Questions tagged [iis]
Internet Information Services (IIS) is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.
0
votes
0answers
9 views
Re-arranging the order of authentication header in IIS [migrated]
Is it possible to re-arrange the authentication header in IIS7?
I have currently enabled Kerberos and Basic. I want the kerberos authentication header to be first and basic to be the fall back. But ...
1
vote
0answers
47 views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
3
votes
2answers
222 views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
1
vote
1answer
270 views
IIS - giving service accounts admin rights?
I'm looking at a application running on IIS which requires service account(s) to run some services/software, however the service account requires LOCAL ADMIN access which is against policy.
Are there ...
2
votes
0answers
117 views
What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?
In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in
ASP.NET MVC for being vulnerable to trivial attacks:
The ASP.NET team doesn’t support using mixed-mode authentication in ...
0
votes
0answers
34 views
Is it safe to remove read-only attribute from wwwroot?
I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
2
votes
1answer
135 views
How secure IIS run together with XAMPP?
I'm using IIS for web server & run phpMyAdmin via IIS.
But now, I saw someone use IIS and XAMPP. There is something I wanted to know.
Usually they set : XAMPP to localhost:81 or localhost:...
1
vote
1answer
123 views
Islanding vs server lockdown
TL;DR:
We're considering disconnecting our manufacturing computers from the outside world. How much less secure would it be to connect them only to a local server, which in turn connected to the ...
2
votes
1answer
311 views
SSL certificate for WebAPI
We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
0
votes
0answers
45 views
Has Microsoft ever official recommended forms auth over Windows Auth
My team is debating using Windows Authentication for a public facing website. I’ve been scouring the forms and can see the numerous security vulnerabilities of replying on NTML, and I can see the ...
1
vote
1answer
34 views
Use D Parameter Of Private Key as HMAC Secret for JWT in a Load Balanced Environment
I need to use a signature for a JWT that needs to be created or verified on 12 different servers running in a load balanced environment. They all already have the same RSA Key Pair stored in the ...
0
votes
0answers
25 views
Implementation of HTTP Public Key Pinning [duplicate]
I am trying to implement HTTP Public Key Pinning and i am having some issues with the certificate. I followed this guide to create the HTTP Response in IIS:
https://www.namecheap.com/support/...
0
votes
1answer
204 views
Is it safe to use an AD account to run an App Pool in IIS in order to provide SQL read/write permissions to a web app?
I've been working on an intranet web application that provides read/write, role-based access to a database.
I have been asked to configure the IIS application to use an AD account for the Application ...
0
votes
0answers
926 views
Prevention of host header injection in ASP.NET?
How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
1
vote
0answers
334 views
Windows server configured for TLS 1.1 and 1.2 but scans as 1.2 only
I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and ...
2
votes
0answers
564 views
how to fix Out-of-band resource load (HTTP) issue identified by BURP scan
I have Salesforce application which is using my web application hosted in one of our customer's server (IIS 8.0).
BURP Scan has identified one issue in my web application. Issue is something like ...
0
votes
1answer
242 views
django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http
I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this ...
3
votes
0answers
47 views
Can you start a shell with a service account in Windows?
In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (...
0
votes
1answer
82 views
What attacks is my website subceptable to and how can I prevent them? [closed]
I am developing a website using this book. From my knowledge and from the book, the major issues that I would have to look out for are XSS, CRSF and SQL injection attacks. I have found that there is ...
5
votes
2answers
484 views
Vulnerable framework and IIS server version's are being displayed in an error page of a 3rd party application
As security tester, I need to report and justify that a security misconfiguration in a 3rd party application is a risk to us.
Following is the scenario:
1.) There is a 3rd party application which ...
2
votes
1answer
787 views
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
I have setup my https and I can access it in my browser even it is set to require ssl and clientCredentialType = ...
2
votes
2answers
318 views
Can enforcing a website to serve SSL requests only prevent SSLstrip from working?
I understand running a website with HSTS can help prevent an attacker using KRACK to downgrade the website to serve HTTP requests.
What if our web server does not support HSTS?
IIS has a setting ...
0
votes
0answers
49 views
Would putting a HTTP proxy in front of Server 2003 mitigate some risk?
Lets "pretend" someone out there is still running a Windows Server 2003 IIS servers with web sites on them that aren't going to be migrated by their owners anytime soon.
As some form of mitigation I ...
2
votes
0answers
26 views
IIS 7.5 don't let to use stream cipher! [closed]
Internet Information Services 7.5 in Windows 7 don't let me to use stream cipher. When I change the local group policy to force the use of stream cipher or GCM mode, which works like stream cipher, ...
1
vote
1answer
199 views
SERVER-IIS multiple extension code execution attempt
Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. ...
-1
votes
1answer
33 views
Secure access to pre authorized individuals only on application server [closed]
I am building a PHP application and would like to lock the backend (even login page) to only be accessible to preauthorized people - even further be able to link activities to the authorized ...
0
votes
1answer
59 views
SSL cert securing an on-premises web service where the domain is hosted externally
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by a hosting provider. It's just an informational site with no login\commerce function so currently ...
1
vote
2answers
561 views
Can http referrer value be used to stop spam bots?
