IIS Server Penetration Testing and Enumeration Techniques

Microsoft Internet Information Services (IIS) servers are frequently misconfigured, providing a wide attack surface for security researchers and bug bounty hunters. The primary takeaway is that the default IIS splash page is often a starting point rather than a dead end, leading to critical vulnerabilities such as internal IP disclosure, sensitive configuration leaks, and remote code execution (RCE).

Identifying IIS Targets

Finding IIS servers requires a combination of passive indexing and active fingerprinting to locate staging servers, forgotten admin panels, and internal tools.

Passive Discovery

  • Shodan Queries: Use queries like ssl:"target.com" http.title:"IIS" or org:"target" http.title:"IIS" to find indexed boxes tied to specific organizations or SSL certificates.
  • Google Dorking: Target specific IIS indicators such as site:target.com inurl:aspnet_client, site:target.com inurl:_vti_bin, or file extensions like .aspx, .ashx, and .asmx.
  • Wildcard Searching: Using stacked wildcards (e.g., site:*.*.target.com intitle:"IIS") can uncover nested subdomains and development environments.

Active Fingerprinting

Active identification is performed by inspecting response headers for Server: Microsoft-IIS/x.x and X-Powered-By: ASP.NET. This can be automated at scale using tools like httpx:

httpx -l targets.txt -td | grep IIS | tee iis-targets.txt

Information Disclosure and Reconnaissance

IIS servers often leak internal infrastructure details through simple request variations.

Internal IP Disclosure

Sending an HTTP/1.0 request to certain IIS setups, particularly those fronting Exchange or Outlook Web Access (OWA), can cause the server to reveal an internal IP address in the Location header:

curl -v --http1.0 http://example.com

Virtual Host Discovery

An HTTPAPI 2.0 404 error often indicates that the server is running but requires a specific Host header to route the request to a virtual host. Researchers can resolve this by:

  1. Inspecting the SSL certificate's Subject or Subject Alternative Name (SAN) fields.
  2. Brute-forcing the Host header using ffuf:
ffuf -u https://TARGET_IP/ -H "Host: FUZZ.target.com" -w vhosts.txt -fs 0

IIS Tilde Enumeration (8.3 Filenames)

IIS inherits a legacy DOS 8.3 filename convention that allows the enumeration of short names for files and directories even when directory listing is disabled.

Enumeration Process

Using tools like shortscan or Burp Suite's IIS Tilde Enumeration Scanner, researchers can identify fragments such as WEB~1.CON (web.config) or SITEBA~1.ZIP.

Resolving Shortnames to Full Filenames

Once a shortname fragment is found, the full filename can be resolved using several methods:

  • LLMs: Prompting a model to generate a list of possible full words based on the snippet.
  • GitHub Dorking: Searching GitHub code for filenames that match the first six characters of the shortname.
  • BigQuery: Querying the public GitHub dataset via Google BigQuery to find real-world filenames matching the pattern:
    SELECT DISTINCT path FROM `bigquery-public-data.github_repos.files` 
WHERE REGEXP_CONTAINS(path, r'(?i)(\/siteba[a-z0-9]+\.zip|^siteba[a-z0-9]+\.zip)')
  • Brute-forcing: Using crunch to generate all possible combinations for the remaining characters and fuzzing with ffuf using various separators (hyphens, underscores, spaces).

High-Value Target Fuzzing

Generic wordlists are often insufficient for IIS. Targeted fuzzing should focus on the .NET ecosystem and specific extensions.

Critical Paths to Fuzz

  • Configuration Files: /web.config, /web.config.bak, /appsettings.json.
  • Debug Endpoints: /trace.axd (ASP.NET trace viewer) and /elmah.axd (error log viewer), which can leak headers, cookies, and credentials.
  • Legacy Files: /_vti_pvt/service.cnf and /WS_FTP.LOG.

Recommended Extensions

Fuzz for .asp, .aspx, .ashx, .asmx, .wsdl, .config, .xml, .zip, .txt, .dll, and .json.

Advanced Exploitation Techniques

The web.config RCE Chain

Accessing the web.config file is a critical win because it often contains machine keys used to sign and encrypt ViewState. With these keys, an attacker can use ysoserial.net to forge a malicious serialized ViewState payload, leading to Remote Code Execution (RCE).

DLL Exposure via Cookieless Sessions

ASP.NET's cookieless session feature can be abused to bypass path restrictions and access the /bin directory. By using the (S(X)) syntax, researchers can download application DLLs:

GET /(S(X))/b/(S(X))in/WebApplication1.dll

These DLLs can then be decompiled using tools like dnSpy or JetBrains dotPeek to reveal hardcoded credentials and internal logic.

Path and Authentication Bypasses

  • Reverse Proxy Confusion: Using %2f (URL-encoded slash) to bypass proxy access controls (e.g., /anything/..%2fadmin/).
  • NTFS Metadata Hacks: Bypassing authentication in IIS 7.5 by requesting NTFS alternate data streams (e.g., /admin::$INDEX_ALLOCATION/admin.php).
  • File Upload Bypasses: Bypassing .aspx filters by adding trailing dots (e.g., shell.aspx.), which IIS strips before serving the file.

WAF Bypass via HTTP Parameter Pollution (HPP)

IIS and ASP.NET concatenate duplicate parameter values with a comma. This can be used to split a payload across multiple parameters to evade WAF detection:

https://target.com/page?param=<svg/&param=onload=alert(1)>

Community Insights

Industry practitioners have noted that while these techniques are effective, some administrators use the IIS landing page as a honeypot to attract and track attackers. Additionally, the 8.3 filename behavior is primarily enabled by default on the C: drive in modern Windows versions, meaning the vulnerability may depend on where the web root is located.

Sources