# IIS enumeration

> Techniques for enumerating Microsoft IIS web servers, uncovering versions, directories, virtual hosts, and misconfigurations to identify attack surfaces.

- **URL:** https://hackindex.io/services/iis/enumeration/iis-enumeration
- **Path:** IIS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/iis/enumeration.md)
- **Published:** 2026-01-19
- **Updated:** 2026-08-11

IIS enumeration extracts version, enabled HTTP methods, authentication mechanisms, TLS certificate hostnames, and application structure from headers and IIS-specific behaviors. The 8.3 shortname disclosure is unique to IIS and reveals real file and directory names without directory listing. WebDAV and NTLM authentication surfaces are common on Windows infrastructure and often lead directly to exploitation. Run this before any IIS-specific vulnerability checks.

IIS enumeration targets:

- Server version from response headers
- Enabled HTTP methods (PUT, MOVE, DELETE for WebDAV)
- NTLM authentication surface and domain info
- TLS certificate hostnames and internal naming
- 8.3 shortname disclosure for hidden file discovery

## Version Fingerprinting

```bash
nmap -sV -p 80,443 $TARGET_IP
# 80/tcp  open  http    Microsoft IIS httpd 10.0
# 443/tcp open  ssl/http Microsoft IIS httpd 10.0
```

```bash
curl -skI http://$TARGET_IP/ | grep -iE 'server|x-powered-by|x-aspnet|x-aspnetmvc'
# Server: Microsoft-IIS/10.0
# X-Powered-By: ASP.NET
# X-AspNet-Version: 4.0.30319
```

```bash
curl -skI http://$TARGET_IP/ -H "Host: $DOMAIN" | grep -iE 'server|x-powered-by|location'
```

The IIS version maps directly to the Windows Server version: IIS 10.0 is Windows Server 2016/2019/2022, IIS 8.5 is Server 2012 R2, IIS 7.5 is Server 2008 R2. Cross-reference with searchsploit and nuclei CVE templates.

## TLS Certificate: Hostname Leakage

```bash
openssl s_client -connect $TARGET_IP:443 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
# subject=CN=*.company.com
# X509v3 Subject Alternative Name:
#     DNS:company.com, DNS:www.company.com, DNS:mail.company.com, DNS:internal.corp.company.com
```

## HTTP Methods

```bash
nmap -p 80,443 --script http-methods $TARGET_IP
# | http-methods:
# |   Supported Methods: OPTIONS TRACE GET HEAD POST
# |_  Potentially risky methods: TRACE
```

```bash
curl -skI -X OPTIONS http://$TARGET_IP/ | grep -i allow
# Allow: OPTIONS, TRACE, GET, HEAD, POST, PUT, DELETE, PROPFIND, MKCOL
```

DAV verbs (PROPFIND, MKCOL, PUT, MOVE) confirm WebDAV is active. TRACE being enabled is a reportable misconfiguration. Check specific paths too: WebDAV is sometimes enabled only on certain virtual directories:

```bash
for path in / /webdav/ /files/ /upload/ /documents/; do echo -n "$path: "; curl -skI -X OPTIONS http://$TARGET_IP$path | grep -o 'Allow:.*' | head -1; done
# /: Allow: OPTIONS,GET,HEAD,POST
# /webdav/: Allow: OPTIONS,GET,HEAD,POST,PUT,DELETE,PROPFIND,MKCOL,MOVE
# /upload/: Allow: OPTIONS,GET,HEAD,POST,PUT
```

## WebDAV Detection

```bash
nmap -p 80,443 --script http-webdav-scan $TARGET_IP
# | http-webdav-scan:
# |   WebDAV type: Unkown
# |   Server Type: Microsoft-IIS/10.0
# |   Server Date: Mon, 28 Mar 2026 12:00:00 GMT
# |_  Allowed Methods: OPTIONS, TRACE, GET, HEAD, PROPFIND, PUT
```

```bash
curl -skI -X PROPFIND http://$TARGET_IP/ -H 'Depth: 0' | grep -iE 'HTTP|DAV|207'
# HTTP/1.1 207 Multi-Status
# DAV: 1,2,3
```

