Determine web site ports via file system

Question

I have file system access to a web server, but not access to IIS admin snap-in. I need to determine the ports that certain web sites are running on. Is there a XML config file or something I can look at to find this information?

Answer 1

For IIS 6, configuration is stored in the MetaBase.xml file which by default is in %SYSTEMROOT%\System32\inetsrv (for 32-bit) or %SYSTEMROOT\SYSWOW64\inetsrv (for 64-bit).

Look for IIsWebServer nodes. They will have an attribute called ServerBindings which will indicate which port the site is bound to. You'll have to parse the value as it will also include host header binding information as well.

Format of the value is

:port:hostname [[:port:hostname] ...]

So an example with 2 host headers configured for the site would be

:80:host1.mydomain.com :80:host2.mydomain.com

For IIS7 configuration information is stored in %SYSTEMROOT%\system32\inetsrv\config\applicationHost.config. Look for <binding> nodes (which are child nodes of <bindings> which are in turn child nodes of <site> nodes). The bindingInformation attribute of the <binding> node contains the port/host header information in the same format as above.