We're the exploits helped out in any way by Windows itself or were they solely exploiting IIS alone? Never used it but I assume at least before it may have been

We're the exploits helped out in any way by Windows itself or were they solely exploiting IIS alone? Never used it but I assume at least before it may have been pretty integrated into Windows.