6 ms·
Humiliating IIS servers for fun and jail time
- naturalmovement 4mo agoI front all my honeypots with the IIS landing page precisely because it attracts black hat jagoffs. Nothing makes me happier than knowing I've wasted hours of their time chasing their own tails.
- themafia 4mo agoNoise is a really underrated security layer.
- YeahThisIsMe 4mo agoThat's just security by obscurity, which is rated pretty appropriately.
- close04 4mo agoObscurity is a perfectly adequate layer of security. It shouldn't be the only layer but those who argue against adding it heard at some point "security through obscurity is not security" and never dug deeper.
- seethishat 4mo agoI agree. Hiding from a grizzly bear is a good strategy. But if that fails, you will need pepper spray and maybe a shotgun. Bear Defense Plan: Hide, Non-lethal, Lethal.
- Alphanymous 4mo agoYou've said it just like it is, prevention + preparation.
- loneboat 4mo ago... those who argue against adding it heard at some point "security through obscurity is not security" and never dug deeper. Ironically, that makes them the exact type of person who would be successfully deterred by a layer of obscurity.
- l23k4 4mo ago[dead]
- p1necone 4mo agoWhy stop there? Front the honeypot with a real IIS server, build a matryoshka doll of honeypots and see how far people get.
- wil421 4mo agoTell me more…I opened a plex and Nintendo switch port, the scans were out of control. I’d love to screw over port scanner over.
- DaSHacka 4mo agoUnless you're honeypotting in the IP range of an established organization, all you're doing is getting bot traffic. High-tier blackhats focus on big targets, and low-tier ones focus on low-hanging fruits they find off shodan or application 0days they've found.
- bitwize 4mo ago"Guys, guys, guys, listen, listen, listen. So I'm in this computer, right? So I'm lookin' around, lookin' around, throwing commands at it, I don't know where it is or what it does or anything..."
- forgetfreeman 4mo agoSome ATM in bumsville Idaho spit $700 into the middle of the street.
- wildlogic 4mo agojoey, is that you!?
- stavros 4mo agoWhere's that from?
- bryanrasmussen 4mo agoI think it's from hackers, Joey the youngest hacker found the bad guys computers, not sure if it's an accurate quote since it's been years since I saw it.
- egil 4mo ago"They're trashing! They're trashing our rights!"
- giancarlostoro 4mo ago
- raverbashing 4mo agoSounds like creating an url like aspnet_client/admin.php returning a WebObjects header might be a good hobby
- kreyenborgi 4mo agoAdd in a zip bomb or two?
- MrDrMcCoy 4mo agoNow you have me wondering how badly http gzip content compression can be abused along those lines.
- hstaab 4mo agoThe tone of this is something else
- andai 4mo agoSeveral times, I wondered if Claude wrote it.
- Stitch4223 4mo agoOne confusing part is that the blue screen is not a reference to BSOD but to the IIS default page with the blue squares. That’s probably jargon. The article lists all the tricks I’ve collected over the years doing pentesting and then some, with great tool references. The signal to noise ratio is very high and there’s little “here’s why” filler which instead might just be someone’s way of storytelling. The article drones on, but with actual content as there is a lot to tell. It’s even light on features like trace.axd, but does mention them and their purposes. I found it an entertaining overview of taking apart unassuming IIS servers and the point of “Recon harder. ” is made very well :) Edit: s/boring/unassuming + added point was made very well
- 0x1d7 4mo agoYes, it's jargon. Blue screen is that default page. Yellow screen of death is another one, referring to when ASP.NET throws an exception and you have detailed exceptions turned on (which for public sites, you shouldn't).
- Tiberium 4mo agoIt did, this article is clearly LLM-written/edited
- merpkz 4mo ago"This is the brute-force fallback when the smart approaches fail, and honestly, it works more often than you’d expect." Found the LLM generated part.
- 4mo ago
- AuthAuth 4mo agoAh webpage formatting cooked but otherwise a fun read
- sytelus 4mo agoThis is extremely well done design (at least on full desktop browsers). Amazing content as well.
- mopsi 4mo ago"Amazing" is a little generous for script kiddie stuff from the early 2000s. The author has yet to learn the extent to which civilization depends on people not being cunts to one another for no good reason.
- caspper69 4mo agoAh yes, the lulz, the great American pastime.
- deadbabe 4mo ago[flagged]
- cindyllm 4mo ago[dead]
- dakolli 4mo agoThere's like 90,000 computer fraud reports sent to the federal government every year and about 400 prosecutions total. Most of those are concentrated in whatever niche abuse category the government is focused on at the time (right now, crypto/phishing/ransomware). note: Don't take this as your cue to start messing around with black hat. Don't become the guy trying to explain to your cell mate who's doing 50 years for a violent crimes what a unauthenticated supabase table is and why you deleted it.
