0
votes
0answers
8 views

IIS Security - prevent web script to navigate upper level

I would like to know how to prevent the web script to be able to navigate his upper level ? For instance, the web script is located at C:\Websites\Website-A and it shouldn't able to navigate to upper ...
1
vote
0answers
15 views

How to resolve security warning concerning WebAdministrationProvider?

I have a new Windows Server 2012 install, and have just installed IIS. I see the following warning in the Application Log: A provider, WebAdministrationProvider, has been registered in the ...
0
votes
1answer
69 views

IIS Webserver hosting intranet and public sites in DMZ

We have a webserver (VM) hosting several sites. One of the applications has a part intranet and a part public. (archiving/docflow = intranet, customer invoices = public) This webserver is currently ...
1
vote
0answers
54 views

IIS application pool identity doesn't respect Windows security

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I ...
0
votes
0answers
11 views

How to create a very low-level Application Pool account?

I want to create a very low-level application pool account which only allows to run some code, specifically RazorEngine. I don't want user can read/write files and use some dangerious code to down the ...
3
votes
1answer
178 views

Does IIS NTLM/Kerberos authentication still work with an offline domain controller?

We have multiple IIS instances spread across remote regional branches. Each IIS instance (v.7.5) is running the same application and authenticates its users with Integrated Authentication (NTLM in the ...
0
votes
1answer
39 views

Conditional authentication in IIS?

Is it possible to specify conditional authentication methods in IIS (6 or 7) based on http headers? So for example mobile browsers would use a guest account while desktop browsers would need ...
1
vote
0answers
40 views

How do I test a Snort rule for the IIS “Integer Overflow in IPP Service Vulnerability”?

I need to make an attack that exploits this vulnerability, on the internet i only could find the description of the vulnerability that is: Integer overflow in the Internet Printing Protocol (IPP) ...
1
vote
1answer
72 views

How to secure a single file download over HTTP on IIS?

I want to create a download link to a file on my HTTP server (IIS 7.5), for a one time secure download purpose. I don't want the file to be publicly available, the receiver must authenticate. When ...
0
votes
0answers
29 views

Securing files on IIS 7 and Windows Server 2008 Server

What's the best practice for securing a file on an IIS 7 web application running on Windows 2008 server? I have the following requirements and ideas: Requirements: A authenticated user to my web app ...
4
votes
1answer
166 views

Logging SSL ciphersuite used in Windows Server 2008 R2

Is there a way to see /log which cipher suites are (actively) being used to establish SSL connections on Windows Server 2008 R2? Ideally on a per request basis, like an extra column in the IIS logs.
1
vote
1answer
56 views

Keeping PHP up-to-date on a Windows IIS server

On my Windows servers, Microsoft Update keeps IIS and ASP.NET updated automatically. On my Linux/Debian servers, cron-apt keeps Apache/PHP/etc. updated (semi-)automatically. However, I have not found ...
0
votes
0answers
46 views

Cannot Connect to Windows Server Using a Particular IP

We have a Windows server 2008 running as web server. The Server has two IP's (A and B) added to it. We were able to use both the IP's for remote desktop connections and FTP connections. Strangely we ...
0
votes
1answer
196 views

Which user should i give permission to in IIS?

I'm running a windows 2012 server with IIS 8 installed, I have a php script which complains about not having write permission on a specific folder. If I grant permissions to this IUSR user, It works ...
4
votes
2answers
401 views

Should I delete the .pfx or .cer files after importing the SSL cert?

When provided, I have to import into IIS on Windows Server (2008 R2) using either a .pfx or .cer to get SSL certs ready for use. My question is, is should I delete these files after I have ...
0
votes
3answers
344 views

I think I'm under DoS attack. How can I respond?

