# IIS Misconfiguration Checks

> Enumerate IIS misconfigurations including directory listing, WebDAV, default pages, request filtering bypasses, and insecure authentication settings.

- **URL:** https://hackindex.io/services/iis/vulnerability-discovery/iis-misconfiguration-checks
- **Path:** IIS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/iis/vulnerability-discovery.md)
- **Published:** 2026-03-30
- **Updated:** 2026-08-11

IIS misconfigurations expose application internals, enable dangerous HTTP methods, and leak file paths and framework versions. Each finding below is independently reportable. Run these after [IIS enumeration](https://hackindex.io/services/iis/enumeration/iis-enumeration) establishes the version and surface. Confirmed misconfigurations feed directly into exploitation paths.

IIS misconfigurations to check:

- Directory listing enabled (exposes application structure)
- TRACE method enabled (cross-site tracing risk)
- Verbose error pages leaking file paths and stack traces
- Default pages and sample applications still accessible

## IIS misconfiguration checks: directory listing

Check whether IIS returns directory contents when no default document exists:

```bash
curl -sk http://$TARGET_IP/ | grep -iE 'directory listing|parent directory|\[DIR\]'
# <h2>Directory Listing for /</h2>
# <a href="uploads/">uploads/</a>
```

```bash
for path in / /uploads/ /files/ /backup/ /images/ /scripts/; do code=$(curl -sk http://$TARGET_IP$path | grep -c 'Directory Listing'); [ $code -gt 0 ] && echo "Directory listing: http://$TARGET_IP$path"; done
# Directory listing: http://10.10.10.50/uploads/
```

## TRACE Method Enabled

HTTP TRACE reflects the request back to the client including all headers. On IIS it is enabled by default and should be explicitly disabled:

```bash
curl -sk -X TRACE http://$TARGET_IP/ -H 'X-Custom-Header: tracetest' | grep -i 'TRACE\|tracetest'
# TRACE / HTTP/1.1
# X-Custom-Header: tracetest
```

The server reflecting the request body confirms TRACE is active. This is a reportable misconfiguration enabling cross-site tracing (XST) attacks in combination with XSS.

## ASP.NET Stack Trace and Path Disclosure

Custom errors disabled or misconfigured causes ASP.NET to return full stack traces with physical file paths:

```bash
curl -sk http://$TARGET_IP/doesnotexist.aspx | grep -iE 'physical path|stack trace|c:\\|d:\\|exception|version'
# Physical path: C:\inetpub\wwwroot\doesnotexist.aspx
# ASP.NET Version: 4.0.30319
# Exception Details: System.Web.HttpException
```

```bash
curl -sk http://$TARGET_IP/web.config.bak
# <?xml version="1.0" encoding="UTF-8"?>
# <configuration>
#   <connectionStrings>
#     <add name="DefaultConnection" connectionString="Server=10.10.10.20;Database=webapp;User Id=sa;Password=SqlP@ss2024!" />
#   </connectionStrings>
```

A web.config backup containing a connection string with credentials is a direct path to the database. Test the credentials immediately against the MSSQL service.

## ASP.NET Debug Mode Enabled

Debug mode enabled in web.config or detectable via response headers exposes additional information and may enable remote debugging:

```bash
curl -sk http://$TARGET_IP/ | grep -i 'debug\|compilation debug'
```

```bash
curl -skI http://$TARGET_IP/ | grep -i 'x-debug\|x-aspnet-debug'
```

## Exposed Sensitive Files

Check for common IIS-specific sensitive files that are sometimes accessible despite server restrictions:

```bash
for file in /web.config /web.config.bak /web.config.old /global.asax /global.asax.bak /.git/HEAD /elmah.axd /trace.axd /App_Data/ /App_Data/database.mdb; do code=$(curl -skI http://$TARGET_IP$file | grep HTTP | awk '{print $2}'); echo "$code $file"; done
# 404 /web.config
# 200 /web.config.bak
# 404 /web.config.old
# 200 /elmah.axd
# 404 /trace.axd
```

elmah.axd (Error Logging Modules and Handlers) accessible without authentication is a high-impact finding: it exposes the full application error log including SQL queries, connection strings, and internal paths. Pull the full log:

```bash
curl -sk http://$TARGET_IP/elmah.axd | grep -iE 'password|connection|exception|server error' | head -20
```

## IIS Version-Specific Vulnerabilities

Cross-reference the detected version against known CVEs before moving to manual testing:

```bash
searchsploit 'Microsoft IIS' | grep -iE '10\.0|8\.5|7\.5|remote'
```

```bash
nuclei -u http://$TARGET_IP/ -tags iis,microsoft -severity medium,high,critical
```

## References

- [Microsoft: IIS Security Configuration](https://learn.microsoft.com/en-us/iis/manage/configuring-security/how-to-use-the-sample-read-only-xml-membership-and-role-providers-with-iis) - IIS security hardening reference including custom errors and method restrictions
- [ELMAH](https://elmah.github.io/) - Error Logging Modules and Handlers: common IIS error log exposure