- BalinKing 4mo agoThe lead says "how I approach IIS targets during bug bounty" (emphasis mine), so (assuming the author is being truthful) I'm guessing the tone of the title is just for fun.
- 4mo ago
- Group_B 4mo agoWould love to see a write yo on nginx!
- Lammy 4mo ago> IIS has a legacy behavior inherited from the old DOS 8.3 filename convention. Is this exposing the underlying OS's behavior coupled with the fact that the IIS document root is `C:\Inetpub` by default? Eight-dot-three filenames are enabled by default on the C drive but disabled by default on all other drives on Windows 10/11: PS> (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion 24H2 PS> fsutil 8dot3name query C: The volume state is: 0 (8dot3 name creation is ENABLED) The registry state is: 2 (Per volume setting - the default) Based on the above settings, 8dot3 name creation is ENABLED on "C:" PS> fsutil 8dot3name query U: The volume state is: 1 (8dot3 name creation is DISABLED) The registry state is: 2 (Per volume setting - the default) Based on the above settings, 8dot3 name creation is DISABLED on "U:"
- Terr_ 4mo agoTangentially, that reminds me of how a Windows update created c:\inetpub on everybody's non-server computers, to "increase protection" for unspecified reasons. https://www.pcworld.com/article/2684062/why-is-windows-11-latest-update-creating-a-mysterious-inetpub-folder.html https://www.pcworld.com/article/2684062/why-is-windows-11-la...
- Lammy 4mo ago> to "increase protection" for unspecified reasons Everything old is new again https://devblogs.microsoft.com/oldnewthing/20041116-00/?p=37303 https://devblogs.microsoft.com/oldnewthing/20041116-00/?p=37... (2004)
- mook 4mo agoThat page eventually leads to the CVE page: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21204 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... While that's still pretty vague, it sounds like the issue was that something running as SYSTEM (the page seems to indicate some part of Windows Update) was not correctly checking if inetpub was a symlink or something along those lines. It also links to a script to set ACLs on that directory; presumably that's not possible to do if the directory doesn't exist. It would probably be better to fix whatever component to not have the link traversal bug, but maybe there's some reason that makes the proper fix infeasible…
- t1234s 4mo agoDoes anyone use IIS anymore?
- vlan0 4mo agoThe entire solarwinds platform(barf)
- qingcharles 4mo agoYeah, I regularly speak to folks still running IIS on Windows Server. There are a lot of old apps out there, sadly. Some really, really important ones.
- mpyne 4mo agoTons of the Navy's public websites still run on it.
- thedougd 4mo agoAmazingly some companies like Hyland still ship software that requires IIS. Bonus add are the pages and pages of setup instructions.
- robotnikman 4mo agoAnd NCR from my experience.
- pjmlp 4mo agoSitecore, Microsoft as two other examples. Sitecore on the classical XP/XM stack, they don't seem to be bothered to update it to modern .NET, as the new products moved away from .NET (XM Cloud and co). Microsoft still has stuff like Dynamics 365, running .NET Framework.
- naturalmovement 4mo agoSome banks still use IIS. Every large company big enough to host an intranet is running IIS somewhere, possibly everywhere. It integrates well with AD so some really complex tasks become stupid simple. It's seeing less and less usage as the world moves to AWS which is equally stupid because you're tied to one vendor's proprietary products (Amazon) again. Except this time you don't own the hardware. Public sector IT loves IIS. Check your municipality's tax or property website it's probably got .aspx scripts out the ass. I've seen it hosting European web apps, public sector if I recall. Lots of bespoke .NET applications out there with SQL Server backends running entire local governments. Asian countries especially China and Taiwan love IIS and use it to host anything and everything. This is a personal observation. Sure the world has mostly moved on, but there's tons of legacy code out there that keeps cities and really important organizations humming that runs on IIS and it's never changing. You think that's bad, there's still places out there running AS/400 stuff on the web, Lotus Notes, and Novell Groupwise (gasp).
- NooneAtAll3 4mo agowhat's the deal with left sidebar overlapping the main text?
- kahf56 4mo agogood entertainment
- xmcp123 4mo agoOh man this takes me back. Once upon a time, all server logs were basically unusable because of the amount of IIS scanners out there. There was a directory traversal that was literally just url encoding “../“ that absolutely lit the internet on fire for many months.
- 0x1d7 4mo agoThose traversal attempts are still very common, right next to the PHP/WordPress script kiddie attacks.
- dpoloncsak 4mo ago"The White Noise of the Internet" as they call it
- RetroTechie 4mo agoWondering how far back that goes.. Win95 still vulnerable? (Edit: I mean active attempts to exploit in the wild)