My server's CPU has been spiking out for the past few days, to the point that it drops requests. I've been looking through the logs, and see certain IP's in the logs that are just simply downloading ...
0
votes
1answer
58 views

How to provide IIS Basic authentication access without a general user account

I want to provide access to my website through IIS Basic auth (already working) but I don't want to give out OS level logins, to my testers/previewers. Is this possible? How can I do this? I ...
4
votes
1answer
331 views

WMI Impersonation levels within vbscript / ASP code

I have an IIS 7.5 web site running "classic" ASP code (not ASP.NET) where the site is running under the normal service context, and only "Windows Authentication" is enabled. Users and navigate the ...
1
vote
1answer
96 views

Is opening port 80 for basic websites ok?

I have set up IIS 7.5 with some web applications, that are meant for internal use as well as for some of our customers. The information inside them is important to some extent, but not like credit ...
0
votes
2answers
237 views

Asp.net IIS Hacking early warning system

I am running an asp.net website on IIS 7.5 and windows 2008 R2 server. How do I setup (or what do I need) in order to have an alert if there is a hacking attempt against the website and server,? How ...
1
vote
0answers
57 views

require client certificates in IIS without requiring SSL

In IIS 7, I've created an https binding for a site, and I'd like to require client certificates for https and still keep my http endpoint. That is to say, I'd like to require client certificates for ...
0
votes
2answers
152 views

Installing a Certificate in IIS 7

I have created a free certificate from https://www.startssl.com. It asked me to export that certificate on the disk. Now i want to install this certificate in IIS 7 on my webserver. How do i do that. ...
0
votes
2answers
143 views

Is it Possible to use a Single Certificate for a site which has many different domains

I have an ASP.NET application on IIS(Windows Azure) which has many different domains. All domains are working on http. Now, I need to use https. Whether, a single certificate is fine for all of my ...
5
votes
1answer
8k views

IIS 7 What does Physical path credentials logon type mean?

I am trying to understand an aspect of IIS security that I can't figure out. I have an internal (not on the internet) application that runs under IIS. This specific application has an app pool ...
2
votes
1answer
94 views

extract iis saved password

In IIS6 settings for a domain, under the Directory Securty » Authentication and access control » Enable anonymous access, there's typically a user name and password supplied specifying the ...
0
votes
3answers
3k views

Windows Server 2003 W3SVC Failing, Brute Force attack possibly the cause

This week my website has disappeared twice for no apparent reason. I logged onto my server (Windows Server 2003 Service Pack 2) and restarted the World Web Publishing service, website still down. I ...
3
votes
2answers
422 views

Does IIS7 have in-built, or available extensions, for responding to scan attempts?

Does IIS7 have an in-built mechanism, or are extensions available, for providing web-application-firewall type behavior? For example, dozens of successive attempts come in that look like scan ...
13
votes
2answers
21k views

Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5?

I know that there are thousands of reports of people having trouble getting Integrated Windows Authentication to work with IIS, but they all seem to lead to web pages that don't apply or solutions ...
0
votes
1answer
80 views

How can I make UrlScan test extensionless urls?

If I use UrlScan to block common SQL Injection attempts on asp- and aspx-files, I would do something like this: [SQLInjection] AppliesTo=.asp,.aspx DenyDataSection=SQLInjectionStrings ScanURL=0 ...
0
votes
1answer
383 views

How to configure IIS 7.5 to host multiple websites with the correct F/S permissions

So, heres my scenario: Dedicated server running Windows 2008 R2 IIS 7.5 Multiple sites using PHP / .NET 4 / Perl / Python Need to do: Ensure that the sites are not able to write/create/read ...
2
votes
1answer
618 views

Advice on IIS log analysis, for finding footprints of hackers

I need to find out how a website was hacked, I have the relevant IIS logs, but since there are too many visitors, It would be nice to have some kind of log analyzer that was not designed to only give ...
1
vote
1answer
131 views

Securtiy concerns about IIS websites' access rights - Restrict them not to be able to read c:\, etc

I have some security concerns about my IIS websites. From PHP-files (FastCGI) on our server the scripts are able to read my system's root directory (c:\), but even list the content of c:\windows. What ...
2
votes
1answer
202 views

How can I verify a client's identity using an SSL handshake to allow access to certain website pages?

