Skip to content
HackIndex logo

HackIndex

IIS Misconfiguration Checks

3 min read Mar 30, 2026

IIS misconfigurations expose application internals, enable dangerous HTTP methods, and leak file paths and framework versions. Each finding below is independently reportable. Run these after IIS enumeration establishes the version and surface. Confirmed misconfigurations feed directly into exploitation paths.

Directory Listing Enabled

Check whether IIS returns directory contents when no default document exists:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP/ | grep -iE 'directory listing|parent directory|\[DIR\]' 
<h2>Directory Listing for /</h2>
<a href="uploads/">uploads/</a>
┌──(kali㉿kali)-[~]
└─$ for path in / /uploads/ /files/ /backup/ /images/ /scripts/; do code=$(curl -sk http://$TARGET_IP$path | grep -c 'Directory Listing'); [ $code -gt 0 ] && echo "Directory listing: http://$TARGET_IP$path"; done 
Directory listing: http://10.10.10.50/uploads/

TRACE Method Enabled

HTTP TRACE reflects the request back to the client including all headers. On IIS it is enabled by default and should be explicitly disabled:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X TRACE http://$TARGET_IP/ -H 'X-Custom-Header: tracetest' | grep -i 'TRACE\|tracetest' 
TRACE / HTTP/1.1
X-Custom-Header: tracetest

The server reflecting the request body confirms TRACE is active. This is a reportable misconfiguration enabling cross-site tracing (XST) attacks in combination with XSS.

ASP.NET Stack Trace and Path Disclosure

Custom errors disabled or misconfigured causes ASP.NET to return full stack traces with physical file paths:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP/doesnotexist.aspx | grep -iE 'physical path|stack trace|c:\\|d:\\|exception|version' 
Physical path: C:\inetpub\wwwroot\doesnotexist.aspx
ASP.NET Version: 4.0.30319
Exception Details: System.Web.HttpException
┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP/web.config.bak 
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <connectionStrings>
    <add name="DefaultConnection" connectionString="Server=10.10.10.20;Database=webapp;User Id=sa;Password=SqlP@ss2024!" />
  </connectionStrings>

A web.config backup containing a connection string with credentials is a direct path to the database. Test the credentials immediately against the MSSQL service.

ASP.NET Debug Mode Enabled

Debug mode enabled in web.config or detectable via response headers exposes additional information and may enable remote debugging:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP/ | grep -i 'debug\|compilation debug'
┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP/ | grep -i 'x-debug\|x-aspnet-debug'

Exposed Sensitive Files

Check for common IIS-specific sensitive files that are sometimes accessible despite server restrictions:

┌──(kali㉿kali)-[~]
└─$ for file in /web.config /web.config.bak /web.config.old /global.asax /global.asax.bak /.git/HEAD /elmah.axd /trace.axd /App_Data/ /App_Data/database.mdb; do code=$(curl -skI http://$TARGET_IP$file | grep HTTP | awk '{print $2}'); echo "$code $file"; done 
404 /web.config
200 /web.config.bak
404 /web.config.old
200 /elmah.axd
404 /trace.axd

elmah.axd (Error Logging Modules and Handlers) accessible without authentication is a high-impact finding — it exposes the full application error log including SQL queries, connection strings, and internal paths. Pull the full log:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP/elmah.axd | grep -iE 'password|connection|exception|server error' | head -20

IIS Version-Specific Vulnerabilities

Cross-reference the detected version against known CVEs before moving to manual testing:

┌──(kali㉿kali)-[~]
└─$ searchsploit 'Microsoft IIS' | grep -iE '10\.0|8\.5|7\.5|remote'
Explain command
'Microsoft IIS' Search term to query the Exploit-DB local database for IIS exploits.
-iE Case-insensitive matching using extended regular expressions.
'10\.0|8\.5|7\.5|remote' Regex pattern to filter results matching IIS versions or remote exploits.
┌──(kali㉿kali)-[~]
└─$ nuclei -u http://$TARGET_IP/ -tags iis,microsoft -severity medium,high,critical
Explain command
-u http://$TARGET_IP/ Target URL to scan, with dynamic IP placeholder.
-tags iis,microsoft Run only templates tagged with 'iis' or 'microsoft'.
-severity medium,high,critical Filter templates by severity: medium, high, or critical.

References