Questions tagged [iis]
Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.
167
questions
0
votes
0answers
20 views
Running application with minimal privileges on Win 10
I have REST server (Spring Boot) runs on Windows 10 and frontend which runs on IIS web server. I need to configure rules as secure as possible. Web-server and REST server runs on the same computer on ...
0
votes
1answer
49 views
Detect vulnerability based on IIS log [closed]
Is there any tools to detect website vulnerability/suspicious request from IIS log?
3
votes
0answers
35 views
What does IIS query string validation protect from?
Recently we had a failure in one of our systems because IIS rejects query strings with (URL encoded) parameter values containing the sequence &#. It doesn't reject & #.
We've got tired of ...
0
votes
0answers
15 views
Securing DB connection string and other configuration files in RCE scenario
Environment:
Microsoft Windows
IIS Web server
MSSQL DB
Let's say an application gets compromised with an RCE, what's the best scenario of protecting the database connection string file or any ...
0
votes
0answers
52 views
Determining clients connecting to IIS using CBC ciphers. (preparing for Lucky13 remediation)
I am trying to determine the impact of re-mediating a lucky 13 vulnerability; which i understand requires disabling CBC cipher modes.
So far i have added custom logging to my IIS instance to capture ...
2
votes
0answers
56 views
Secure AWS instance metadata against potential SSRF
I am running a Windows instance on AWS.
The instance has an IIS service running on it.
The IIS service has a user associated to it and it has no need to access the AWS instance metadata.
I was ...
6
votes
1answer
302 views
Risk of allowing the string “xss” in query string
A former employee, put the following in our "global.axas"
if (url.Contains("xss")){
response.StatusCode = 404;
response.end();
}
I get he was trying to prevent cross site scripting, but other than ...
0
votes
0answers
31 views
How filter a GET parameter for a specific URL in IIS 10?
I have an openredirect vulnerability on my web application. You can learn about this with the following link: https://stackoverflow.com/questions/48340714/azure-ad-b2c-vulnerable-to-open-redirect
...
1
vote
2answers
89 views
Can I get an SSL certificate even if external DNS does not resolve
I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
1
vote
2answers
68 views
IIS Application - service account permissions
My company is looking to install a 3rd party application on our infrastructure and this application will be installed on an IIS Server with a connection to a SQL server. They require an AD service ...
1
vote
1answer
88 views
It is possible to enumerate/discover IIS applications from outside?
I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.
If yes, how? And how can I protect my IIS from this ...
2
votes
1answer
229 views
How could ASP.NET forms authentication session leak into a different site?
We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur
Steps:
Login to ...
0
votes
0answers
214 views
Windows Firewall blocking local access to SQL Server?
I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
1
vote
2answers
500 views
2-way SSL - is it possible to accept multiple client certs on one IIS site?
A client has asked us to build an API which requires two-way SSL. Will we be able to expose that same API to other clients with different certificates? Or will we have to set up a different endpoint ...
2
votes
1answer
143 views
Security Log Analyze [closed]
is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not?
I don't want to use SIEM.
1
vote
1answer
84 views
Deny access to IIS Server from IP local range
I have a local IIS 10 Server, this server runs a critical application.
I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
1
vote
0answers
88 views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
3
votes
2answers
421 views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
1
vote
1answer
1k views
IIS - giving service accounts admin rights?
I'm looking at a application running on IIS which requires service account(s) to run some services/software, however the service account requires LOCAL ADMIN access which is against policy.
Are there ...
3
votes
0answers
268 views
What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?
In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in
ASP.NET MVC for being vulnerable to trivial attacks:
The ASP.NET team doesn’t support using mixed-mode authentication in ...
0
votes
1answer
62 views
Is it safe to remove read-only attribute from wwwroot?
I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
2
votes
1answer
235 views
How secure IIS run together with XAMPP?
I'm using IIS for web server & run phpMyAdmin via IIS.
But now, I saw someone use IIS and XAMPP. There is something I wanted to know.
Usually they set : XAMPP to localhost:81 or localhost:...
1
vote
1answer
134 views
Islanding vs server lockdown
TL;DR:
We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the ...
2
votes
1answer
473 views
SSL certificate for WebAPI
We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
1
vote
1answer
47 views
Use D Parameter Of Private Key as HMAC Secret for JWT in a Load Balanced Environment
I need to use a signature for a JWT that needs to be created or verified on 12 different servers running in a load balanced environment. They all already have the same RSA Key Pair stored in the ...
0
votes
1answer
534 views
Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?
I've been working on an intranet web application that provides read/write, role-based access to a database.
I have been asked to configure the IIS application to use an AD account for the Application ...
