IIS:
Exploitation
WebDAV abuse, ASPX shell upload, and auth attacks on IIS
IIS ASPX Web Shell Upload
Exploit IIS misconfigurations to upload and execute ASPX web shells, gaining remote code execution on Windows servers running IIS.
IIS exploitation leverages the server's unique features and common misconfigurations. Short filename disclosure (the tilde vulnerability) leaks file and directory names that should be hidden. WebDAV, when enabled, can allow file uploads and remote code execution.
Handler exploitation targets misconfigured ISAPI extensions and ASP.NET handlers. Version-specific CVEs like CVE-2017-7269 (WebDAV buffer overflow) provide direct remote code execution on unpatched servers.
The subpages cover short name brute-forcing, WebDAV abuse, handler exploitation, and known IIS CVEs.