Questions tagged [iis]
Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.
0
votes
0answers
27 views
HTTP Debug method reveals Server header on IIS
Stuck with really weird problem and can't figure out how to handle it. So, I have asp web api application hosted in IIS 10. I use IIS Rewrite module with outbound rule which removes any Server header:
...
1
vote
2answers
32 views
2-way SSL - is it possible to accept multiple client certs on one IIS site?
A client has asked us to build an API which requires two-way SSL. Will we be able to expose that same API to other clients with different certificates? Or will we have to set up a different endpoint ...
2
votes
1answer
60 views
Security Log Analyze [closed]
is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not?
I don't want to use SIEM.
1
vote
1answer
42 views
Deny access to IIS Server from IP local range
I have a local IIS 10 Server, this server runs a critical application.
I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
1
vote
0answers
58 views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
3
votes
2answers
322 views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
1
vote
1answer
407 views
IIS - giving service accounts admin rights?
I'm looking at a application running on IIS which requires service account(s) to run some services/software, however the service account requires LOCAL ADMIN access which is against policy.
Are there ...
2
votes
0answers
170 views
What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?
In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in
ASP.NET MVC for being vulnerable to trivial attacks:
The ASP.NET team doesn’t support using mixed-mode authentication in ...
0
votes
0answers
34 views
Is it safe to remove read-only attribute from wwwroot?
I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
2
votes
1answer
155 views
How secure IIS run together with XAMPP?
I'm using IIS for web server & run phpMyAdmin via IIS.
But now, I saw someone use IIS and XAMPP. There is something I wanted to know.
Usually they set : XAMPP to localhost:81 or localhost:...
1
vote
1answer
125 views
Islanding vs server lockdown
TL;DR:
We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the ...
2
votes
1answer
361 views
SSL certificate for WebAPI
We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
0
votes
0answers
49 views
Has Microsoft ever official recommended forms auth over Windows Auth
My team is debating using Windows Authentication for a public facing website. I’ve been scouring the forms and can see the numerous security vulnerabilities of replying on NTML, and I can see the ...
1
vote
1answer
36 views
Use D Parameter Of Private Key as HMAC Secret for JWT in a Load Balanced Environment
I need to use a signature for a JWT that needs to be created or verified on 12 different servers running in a load balanced environment. They all already have the same RSA Key Pair stored in the ...
0
votes
0answers
25 views
Implementation of HTTP Public Key Pinning [duplicate]
I am trying to implement HTTP Public Key Pinning and i am having some issues with the certificate. I followed this guide to create the HTTP Response in IIS:
https://www.namecheap.com/support/...
0
votes
1answer
275 views
Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?
I've been working on an intranet web application that provides read/write, role-based access to a database.
I have been asked to configure the IIS application to use an AD account for the Application ...
0
votes
0answers
1k views
Prevention of host header injection in ASP.NET?
How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
1
vote
0answers
366 views
Windows server configured for TLS 1.1 and 1.2 but scans as 1.2 only
I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and ...
2
votes
0answers
677 views
how to fix Out-of-band resource load (HTTP) issue identified by BURP scan
I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0).
BURP Scan has identified one issue in my web application. Issue is something like ...
0
votes
1answer
268 views
django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http
I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
3
votes
0answers
49 views
Can you start a shell with a service account in Windows?
In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (...
0
votes
1answer
86 views
What attacks is my website subceptable to and how can I prevent them? [closed]
I am developing a website using this book. From my knowledge and from the book, the major issues that I would have to look out for are XSS, CRSF and SQL injection attacks. I have found that there is ...
5
votes
2answers
594 views
Vulnerable framework and IIS server version's are being displayed in an error page of a 3rd party application
As security tester, I need to report and justify that a security misconfiguration in a 3rd party application is a risk to us.
Following is the scenario:
1.) There is a 3rd party application which ...
2
votes
1answer
930 views
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
I have setup my https and I can access it in my browser even it is set to require ssl and clientCredentialType = ...
2
votes
2answers
336 views
Can enforcing a website to serve SSL requests only prevent SSLstrip from working?
I understand running a website with HSTS can help prevent an attacker using KRACK to downgrade the website to serve HTTP requests.
What if our web server does not support HSTS?
IIS has a setting ...
-1
votes
0answers
54 views
Would putting a HTTP proxy in front of Server 2003 mitigate some risk?
Lets "pretend" someone out there is still running a Windows Server 2003 IIS servers with web sites on them that aren't going to be migrated by their owners anytime soon.
As some form of mitigation I ...
2
votes
0answers
26 views
IIS 7.5 don't let to use stream cipher! [closed]
Internet Information Services 7.5 in Windows 7 don't let me to use stream cipher. When I change the local group policy to force the use of stream cipher or GCM mode, which works like stream cipher, ...
1
vote
1answer
231 views
SERVER-IIS multiple extension code execution attempt
Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. ...