I have a public sign up site, and when they click submit, a verification text message goes out to the phone number specified in sign up by calling an aspx page via ajax. I don't want spam bots sending ...
2
votes
1answer
75 views
SSL cert for securing on-premises IIS web application
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by some hosting provider or other. It's just an informational site with no login\commerce function so ...
6
votes
2answers
476 views
How to ensure that our production environment deployment process is PCI-compliant when we need to perform live code updates?
In planning the next phase of our platform, I am trying to ensure that the production deployment process is PCI compliant.
We have a central platform which acts as a CMS, serving custom content based ...
2
votes
3answers
558 views
How to defend against web server security scanners? [closed]
I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like:
/CFIDE/administrator/
and
...
0
votes
1answer
172 views
Is the CSR and public key the exact same thing?
Is the CSR and public key the exact same thing?
I require the CSR - can I create a Public key from .cer and use it as CSR?
I need the CSR for HPKP backup key generation.
Is OpenSSL the only way to ...
1
vote
2answers
171 views
Creat IIS USER in SQL from different machine [closed]
I am trying to create a IIS APPPOOL\poolName security login in SQL but getting this error "Windows NT user or group 'IIS APPPOOL\poolName' not found." I am doing this to run elmah.
doing this from ...
-3
votes
2answers
149 views
Website taken down by host.txt
I had my clients site just hanging today. It appears a host.txt file was inserted into the root folder.
I run a Windows 2012 R2 server and IIS.
The website has anonymous access allowed.
I have set ...
1
vote
2answers
155 views
Website using Windows integrated - can user get locked out
I have a website that the IIS folder is set to Windows, that's the windows integrated authentication. It is available from the reverse proxy so any Internet user can access the URL. They then get ...
1
vote
0answers
215 views
IIS with Windows authentication: can we know that an authenticated user would have connected from a machine on the domain?
If I have an ASP.net web app set up to use windows authentication only on IIS,
does it follow that any authenticated user should have connected from a machine that's joined to the domain?
Does it ...
1
vote
0answers
220 views
Can RC4 ciphers be disabled in Windows Server 2008?
Having some difficulty with disabling RC4 ciphers in Windows Server 2008 SP2. All the guidance I'm seeing for doing this is specific to Windows Server 2008 R2, including the creation of registry keys ...
1
vote
2answers
394 views
what is the security issue if session time out is the default value from server configuration?
In a web-application the session time-out is not defined neither in the application nor in the application configuration. But the default time out is taken from the IIS. what is the security issue if ...
2
votes
1answer
121 views
Invalid CSR when using Let's Encrypt web tools
I've created a CSR using IIS. When I paste the text here...
https://www.sslshopper.com/csr-decoder.html
... it validates correctly.
But when I use the Let's Encrypt tools here...
https://zerossl....
2
votes
2answers
106 views
Migrating IIS to Azure
So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...
1
vote
1answer
258 views
IIS renew option missing for self-signed certificate
does anyone know why the "Renew" button is missing in IIS 7 ? It's a self-signed certificate and I'd like to renew it. Is is because it's self-signed ? I have another certificate within IIS and it ...
2
votes
0answers
3k views
How to exploit a file upload to an IIS 5.1 [closed]
I found the following services in a testing environment:
21/tcp open ftp Microsoft ftpd
80/tcp open http Microsoft IIS httpd 5.1
The FTP server allows anonymous logins and ...
1
vote
0answers
316 views
Microsoft IIS 7.5 from Time Based SQLi DBA to shell
I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell.
My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
2
votes
1answer
3k views
How to configure F5 load balancer and backend server both with SSL Certs
I have an F5 load balancer and a backend server. Load balancer is www.example.com. Backend server is server1.example.com. I have the F5 load balancer with SSL Profile (client) and SSL Profile (server) ...
2
votes
1answer
292 views
Which server is responsible for “security” when ASP.NET Core Kestrel is hosted behind IIS?
I want to understand how the flow between IIS and Kestrel works with regards to security. It seems that the integration between IIS and Kestrel is that IIS just sends absolutely all that it receives ...
3
votes
1answer
50 views
.NET extraction and storage of compression files concerns
I have been provided a specification for an enhancement to one of my companies software products to allow extraction of uploaded compression files (just Zip currently) that will save and migrate the ...
1
vote
0answers
314 views
allowdoubleescaping=true security implications
IIS does not allow doubleescaping per default, which is good practice.
What are the real implications if enabled?
How do/does a valid a attack scenario look like in this case - that
uses double ...
1
vote
1answer
50 views
Can I use an old version of IIS and still be secure?
I've a site and it's using IIS 8.5
Can I be secure?
IIS 8.5 is secure or it can be hacked easily?
When should I update IIS and when shouldn't I?
1
vote
1answer
768 views
IIS client certificates: do I need client certificates mappings?
I created self-signed root certificate, ssl certificate and client certificate using makecert util. I created site in IIS, enabled settings "Require SSL" and "Require client certificate". This site ...
2
votes
3answers
2k views
(Solved) Meterpreter over ASPX webshell
I am a beginner and have just started working on pentesting engagements. I have a case where I have a victim IIS server (without PHP support) where I have aspx based web shell (https://github.com/...
