Questions tagged [iis]
Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.
184
questions
1
vote
0
answers
42
views
Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?
I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows ...
- 11
0
votes
4
answers
594
views
Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn't use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn't support forward secrecy. ...
- 1
0
votes
1
answer
106
views
Common attack vectors for Microsoft Exchange Server?
What are the common attack vectors for a Microsoft Exchange Server?
My online searches only yield discussion into various APT groups, and technical write-ups of different 0day exploits. There does not ...
- 171
0
votes
1
answer
41
views
What's wrong with toggling detailed IIS errors for production?
What is the danger of setting IIS errorMode to detailed in webconfig? It helps me marginally with sanity checks on production, but it seems like it wouldn't really help a bad actor much. I'd like to ...
2
votes
1
answer
134
views
API Sql Injection Need help
I need some help with sqli in API.
Webserver IIS 8.5
GET request looks like this
...
https://example.com/api/Search?q=Landing
Response look like this
HTTP/1.1 200 OK
...
[{"pageId":1,"...
- 21
2
votes
3
answers
183
views
HttpResponse Headers Information Leakage on Server Error (Verbose Headers)
In the past I have dealt with security issues related to Default Service Banners/Verbose Headers/Information Leakage via HttpResponse Headers. These issues are quite common, and usually look ...
- 151
0
votes
1
answer
392
views
Skip date check in Server certificate in Chrome
We have a web application on https port with server certificate valid from 01/01/2021 and valid to 31/12/2021. Due to some constraints the clients which are going to use web application are behind ...
- 101
2
votes
2
answers
739
views
Is this test enough to proof that the web application is vulnerable to Login CSRF?
SCENARIO:
web application which I think is affected by:
a self-xss in the profile section of a user.
logout CSRF
login CSRF
Below I described the test I did to check for the last 2 vulnerabilities, ...
- 497
1
vote
1
answer
109
views
php / email / iis
in a certain page I have a newsletter subscription form, where the user enters his e-mail address and then through PHP an authenticated e-mail is sent to myself with the user's information (e-mail ...
- 113
0
votes
0
answers
101
views
SSRF - Internal network surfing
If an IIS web server exposes a site in INTERNET, is it possible for an attacker to access internal sites by simply modifying the host header of initial request to internet site and refer another host ...
- 5
0
votes
2
answers
189
views
Content-Type and Code Execution
I just got a message from a security guy that my application is executing remote code if they pass a Content-Type: image/asp. For now he does not disclose anything. Now my question is that if I am ...
- 2,461
1
vote
1
answer
1k
views
Slow HTTP POST vulnerability in IIS 10
I ran a Qualys scan on my website and got a Slow HTTP POST vulnerability. In particular, server resets timeout after accepting request data from peer.
From what I understood from this finding, ...
- 11
0
votes
1
answer
1k
views
TLS 1.2 and HTTPS [duplicate]
This question may be silly but I've a hard time understanding TLS 1.2 and accessing a website via HTTPS.
I've received a report from a web security tool that my website is not HTTPS and I have to ...
- 1
1
vote
1
answer
162
views
An intranet web app for decrypting values : a bad idea, and if so, why?
We have to protect a database connection string for a .NET desktop application that has an application-level database user. One option is to encrypt a section of the app.config using asp_regiis. But ...
- 121
0
votes
1
answer
226
views
How to best limit SQL injection attacks that are being funneled through an Apache proxy I control
I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
- 105
1
vote
1
answer
1k
views
How to make use of a exploit that is not available in metasploit? [closed]
I want to exploit a Microsoft IIS HTTPD 10.0 server open which is open in PORT 80. However there is no available exploits in Metasploit but there are few vulnerabilities in this site. Is it possible ...
- 89
0
votes
1
answer
233
views
Check the origin header server-wide in IIS to prevent CSRF through the IIS configuration change Only
Could you please let me know how can we check the origin header server-wide in IIS to prevent CSRF through the configuration change only without adding a custom HTTP module in IIS?
1
vote
0
answers
1k
views
Active Directory authentication with a Login form ASP.NET MVC5
I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
- 11
1
vote
1
answer
332
views
IIS FTPS Best Practise
I have the task to place an FTP server in the company DMZ for our partners to store sensitive data that can not be sent by mail.
I have chosen the IIS FTPS. I will generate a self-signed certificate ...
- 167
0
votes
1
answer
141
views
Detect vulnerability based on IIS log [closed]
Is there any tools to detect website vulnerability/suspicious request from IIS log?
I was asked to do log review. The logs include IIS Log and Event Log. Is there any tools to detect if there's any ...
- 101
3
votes
0
answers
141
views
What does IIS query string validation protect from?
Recently we had a failure in one of our systems because IIS rejects query strings with (URL encoded) parameter values containing the sequence &#. It doesn't reject & #.
We've got tired of ...
- 181
0
votes
0
answers
344
views
Determining clients connecting to IIS using CBC ciphers. (preparing for Lucky13 remediation)
I am trying to determine the impact of re-mediating a lucky 13 vulnerability; which i understand requires disabling CBC cipher modes.
So far i have added custom logging to my IIS instance to capture ...
