Skip to content
HackIndex logo

HackIndex

IIS enumeration

5 min read Mar 30, 2026

IIS enumeration extracts version, enabled HTTP methods, authentication mechanisms, TLS certificate hostnames, and application structure from headers and IIS-specific behaviors. The 8.3 shortname disclosure is unique to IIS and reveals real file and directory names without directory listing. WebDAV and NTLM authentication surfaces are common on Windows infrastructure and often lead directly to exploitation. Run this before any IIS-specific vulnerability checks.

Version Fingerprinting

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 80,443 $TARGET_IP 
80/tcp  open  http    Microsoft IIS httpd 10.0
443/tcp open  ssl/http Microsoft IIS httpd 10.0
┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP/ | grep -iE 'server|x-powered-by|x-aspnet|x-aspnetmvc' 
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
X-AspNet-Version: 4.0.30319
┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP/ -H "Host: $DOMAIN" | grep -iE 'server|x-powered-by|location'

The IIS version maps directly to the Windows Server version: IIS 10.0 is Windows Server 2016/2019/2022, IIS 8.5 is Server 2012 R2, IIS 7.5 is Server 2008 R2. Cross-reference with searchsploit and nuclei CVE templates.

TLS Certificate — Hostname Leakage

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $TARGET_IP:443 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName 
subject=CN=*.company.com
X509v3 Subject Alternative Name:
    DNS:company.com, DNS:www.company.com, DNS:mail.company.com, DNS:internal.corp.company.com

HTTP Methods

┌──(kali㉿kali)-[~]
└─$ nmap -p 80,443 --script http-methods $TARGET_IP 
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
Explain command
-p 80,443 Scan only ports 80 and 443.
--script http-methods Run NSE script to enumerate allowed HTTP methods.
$TARGET_IP Placeholder for the target host IP address.
┌──(kali㉿kali)-[~]
└─$ curl -skI -X OPTIONS http://$TARGET_IP/ | grep -i allow 
Allow: OPTIONS, TRACE, GET, HEAD, POST, PUT, DELETE, PROPFIND, MKCOL

DAV verbs (PROPFIND, MKCOL, PUT, MOVE) confirm WebDAV is active. TRACE being enabled is a reportable misconfiguration. Check specific paths too — WebDAV is sometimes enabled only on certain virtual directories:

┌──(kali㉿kali)-[~]
└─$ for path in / /webdav/ /files/ /upload/ /documents/; do echo -n "$path: "; curl -skI -X OPTIONS http://$TARGET_IP$path | grep -o 'Allow:.*' | head -1; done 
/: Allow: OPTIONS,GET,HEAD,POST
/webdav/: Allow: OPTIONS,GET,HEAD,POST,PUT,DELETE,PROPFIND,MKCOL,MOVE
/upload/: Allow: OPTIONS,GET,HEAD,POST,PUT

WebDAV Detection

┌──(kali㉿kali)-[~]
└─$ nmap -p 80,443 --script http-webdav-scan $TARGET_IP 
| http-webdav-scan:
|   WebDAV type: Unkown
|   Server Type: Microsoft-IIS/10.0
|   Server Date: Mon, 28 Mar 2026 12:00:00 GMT
|_  Allowed Methods: OPTIONS, TRACE, GET, HEAD, PROPFIND, PUT
Explain command
-p 80,443 Scan only ports 80 and 443.
--script http-webdav-scan Run NSE script to detect WebDAV support on the target.
$TARGET_IP Placeholder for the target host IP address.
┌──(kali㉿kali)-[~]
└─$ curl -skI -X PROPFIND http://$TARGET_IP/ -H 'Depth: 0' | grep -iE 'HTTP|DAV|207' 
HTTP/1.1 207 Multi-Status
DAV: 1,2,3

Authentication Mechanism Detection

┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP/ | grep -i 'www-authenticate' 
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
┌──(kali㉿kali)-[~]
└─$ nmap -p 80,443 --script http-ntlm-info $TARGET_IP 
| http-ntlm-info:
|   Target_Name: COMPANY
|   NetBIOS_Domain_Name: COMPANY
|   NetBIOS_Computer_Name: WEB01
|   DNS_Domain_Name: company.local
|   DNS_Computer_Name: web01.company.local
|_  Product_Version: 10.0.17763
Explain command
-p 80,443 Scan only ports 80 and 443.
--script http-ntlm-info Run NSE script to extract NTLM info from HTTP authentication headers.
$TARGET_IP Target host IP address variable.

NTLM info reveals domain, hostname, and Windows version without credentials. Feed domain name into Kerberos enumeration and password spraying. Windows Server 2019 is version 10.0.17763.

8.3 Shortname Disclosure

IIS on Windows exposes 8.3 format filenames through response code differences when probing with a tilde. This reveals partial file and directory names without directory listing. See the dedicated shortname disclosure page for full methodology:

┌──(kali㉿kali)-[~]
└─$ nmap -p 80 --script http-iis-short-name-brute $TARGET_IP 
| http-iis-short-name-brute:
|   Found 3 short names
|   ASPNET~1 (directory)
|   UPLOAD~1 (directory)
|_  ADMINI~1 (directory)
Explain command
-p 80 Scan only port 80 (HTTP).
--script http-iis-short-name-brute Run NSE script to brute-force IIS 8.3 short filenames via tilde (~) bug.
$TARGET_IP Placeholder for the target host IP address.

Content Discovery — IIS-Specific Extensions

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://$TARGET_IP/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -x aspx,asp,ashx,asmx,svc,config,txt,xml --random-agent -o iis_content.txt
Explain command
dir Use directory/file brute-forcing mode.
-u http://$TARGET_IP/ Target URL to enumerate.
-w /usr/share/seclists/Discovery/Web-Content/common.txt Wordlist file used for brute-forcing paths.
-x aspx,asp,ashx,asmx,svc,config,txt,xml File extensions to append to each wordlist entry.
--random-agent Use a random HTTP User-Agent string per request.
-o iis_content.txt Write results output to the specified file.

ASP.NET Config and Error Leakage

┌──(kali㉿kali)-[~]
└─$ for path in /web.config /web.config.bak /web.config.old /web.config.zip /Web.config /App_Data/web.config; do code=$(curl -skI http://$TARGET_IP$path | grep HTTP | awk '{print $2}'); echo "$code $path"; done 
404 /web.config
200 /web.config.bak
404 /web.config.old
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP/doesnotexist.aspx | grep -iE 'version|path|stack|error|exception|c:\\' | head -10 
Server Error in '/' Application
ASP.NET Version: 4.0.30319
Physical path: C:\inetpub\wwwroot\doesnotexist.aspx

Virtual Directory Mapping

Common IIS virtual directories — particularly on Exchange and SharePoint servers — are worth probing directly:

┌──(kali㉿kali)-[~]
└─$ for vdir in owa ecp autodiscover rpc aspnet_client exchange sharepoint wsman; do code=$(curl -skI http://$TARGET_IP/$vdir/ | grep HTTP | awk '{print $2}'); echo "$code /$vdir/"; done 
302 /owa/
200 /ecp/
401 /autodiscover/
401 /rpc/
404 /sharepoint/

OWA (Outlook Web App) and ECP (Exchange Control Panel) present confirm Exchange is running — a high-value target for NTLM relay and credential spraying. Move to IIS misconfiguration checks and shortname disclosure next.

References