0
votes
1answer
24 views

IIS6 Server compromised, pages being served which don't exist as asp files?

Started a new job recently which involves some work with an IIS server. We recently found that the server had been compromised as a few websites had pages appearing on Google Webmaster tools which ...
4
votes
1answer
52 views

What is this user name for and how did it get created?

When I created a website named Portal on my IIS 7.5 on the website permissions->security I got this user. What is its purpose? From what I have read the ApplicationPool runs under NetworkService ...
0
votes
2answers
228 views

Asp.net IIS Hacking early warning system

I am running an asp.net website on IIS 7.5 and windows 2008 R2 server. How do I setup (or what do I need) in order to have an alert if there is a hacking attempt against the website and server,? How ...
0
votes
1answer
69 views

How should I set up a new local user for IIS to run under?

I'm interested in setting up a full-blown local user to run my ASP.NET web sites under in IIS 7.5 (Windows Server 2008 R2). (The long and boring rationale has to do with System.IO.Packaging's use of ...
0
votes
2answers
141 views

Is it Possible to use a Single Certificate for a site which has many different domains

I have an ASP.NET application on IIS(Windows Azure) which has many different domains. All domains are working on http. Now, I need to use https. Whether, a single certificate is fine for all of my ...
2
votes
2answers
441 views

Automated Mail sent to/from my own Windows Domain going into Junk Mail

We have emails sent to people within our company that are filtered into Outlook's Junk Mail. Basically, there is a signup form on our company's .Net website, and when people signup, these automated ...
0
votes
1answer
67 views

How do i grant my windows user access to a production database restored to my local machine?

So I am trying to migrate schema changes to my production system. To do this I want to first test the schema changes on a local backup of my production database, so I downloaded the latest backup ...
1
vote
1answer
165 views

Locking down a server for shared internet hosting

Basically I control several servers and I only host either static websites or scripts which I have designed, so I trust them up to a point. However, I have a few customers who want to start using ...
1
vote
2answers
716 views

How to hide the admin page?

The admin page is a page which allows me to access the database of my website. Of course, there will be a login screen there but I want to take measures that no one besides me will even ever see this ...
0
votes
1answer
228 views

Hosting shared full trust asp.net sites while limiting their access to the registry & file system

I am planning to host some asp.net apps which require full trust. The sites will be under different domain names and I am the admin of the server. They will be hosted in Windows 2008 R2 (IIS 7.5). I ...
0
votes
2answers
86 views

Post Vulnerability Actions

To protect the guilty I will avoid names... I know of a site that last night went down. Sort of. For about 5 hours all requests to this asp.net site were producing a YSOD. The details that were spit ...
13
votes
11answers
3k views

Chinese Hacker-Bots attempting to exploit our systems 24/7

Our sites our constantly under attack from bots with IP addresses resolving to China, attempting to exploit our systems. While their attacks are proving unsuccessful, they are a constant drain on our ...
1
vote
2answers
358 views

Web site on IIS needed login and password to access

I am using some web hosting provider (Windows, IIS, ASP.NET). My site worked good. One day I got an error "You are not authorized to view this page. HTTP Error 401.3 - Unauthorized: Access is denied ...
0
votes
1answer
130 views

What type of security problems are mitigated by this .NET architecture?

Given the following physical layout for a .NET web application: DB (sql server, windows) - No public route (no table access, only stored procs) Web Service DAL (iis, windows) - No public route (can ...
0
votes
1answer
202 views

Is it a bad idea to run an asp.net app pool with the same identity as IIS's anon user?

Subject says it all really, Thinking on security terms, I want to give each site on my server its own user account, so that they can't access each other's data. I also want to use integrated ...
0
votes
1answer
268 views

Moving file security from one server to another (asp.net sites, IIS)

I am running windows server with asp.net websites and sql server 2008 and IIS 6. It is working fine. Now I need to move my asp.net websites to another windows server and I have hard time setting ...
1
vote
3answers
2k views

IIS reveals internal IP address in content-location field

Referring: http://support.microsoft.com/kb/q218180/, there is a known issue in IIS4/5/6 whereby it will reveal the internal IP of a web server in the content-location field of the HTTP header. We ...
4
votes
2answers
280 views

Secure IIS/MS-SQL [closed]

I have Windows Server 2008, with IIS 7.5 and SQL Server 2008. I want to install DotNetNuke which is an ASP.NET application. What are the necessary precautions to not to get pwn3d.
2
votes
3answers
22k views

ASP.net user account permissions in IIS 7 on Windows 2008 server

I set up a global error handler in my ASP.net application, using Log4Net and a RollingLogFileAppender which has worked quite nicely up until. I'm in the middle of an upgrade to IIS 7 on Windows 2008 ...
0
votes
1answer
600 views

PayPal - ASP.NET Medium Trust

Recently our Web hosting provider moved to a medium trust level for all shared ASP.NET site hosting. As a result, we're having some issues completing transactions via PayPal's SOAP API. Specifically, ...
4
votes
6answers
11k views

SQL Server 2008 login problem with ASP.NET application: Failed to open the explicitly specified database

I am running SQL Server 2008 Express Edition on Windows Server 2008 with an ASP.NET application which must access the server. The ASP.NET application is associated with an application pool that runs ...
0
votes
2answers
1k views

How can one perform TCP hijacking?

I am developing with an ASP.NET application that uses Windows Authentication. I have setup the web.config file to deny all unauthenticated users, and only allow users from a certain role. Using ...
2
votes
2answers
3k views

IIS7 is not propagating authorization to subdirectories

Our application is using forms authentication and the solution has been working well. Recently one of our 2008 servers developed a problem where the authorization is not being propagated to ...