-1
votes
1answer
33 views
Secure access to pre authorized individuals only on application server [closed]
I am building a PHP application and would like to lock the backend (even login page) to only be accessible to preauthorized people - even further be able to link activities to the authorized ...
4
votes
3answers
40k views
How to add X-Frame-Options header to a simple HTML file?
I am having trouble adding X-Frame-Options header to a simple HTML file.
Is there any way to do it using JavaScript?
0
votes
1answer
60 views
SSL cert securing an on-premises web service where the domain is hosted externally
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by a hosting provider. It's just an informational site with no login\commerce function so currently ...
1
vote
2answers
627 views
Can http referrer value be used to stop spam bots?
I have a public sign up site, and when they click submit, a verification text message goes out to the phone number specified in sign up by calling an aspx page via ajax. I don't want spam bots sending ...
2
votes
1answer
77 views
SSL cert for securing on-premises IIS web application
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by some hosting provider or other. It's just an informational site with no login\commerce function so ...
6
votes
2answers
518 views
How to ensure that our production environment deployment process is PCI-compliant when we need to perform live code updates?
In planning the next phase of our platform, I am trying to ensure that the production deployment process is PCI compliant.
We have a central platform which acts as a CMS, serving custom content based ...
2
votes
3answers
604 views
How to defend against web server security scanners? [closed]
I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like:
/CFIDE/administrator/
and
...
0
votes
1answer
211 views
Is the CSR and public key the exact same thing?
Is the CSR and public key the exact same thing?
I require the CSR - can I create a Public key from .cer and use it as CSR?
I need the CSR for HPKP backup key generation.
Is OpenSSL the only way to ...
1
vote
2answers
206 views
Creat IIS USER in SQL from different machine [closed]
I am trying to create a IIS APPPOOL\poolName security login in SQL but getting this error "Windows NT user or group 'IIS APPPOOL\poolName' not found." I am doing this to run elmah.
doing this from ...
-3
votes
2answers
155 views
Website taken down by host.txt
I had my clients site just hanging today. It appears a host.txt file was inserted into the root folder.
I run a Windows 2012 R2 server and IIS.
The website has anonymous access allowed.
I have set ...
1
vote
2answers
155 views
Website using Windows integrated - can user get locked out
I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get ...
1
vote
0answers
227 views
IIS with Windows authentication: can we know that an authenticated user would have connected from a machine on the domain?
If I have an ASP.net web app set up to use windows authentication only on IIS,
does it follow that any authenticated user should have connected from a machine that's joined to the domain?
Does it ...
1
vote
0answers
239 views
Can RC4 ciphers be disabled in Windows Server 2008?
Having some difficulty with disabling RC4 ciphers in Windows Server 2008 SP2. All the guidance I'm seeing for doing this is specific to Windows Server 2008 R2, including the creation of registry keys ...
1
vote
2answers
425 views
what is the security issue if session time out is the default value from server configuration?
In a web-application the session time-out is not defined neither in the application nor in the application configuration. But the default time out is taken from the IIS. what is the security issue if ...
2
votes
1answer
132 views
Invalid CSR when using Let's Encrypt web tools
I've created a CSR using IIS. When I paste the text here...
https://www.sslshopper.com/csr-decoder.html
... it validates correctly.
But when I use the Let's Encrypt tools here...
https://zerossl....
2
votes
2answers
107 views
Migrating IIS to Azure
So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...
1
vote
1answer
314 views
IIS renew option missing for self-signed certificate
does anyone know why the "Renew" button is missing in IIS 7 ? It's a self-signed certificate and I'd like to renew it. Is is because it's self-signed ? I have another certificate within IIS and it ...
2
votes
0answers
3k views
How to exploit a file upload to an IIS 5.1 [closed]
I found the following services in a testing environment:
21/tcp open ftp Microsoft ftpd
80/tcp open http Microsoft IIS httpd 5.1
The FTP server allows anonymous logins and ...
1
vote
0answers
333 views
Microsoft IIS 7.5 from Time Based SQLi DBA to shell
I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell.
My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
2
votes
1answer
4k views
How to configure F5 load balancer and backend server both with SSL Certs
I have an F5 load balancer and a backend server. Load balancer is www.example.com. Backend server is server1.example.com. I have the F5 load balancer with SSL Profile (client) and SSL Profile (server) ...
2
votes
1answer
306 views
Which server is responsible for “security” when ASP.NET Core Kestrel is hosted behind IIS?
I want to understand how the flow between IIS and Kestrel works with regards to security. It seems that the integration between IIS and Kestrel is that IIS just sends absolutely all that it receives ...
3
votes
1answer
51 views
.NET extraction and storage of compression files concerns
I have been provided a specification for an enhancement to one of my companies software products to allow extraction of uploaded compression files (just Zip currently) that will save and migrate the ...