## Authentication Mechanism Detection

```bash
curl -skI http://$TARGET_IP/ | grep -i 'www-authenticate'
# WWW-Authenticate: Negotiate
# WWW-Authenticate: NTLM
```

```bash
nmap -p 80,443 --script http-ntlm-info $TARGET_IP
# | http-ntlm-info:
# |   Target_Name: COMPANY
# |   NetBIOS_Domain_Name: COMPANY
# |   NetBIOS_Computer_Name: WEB01
# |   DNS_Domain_Name: company.local
# |   DNS_Computer_Name: web01.company.local
# |_  Product_Version: 10.0.17763
```

NTLM info reveals domain, hostname, and Windows version without credentials. Feed domain name into Kerberos enumeration and password spraying. Windows Server 2019 is version 10.0.17763.

## 8.3 Shortname Disclosure

IIS on Windows exposes 8.3 format filenames through response code differences when probing with a tilde. This reveals partial file and directory names without directory listing. See the dedicated [shortname disclosure page](https://hackindex.io/services/iis/vulnerability-discovery/iis-short-name-disclosure) for full methodology:

```bash
nmap -p 80 --script http-iis-short-name-brute $TARGET_IP
# | http-iis-short-name-brute:
# |   Found 3 short names
# |   ASPNET~1 (directory)
# |   UPLOAD~1 (directory)
# |_  ADMINI~1 (directory)
```

## Content Discovery: IIS-Specific Extensions

```bash
gobuster dir -u http://$TARGET_IP/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -x aspx,asp,ashx,asmx,svc,config,txt,xml --random-agent -o iis_content.txt
```

## ASP.NET Config and Error Leakage

```bash
for path in /web.config /web.config.bak /web.config.old /web.config.zip /Web.config /App_Data/web.config; do code=$(curl -skI http://$TARGET_IP$path | grep HTTP | awk '{print $2}'); echo "$code $path"; done
# 404 /web.config
# 200 /web.config.bak
# 404 /web.config.old
```

```bash
curl -sk http://$TARGET_IP/doesnotexist.aspx | grep -iE 'version|path|stack|error|exception|c:\\' | head -10
# Server Error in '/' Application
# ASP.NET Version: 4.0.30319
# Physical path: C:\inetpub\wwwroot\doesnotexist.aspx
```

## Virtual Directory Mapping

Common IIS virtual directories (particularly on Exchange and SharePoint servers) are worth probing directly:

```bash
for vdir in owa ecp autodiscover rpc aspnet_client exchange sharepoint wsman; do code=$(curl -skI http://$TARGET_IP/$vdir/ | grep HTTP | awk '{print $2}'); echo "$code /$vdir/"; done
# 302 /owa/
# 200 /ecp/
# 401 /autodiscover/
# 401 /rpc/
# 404 /sharepoint/
```

OWA (Outlook Web App) and ECP (Exchange Control Panel) present confirm Exchange is running: a high-value target for NTLM relay and credential spraying. Move to [IIS misconfiguration checks](https://hackindex.io/services/iis/vulnerability-discovery/iis-misconfiguration-checks) and [shortname disclosure](https://hackindex.io/services/iis/vulnerability-discovery/iis-short-name-disclosure) next.

## References

- [IIS-ShortName-Scanner](https://github.com/irsdl/IIS-ShortName-Scanner) - Java-based 8.3 shortname scanner for IIS
- [nmap: http-iis-short-name-brute NSE](https://nmap.org/nsedoc/scripts/http-iis-short-name-brute.html) - 8.3 shortname brute enumeration via nmap
- [nmap: http-methods NSE](https://nmap.org/nsedoc/scripts/http-methods.html) - Allowed HTTP methods enumeration