# IIS

> IIS is Microsoft's web server. Attackers probe for version leaks, short name flaws, WebDAV misconfigs, ASPX shell upload, auth bypass, and post-access token abuse for escalation

- **URL:** https://hackindex.io/services/iis
- **Type:** Service
- **Default ports:** 80, 443
- **Tags:** iis, web, windows, http, microsoft, web-server
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

IIS (Internet Information Services) is Microsoft's web server platform for hosting websites, APIs, and web applications on Windows. It serves HTTP on **TCP port 80** and HTTPS on **TCP port 443**. Nmap identifies it as `http` with the server header `Microsoft-IIS/<version>`.

IIS runs tightly integrated with Windows and Active Directory, meaning web-level vulnerabilities often escalate to system-level compromise. Common findings include short filename disclosure (tilde enumeration), enabled WebDAV with weak permissions, exposed .NET debugging endpoints, and misconfigured authentication (NTLM, Kerberos, or Basic auth leaking domain information). IIS-specific features like ISAPI filters, application pools running as high-privilege accounts, and handler mappings for dangerous file extensions expand the attack surface beyond a typical web server.

Enumeration starts with fingerprinting the IIS version from response headers, then checking for common paths like `/aspnet_client/`, `/certsrv/`, and `/owa/`. The `iis_shortname_scanner` tool detects the tilde vulnerability for file and directory enumeration. Testing for WebDAV methods, application-level vulnerabilities in ASP.NET applications, and IIS-specific CVEs (such as CVE-2017-7269 for WebDAV buffer overflow) rounds out a thorough assessment.

## Phases

- [Enumeration](https://hackindex.io/services/iis/enumeration.md): Turn discovery into specifics: services, users, and exposed resources. Confirm what’s reachable. (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/iis/vulnerability-discovery.md): IIS misconfigs, short name disclosure, and path enumeration guides (2 guides)
- [Exploitation](https://hackindex.io/services/iis/exploitation.md): WebDAV abuse, ASPX shell upload, and auth attacks on IIS (3 guides)