes
1answer
109 views
Security Log Analyze [closed]
is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not?
I don't want to use SIEM.
1
vote
1answer
56 views
Deny access to IIS Server from IP local range
I have a local IIS 10 Server, this server runs a critical application.
I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
1
vote
0answers
81 views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
3
votes
2answers
393 views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
1
vote
1answer
718 views
IIS - giving service accounts admin rights?
I'm looking at a application running on IIS which requires service account(s) to run some services/software, however the service account requires LOCAL ADMIN access which is against policy.
Are there ...
3
votes
0answers
246 views
What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?
In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in
ASP.NET MVC for being vulnerable to trivial attacks:
The ASP.NET team doesn’t support using mixed-mode authentication in ...
0
votes
1answer
59 views
Is it safe to remove read-only attribute from wwwroot?
I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
2
votes
1answer
197 views
How secure IIS run together with XAMPP?
I'm using IIS for web server & run phpMyAdmin via IIS.
But now, I saw someone use IIS and XAMPP. There is something I wanted to know.
Usually they set : XAMPP to localhost:81 or localhost:...
1
vote
1answer
134 views
Islanding vs server lockdown
TL;DR:
We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the ...
2
votes
1answer
438 views
SSL certificate for WebAPI
We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
1
vote
1answer
42 views
Use D Parameter Of Private Key as HMAC Secret for JWT in a Load Balanced Environment
I need to use a signature for a JWT that needs to be created or verified on 12 different servers running in a load balanced environment. They all already have the same RSA Key Pair stored in the ...
0
votes
1answer
425 views
Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?
I've been working on an intranet web application that provides read/write, role-based access to a database.
I have been asked to configure the IIS application to use an AD account for the Application ...
0
votes
0answers
2k views
Prevention of host header injection in ASP.NET?
How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
1
vote
0answers
450 views
Windows server configured for TLS 1.1 and 1.2 but scans as 1.2 only
I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and ...
2
votes
0answers
924 views
how to fix Out-of-band resource load (HTTP) issue identified by BURP scan
I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0).
BURP Scan has identified one issue in my web application. Issue is something like ...
0
votes
1answer
323 views
django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http
I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
3
votes
1answer
85 views
Can you start a shell with a service account in Windows?
In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (...
0
votes
1answer
93 views
What attacks is my website subceptable to and how can I prevent them? [closed]
I am developing a website using this book. From my knowledge and from the book, the major issues that I would have to look out for are XSS, CRSF and SQL injection attacks. I have found that there is ...
5
votes
2answers
758 views
Vulnerable framework and IIS server version's are being displayed in an error page of a 3rd party application
As security tester, I need to report and justify that a security misconfiguration in a 3rd party application is a risk to us.
Following is the scenario:
1.) There is a 3rd party application which ...
2
votes
1answer
1k views
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
I have setup my https and I can access it in my browser even it is set to require ssl and clientCredentialType = ...
2
votes
2answers
355 views
Can enforcing a website to serve SSL requests only prevent SSLstrip from working?
I understand running a website with HSTS can help prevent an attacker using KRACK to downgrade the website to serve HTTP requests.
What if our web server does not support HSTS?
IIS has a setting ...
2
votes
0answers
28 views
IIS 7.5 don't let to use stream cipher! [closed]
Internet Information Services 7.5 in Windows 7 don't let me to use stream cipher. When I change the local group policy to force the use of stream cipher or GCM mode, which works like stream cipher, ...
1
vote
1answer
282 views
SERVER-IIS multiple extension code execution attempt
Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. ...
-1
votes
1answer
33 views
Secure access to pre authorized individuals only on application server [closed]
I am building a PHP application and would like to lock the backend (even login page) to only be accessible to preauthorized people - even further be able to link activities to the authorized ...
5
votes
3answers
50k views
How to add X-Frame-Options header to a simple HTML file?
I am having trouble adding X-Frame-Options header to a simple HTML file.
Is there any way to do it using JavaScript?
0
votes
1answer
72 views
SSL cert securing an on-premises web service where the domain is hosted externally
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by a hosting provider. It's just an informational site with no login\commerce function so currently ...
1
vote
2answers
706 views
Can http referrer value be used to stop spam bots?