0
votes
0answers
2k views
Prevention of host header injection in ASP.NET?
How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
1
vote
0answers
509 views
Windows server configured for TLS 1.1 and 1.2 but scans as 1.2 only
I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and ...
2
votes
0answers
1k views
how to fix Out-of-band resource load (HTTP) issue identified by BURP scan
I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0).
BURP Scan has identified one issue in my web application. Issue is something like ...
0
votes
1answer
386 views
django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http
I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
3
votes
1answer
86 views
Can you start a shell with a service account in Windows?
In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (...
0
votes
1answer
116 views
What attacks is my website subceptable to and how can I prevent them? [closed]
I am developing a website using this book. From my knowledge and from the book, the major issues that I would have to look out for are XSS, CRSF and SQL injection attacks. I have found that there is ...
5
votes
2answers
873 views
Vulnerable framework and IIS server version's are being displayed in an error page of a 3rd party application
As security tester, I need to report and justify that a security misconfiguration in a 3rd party application is a risk to us.
Following is the scenario:
1.) There is a 3rd party application which ...
2
votes
1answer
2k views
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
I have setup my https and I can access it in my browser even it is set to require ssl and clientCredentialType = ...
2
votes
2answers
366 views
Can enforcing a website to serve SSL requests only prevent SSLstrip from working?
I understand running a website with HSTS can help prevent an attacker using KRACK to downgrade the website to serve HTTP requests.
What if our web server does not support HSTS?
IIS has a setting ...
2
votes
0answers
31 views
IIS 7.5 don't let to use stream cipher! [closed]
Internet Information Services 7.5 in Windows 7 don't let me to use stream cipher. When I change the local group policy to force the use of stream cipher or GCM mode, which works like stream cipher, ...
1
vote
1answer
314 views
SERVER-IIS multiple extension code execution attempt
Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. ...
-1
votes
1answer
33 views
Secure access to pre authorized individuals only on application server [closed]
I am building a PHP application and would like to lock the backend (even login page) to only be accessible to preauthorized people - even further be able to link activities to the authorized ...
5
votes
3answers
56k views
How to add X-Frame-Options header to a simple HTML file?
I am having trouble adding X-Frame-Options header to a simple HTML file.
Is there any way to do it using JavaScript?
0
votes
1answer
82 views
SSL cert securing an on-premises web service where the domain is hosted externally
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by a hosting provider. It's just an informational site with no login\commerce function so currently ...
1
vote
2answers
755 views
Can http referrer value be used to stop spam bots?
I have a public sign up site, and when they click submit, a verification text message goes out to the phone number specified in sign up by calling an aspx page via ajax. I don't want spam bots sending ...
2
votes
1answer
84 views
SSL cert for securing on-premises IIS web application
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by some hosting provider or other. It's just an informational site with no login\commerce function so ...
6
votes
2answers
730 views
How to ensure that our production environment deployment process is PCI-compliant when we need to perform live code updates?
In planning the next phase of our platform, I am trying to ensure that the production deployment process is PCI compliant.
We have a central platform which acts as a CMS, serving custom content based ...
2
votes
3answers
763 views
How to defend against web server security scanners? [closed]
I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like:
/CFIDE/administrator/
and
...
0
votes
1answer
409 views
Is the CSR and public key the exact same thing?
Is the CSR and public key the exact same thing?
I require the CSR - can I create a Public key from .cer and use it as CSR?
I need the CSR for HPKP backup key generation.
Is OpenSSL the only way to ...
1
vote
2answers
304 views
Creat IIS USER in SQL from different machine [closed]
I am trying to create a IIS APPPOOL\poolName security login in SQL but getting this error "Windows NT user or group 'IIS APPPOOL\poolName' not found." I am doing this to run elmah.
doing this from ...
-2
votes
2answers
158 views
Website taken down by host.txt
I had my clients site just hanging today. It appears a host.txt file was inserted into the root folder.
I run a Windows 2012 R2 server and IIS.
The website has anonymous access allowed.
I have set ...
1
vote
2answers
159 views
Website using Windows integrated - can user get locked out
I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get ...
1
vote
0answers
331 views
IIS with Windows authentication: can we know that an authenticated user would have connected from a machine on the domain?
If I have an ASP.net web app set up to use windows authentication only on IIS,
does it follow that any authenticated user should have connected from a machine that's joined to the domain?
Does it ...
1
vote
0answers
320 views
Can RC4 ciphers be disabled in Windows Server 2008?
Having some difficulty with disabling RC4 ciphers in Windows Server 2008 SP2. All the guidance I'm seeing for doing this is specific to Windows Server 2008 R2, including the creation of registry keys ...
