> IIS has a legacy behavior inherited from the old DOS 8.3 filename convention.
Is this exposing the underlying OS's behavior coupled with the fact that the IIS document root is `C:\Inetpub` by default? Eight-dot-three filenames are enabled by default on the C drive but disabled by default on all other drives on Windows 10/11:
PS> (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion
24H2
PS> fsutil 8dot3name query C:
The volume state is: 0 (8dot3 name creation is ENABLED)
The registry state is: 2 (Per volume setting - the default)
Based on the above settings, 8dot3 name creation is ENABLED on "C:"
PS> fsutil 8dot3name query U:
The volume state is: 1 (8dot3 name creation is DISABLED)
The registry state is: 2 (Per volume setting - the default)
Based on the above settings, 8dot3 name creation is DISABLED on "U:"
Tangentially, that reminds me of how a Windows update created c:\inetpub on everybody's non-server computers, to "increase protection" for unspecified reasons.
One confusing part is that the blue screen is not a reference to BSOD but to the IIS default page with the blue squares. That’s probably jargon.
The article lists all the tricks I’ve collected over the years doing pentesting and then some, with great tool references. The signal to noise ratio is very high and there’s little “here’s why” filler which instead might just be someone’s way of storytelling. The article drones on, but with actual content as there is a lot to tell. It’s even light on features like trace.axd, but does mention them and their purposes.
I found it an entertaining overview of taking apart unassuming IIS servers and the point of “Recon harder. ” is made very well :)
Edit: s/boring/unassuming + added point was made very well
There's like 90,000 computer fraud reports sent to the federal government every year and about 400 prosecutions total. Most of those are concentrated in whatever niche abuse category the government is focused on at the time (right now, crypto/phishing/ransomware).
note: Don't take this as your cue to start messing around with black hat. Don't become the guy trying to explain to your cell mate who's doing 50 years for a violent crimes what a unauthenticated supabase table is and why you deleted it.
The lead says "how I approach IIS targets during bug bounty" (emphasis mine), so (assuming the author is being truthful) I'm guessing the tone of the title is just for fun.
Yeah, I regularly speak to folks still running IIS on Windows Server. There are a lot of old apps out there, sadly. Some really, really important ones.
Every large company big enough to host an intranet is running IIS somewhere, possibly everywhere. It integrates well with AD so some really complex tasks become stupid simple.
It's seeing less and less usage as the world moves to AWS which is equally stupid because you're tied to one vendor's proprietary products (Amazon) again. Except this time you don't own the hardware.
Public sector IT loves IIS. Check your municipality's tax or property website it's probably got .aspx scripts out the ass.
I've seen it hosting European web apps, public sector if I recall. Lots of bespoke .NET applications out there with SQL Server backends running entire local governments.
Asian countries especially China and Taiwan love IIS and use it to host anything and everything. This is a personal observation.
Sure the world has mostly moved on, but there's tons of legacy code out there that keeps cities and really important organizations humming that runs on IIS and it's never changing.
You think that's bad, there's still places out there running AS/400 stuff on the web, Lotus Notes, and Novell Groupwise (gasp).
I front all my honeypots with the IIS landing page precisely because it attracts black hat jagoffs.
Nothing makes me happier than knowing I've wasted hours of their time chasing their own tails.
Noise is a really underrated security layer.
Why stop there? Front the honeypot with a real IIS server, build a matryoshka doll of honeypots and see how far people get.
Tell me more…I opened a plex and Nintendo switch port, the scans were out of control. I’d love to screw over port scanner over.
Unless you're honeypotting in the IP range of an established organization, all you're doing is getting bot traffic.
High-tier blackhats focus on big targets, and low-tier ones focus on low-hanging fruits they find off shodan or application 0days they've found.
> IIS has a legacy behavior inherited from the old DOS 8.3 filename convention.
Is this exposing the underlying OS's behavior coupled with the fact that the IIS document root is `C:\Inetpub` by default? Eight-dot-three filenames are enabled by default on the C drive but disabled by default on all other drives on Windows 10/11:
Tangentially, that reminds me of how a Windows update created c:\inetpub on everybody's non-server computers, to "increase protection" for unspecified reasons.
https://www.pcworld.com/article/2684062/why-is-windows-11-la...
The tone of this is something else
Several times, I wondered if Claude wrote it.
One confusing part is that the blue screen is not a reference to BSOD but to the IIS default page with the blue squares. That’s probably jargon.
The article lists all the tricks I’ve collected over the years doing pentesting and then some, with great tool references. The signal to noise ratio is very high and there’s little “here’s why” filler which instead might just be someone’s way of storytelling. The article drones on, but with actual content as there is a lot to tell. It’s even light on features like trace.axd, but does mention them and their purposes.
I found it an entertaining overview of taking apart unassuming IIS servers and the point of “Recon harder. ” is made very well :)
Edit: s/boring/unassuming + added point was made very well
Ah webpage formatting cooked but otherwise a fun read
Would love to see a write yo on nginx!
This is extremely well done design (at least on full desktop browsers). Amazing content as well.
"Amazing" is a little generous for script kiddie stuff from the early 2000s.
The author has yet to learn the extent to which civilization depends on people not being cunts to one another for no good reason.
Ah yes, the lulz, the great American pastime.
Civilization has a way of dealing with these individuals: prison.
There's like 90,000 computer fraud reports sent to the federal government every year and about 400 prosecutions total. Most of those are concentrated in whatever niche abuse category the government is focused on at the time (right now, crypto/phishing/ransomware).
note: Don't take this as your cue to start messing around with black hat. Don't become the guy trying to explain to your cell mate who's doing 50 years for a violent crimes what a unauthenticated supabase table is and why you deleted it.
The lead says "how I approach IIS targets during bug bounty" (emphasis mine), so (assuming the author is being truthful) I'm guessing the tone of the title is just for fun.
Does anyone use IIS anymore?
The entire solarwinds platform(barf)
Yeah, I regularly speak to folks still running IIS on Windows Server. There are a lot of old apps out there, sadly. Some really, really important ones.
Tons of the Navy's public websites still run on it.
Amazingly some companies like Hyland still ship software that requires IIS. Bonus add are the pages and pages of setup instructions.
Some banks still use IIS.
Every large company big enough to host an intranet is running IIS somewhere, possibly everywhere. It integrates well with AD so some really complex tasks become stupid simple.
It's seeing less and less usage as the world moves to AWS which is equally stupid because you're tied to one vendor's proprietary products (Amazon) again. Except this time you don't own the hardware.
Public sector IT loves IIS. Check your municipality's tax or property website it's probably got .aspx scripts out the ass.
I've seen it hosting European web apps, public sector if I recall. Lots of bespoke .NET applications out there with SQL Server backends running entire local governments.
Asian countries especially China and Taiwan love IIS and use it to host anything and everything. This is a personal observation.
Sure the world has mostly moved on, but there's tons of legacy code out there that keeps cities and really important organizations humming that runs on IIS and it's never changing.
You think that's bad, there's still places out there running AS/400 stuff on the web, Lotus Notes, and Novell Groupwise (gasp).
Way, WAY too many corporate IT divisions.
Yes, but typically just internal corporate intraweb stuff from what I've seen.
A lot of big corps still use it.
https://bloomberry.com/data/windows-server/