- 1
2
votes
2
answers
310
views
Secure AWS instance metadata against potential SSRF
I am running a Windows instance on AWS.
The instance has an IIS service running on it.
The IIS service has a user associated to it and it has no need to access the AWS instance metadata.
I was ...
- 994
6
votes
1
answer
458
views
Risk of allowing the string "xss" in query string
A former employee, put the following in our "global.axas"
if (url.Contains("xss")){
response.StatusCode = 404;
response.end();
}
I get he was trying to prevent cross site scripting, but other than ...
- 163
0
votes
0
answers
77
views
How filter a GET parameter for a specific URL in IIS 10?
I have an openredirect vulnerability on my web application. You can learn about this with the following link: https://stackoverflow.com/questions/48340714/azure-ad-b2c-vulnerable-to-open-redirect
...
- 259
1
vote
2
answers
1k
views
Can I get an SSL certificate even if external DNS does not resolve
I have an intranet website that requires an SSL Certificate. From what I've seen it seems like this is difficult to accomplish or cumbersome. Would I be able to buy an SSL certificate if there is an ...
- 11
1
vote
2
answers
150
views
IIS Application - service account permissions
My company is looking to install a 3rd party application on our infrastructure and this application will be installed on an IIS Server with a connection to a SQL server. They require an AD service ...
- 217
1
vote
1
answer
648
views
It is possible to enumerate/discover IIS applications from outside?
I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.
If yes, how? And how can I protect my IIS from this ...
- 21
2
votes
1
answer
621
views
How could ASP.NET forms authentication session leak into a different site?
We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur
Steps:
Login to ...
- 1,130
0
votes
0
answers
2k
views
Windows Firewall blocking local access to SQL Server?
I have an AWS virtual machine running a web application on IIS that connects to a SQL Server database (on the same machine). Recently, I have noticed that there are a plethora of failed login attempts ...
- 101
1
vote
2
answers
2k
views
2-way SSL - is it possible to accept multiple client certs on one IIS site?
A client has asked us to build an API which requires two-way SSL. Will we be able to expose that same API to other clients with different certificates? Or will we have to set up a different endpoint ...
- 125
2
votes
1
answer
353
views
Security Log Analyze [closed]
is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not?
I don't want to use SIEM.
- 21
1
vote
1
answer
254
views
Deny access to IIS Server from IP local range
I have a local IIS 10 Server, this server runs a critical application.
I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
2
votes
0
answers
377
views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
- 21
3
votes
2
answers
652
views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
- 83
1
vote
1
answer
2k
views
IIS - giving service accounts admin rights?
I'm looking at a application running on IIS which requires service account(s) to run some services/software, however the service account requires LOCAL ADMIN access which is against policy.
Are there ...
- 217
3
votes
0
answers
408
views
What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?
In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in
ASP.NET MVC for being vulnerable to trivial attacks:
The ASP.NET team doesn’t support using mixed-mode authentication in ...
- 131
0
votes
1
answer
303
views
Is it safe to remove read-only attribute from wwwroot?
I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
- 107
2
votes
1
answer
463
views
How secure IIS run together with XAMPP?
I'm using IIS for web server & run phpMyAdmin via IIS.
But now, I saw someone use IIS and XAMPP. There is something I wanted to know.
Usually they set : XAMPP to localhost:81 or localhost:...
- 73
1
vote
1
answer
190
views
Islanding vs server lockdown
TL;DR:
We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the ...
- 111
2
votes
1
answer
621
views
SSL certificate for WebAPI
We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
- 123
1
vote
1
answer
136
views
Use D Parameter Of Private Key as HMAC Secret for JWT in a Load Balanced Environment
I need to use a signature for a JWT that needs to be created or verified on 12 different servers running in a load balanced environment. They all already have the same RSA Key Pair stored in the ...
- 1,092
0
votes
1
answer
1k
views
Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?
I've been working on an intranet web application that provides read/write, role-based access to a database.
I have been asked to configure the IIS application to use an AD account for the Application ...
- 137
0
votes
0
answers
5k
views
Prevention of host header injection in ASP.NET?
How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
- 581
1
vote
0
answers
781
views
Windows server configured for TLS 1.1 and 1.2 but scans as 1.2 only
I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and ...
3
votes
0
answers
3k
views
how to fix Out-of-band resource load (HTTP) issue identified by BURP scan
I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0).
BURP Scan has identified one issue in my web application. Issue is something like ...
- 31
0
votes
1
answer
651
views
django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http
I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
3
votes
1
answer
201
views
Can you start a shell with a service account in Windows?
In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (...
- 239
0
votes
1
answer
171
views
What attacks is my website subceptable to and how can I prevent them? [closed]
I am developing a website using this book. From my knowledge and from the book, the major issues that I would have to look out for are XSS, CRSF and SQL injection attacks. I have found that there is ...
- 193
5
votes
2
answers
1k
views
Vulnerable framework and IIS server version's are being displayed in an error page of a 3rd party application
As security tester, I need to report and justify that a security misconfiguration in a 3rd party application is a risk to us.
Following is the scenario:
1.) There is a 3rd party application which ...
- 343