I have a public sign up site, and when they click submit, a verification text message goes out to the phone number specified in sign up by calling an aspx page via ajax. I don't want spam bots sending ...
2
votes
1answer
82 views
SSL cert for securing on-premises IIS web application
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by some hosting provider or other. It's just an informational site with no login\commerce function so ...
6
votes
2answers
629 views
How to ensure that our production environment deployment process is PCI-compliant when we need to perform live code updates?
In planning the next phase of our platform, I am trying to ensure that the production deployment process is PCI compliant.
We have a central platform which acts as a CMS, serving custom content based ...
2
votes
3answers
704 views
How to defend against web server security scanners? [closed]
I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like:
/CFIDE/administrator/
and
...
0
votes
1answer
325 views
Is the CSR and public key the exact same thing?
Is the CSR and public key the exact same thing?
I require the CSR - can I create a Public key from .cer and use it as CSR?
I need the CSR for HPKP backup key generation.
Is OpenSSL the only way to ...
1
vote
2answers
273 views
Creat IIS USER in SQL from different machine [closed]
I am trying to create a IIS APPPOOL\poolName security login in SQL but getting this error "Windows NT user or group 'IIS APPPOOL\poolName' not found." I am doing this to run elmah.
doing this from ...
-2
votes
2answers
158 views
Website taken down by host.txt
I had my clients site just hanging today. It appears a host.txt file was inserted into the root folder.
I run a Windows 2012 R2 server and IIS.
The website has anonymous access allowed.
I have set ...
1
vote
2answers
157 views
Website using Windows integrated - can user get locked out
I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get ...
1
vote
0answers
291 views
IIS with Windows authentication: can we know that an authenticated user would have connected from a machine on the domain?
If I have an ASP.net web app set up to use windows authentication only on IIS,
does it follow that any authenticated user should have connected from a machine that's joined to the domain?
Does it ...
1
vote
0answers
284 views
Can RC4 ciphers be disabled in Windows Server 2008?
Having some difficulty with disabling RC4 ciphers in Windows Server 2008 SP2. All the guidance I'm seeing for doing this is specific to Windows Server 2008 R2, including the creation of registry keys ...
1
vote
2answers
505 views
what is the security issue if session time out is the default value from server configuration?
In a web-application the session time-out is not defined neither in the application nor in the application configuration. But the default time out is taken from the IIS. what is the security issue if ...
2
votes
1answer
149 views
Invalid CSR when using Let's Encrypt web tools
I've created a CSR using IIS. When I paste the text here...
https://www.sslshopper.com/csr-decoder.html
... it validates correctly.
But when I use the Let's Encrypt tools here...
https://zerossl....
2
votes
2answers
111 views
Migrating IIS to Azure
So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...
1
vote
1answer
455 views
IIS renew option missing for self-signed certificate
does anyone know why the "Renew" button is missing in IIS 7 ? It's a self-signed certificate and I'd like to renew it. Is is because it's self-signed ? I have another certificate within IIS and it ...
2
votes
0answers
4k views
How to exploit a file upload to an IIS 5.1 [closed]
I found the following services in a testing environment:
21/tcp open ftp Microsoft ftpd
80/tcp open http Microsoft IIS httpd 5.1
The FTP server allows anonymous logins and ...
1
vote
0answers
360 views
Microsoft IIS 7.5 from Time Based SQLi DBA to shell
I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell.
My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
2
votes
1answer
5k views
How to configure F5 load balancer and backend server both with SSL Certs
I have an F5 load balancer and a backend server. Load balancer is www.example.com. Backend server is server1.example.com. I have the F5 load balancer with SSL Profile (client) and SSL Profile (server) ...
2
votes
1answer
344 views
Which server is responsible for “security” when ASP.NET Core Kestrel is hosted behind IIS?
I want to understand how the flow between IIS and Kestrel works with regards to security. It seems that the integration between IIS and Kestrel is that IIS just sends absolutely all that it receives ...
2
votes
1answer
54 views
.NET extraction and storage of compression files concerns
I have been provided a specification for an enhancement to one of my companies software products to allow extraction of uploaded compression files (just Zip currently) that will save and migrate the ...
