IIS

IIS (Internet Information Services) is Microsoft's web server platform for hosting websites, APIs, and web applications on Windows. It serves HTTP on TCP port 80 and HTTPS on TCP port 443. Nmap identifies it as http with the server header Microsoft-IIS/<version>.

IIS runs tightly integrated with Windows and Active Directory, meaning web-level vulnerabilities often escalate to system-level compromise. Common findings include short filename disclosure (tilde enumeration), enabled WebDAV with weak permissions, exposed .NET debugging endpoints, and misconfigured authentication (NTLM, Kerberos, or Basic auth leaking domain information). IIS-specific features like ISAPI filters, application pools running as high-privilege accounts, and handler mappings for dangerous file extensions expand the attack surface beyond a typical web server.

Enumeration starts with fingerprinting the IIS version from response headers, then checking for common paths like /aspnet_client/, /certsrv/, and /owa/. The iis_shortname_scanner tool detects the tilde vulnerability for file and directory enumeration. Testing for WebDAV methods, application-level vulnerabilities in ASP.NET applications, and IIS-specific CVEs (such as CVE-2017-7269 for WebDAV buffer overflow) rounds out a thorough assessment.