I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL ...
1
vote
1answer
100 views

SelfSSL in IIS 6.0

I am using IIS 6.0 and selfSSL to create a self signed certificate, but it only lasts one week. How do I prolong the time of this?
7
votes
3answers
13k views

What is muieblackcat?

I've recently installed ELMAH on a small .NET MVC site and I keep receiving error reports System.Web.HttpException: A public action method 'muieblackcat' was not found on controller... This is ...
1
vote
1answer
114 views

How to protected the Sitemap.xml file from frequent access?

Our sitemap.xml file is becoming large. I'd like to prevent randoms from accessing the Sitemap.xml file and only allow google, yahoo and bing to access it. Kinda like a whitelist approach. Where can I ...
3
votes
3answers
6k views

DOS attack “slow post” : How to prevent in IIS

I have a public facing IIS 7.5 web server running a single ASP.NET website, which has just failed one of our security scans with a "slow post" vulnerability. Have tried reducing the httpruntime ...
1
vote
2answers
74 views

Basic IIS7 permissions question

We have a website, with a file: www.example.com/apis/httpapi.asp This file is used by the site internally to make requests joining two systems on the website together (one is Classic ASP, the other ...
1
vote
2answers
549 views

How secure are files hosted on IIS Anonymously with Directory Browsing Disabled?

To elaborate a bit on this point, I'd like to know how secure are documents hosted on an IIS website with the following configuration: IIS Directory Listing Disabled Anonymous Access is Enabled Site ...
1
vote
1answer
176 views

Problem viewing Active Directory users from external server

I'm trying to set up a website on an external web server (IIS 6 on Win 2k3) such that: Anonymous access is denied Users have to log in with their Active Directory username / password I can grant ...
1
vote
1answer
5k views

Anonymous Authentication <anonymousAuthentication> / 403 - Forbidden: Access is denied

I am using windows server 2008 R2 and IIS 7.5 I deployed my app to that server for the first time and I got the following error; 403 - Forbidden: Access is denied. You do not have permission ...
1
vote
2answers
202 views

IIS IP Adress Restriction - can I rely on it online?

I have an idea I'd like to float to the smart people of serverFault to pick holes in it. I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no login ...
2
votes
2answers
2k views

How to configure client certificate authentication in IIS

For me it is trivial to configure Tomcat for client authentication. But trying it to do it in an IIS 7 server (running in Win2008R2 Server) it seems imposible. In tomcat all I have to do is configure ...
1
vote
1answer
293 views

shut down FTP from IIS 6 after <X> failed login attempts

Is there a setting in IIS 6 to turn an FTP site off after a specified number of failed login attempts? It has already been documented on this site that a Windows server sitting on a static IP address ...
1
vote
2answers
673 views

Why would PROPFIND and DAV appear in response headers when WebDAV is disabled?

I've got a bit of a challenge I'm hoping someone has some ideas on. I'm in the process of deploying a web app to a shared environment with a host running IIS7.5. A security scan has shown that WebDAV ...
1
vote
1answer
106 views

IIS and PHP restrict IO permissions

I have php installed trough a fastCGI module. Is there a way to restrict the module (php.exe) read / write permissions to only the directory (+ subdirs) of the IIS site that is calling it? I need ...
2
votes
4answers
651 views

How do you stop users directly accessing files on a website in IIS 7

I have a website where users upload files through a CMS. eg http://www.mysite.com/uploadedfiles/file1.txt I want to stop users on the internet being able to enter this URL into a browser and access ...
2
votes
2answers
190 views

Simulate DOS/High Workload on IIS

I want to simulate a DOS attack, or a very high workload on a simple IIS web site. The purpose is testing SCOM responses with IIS. Any suggestions for a tool and/or script? Thanks!
4
votes
2answers
2k views

Understanding IUSR_<machine> account

Namely how is setting read/write permission for this account different from giving read/write access in the IIS (Windows 2003, so it should be IIS6 if I am not mistaken). Here is the issue: It looks ...
1
vote
1answer
165 views

Locking down a server for shared internet hosting

Basically I control several servers and I only host either static websites or scripts which I have designed, so I trust them up to a point. However, I have a few customers who want to start using ...