Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • good entertainment
    by kahf56
  • what's the deal with left sidebar overlapping the main text?
    by NooneAtAll3
  • This is extremely well done design (at least on full desktop browsers). Amazing content as well.
    by sytelus
  • "Amazing" is a little generous for script kiddie stuff from the early 2000s.

    The author has yet to learn the extent to which civilization depends on people not being cunts to one another for no good reason.

    by mopsi
  • > This is extremely well done design (at least on full desktop browsers).

    I can't tell if you're being sarcastic, but on my full desktop browser the side bar overlaps the main panel, putting text on top of other text.

    P.S. Other than this, I do like the presentation.

    by aix1
  • Would love to see a write yo on nginx!
    by Group_B
  • Ah webpage formatting cooked but otherwise a fun read
    by AuthAuth
  • Does anyone use IIS anymore?
    by t1234s
  • Amazingly some companies like Hyland still ship software that requires IIS. Bonus add are the pages and pages of setup instructions.
    by thedougd
  • I've seen it used to deliver 'apps' that 90% of a business's employees use. (EX: Met/Team) in the Metrology (calibration) space.
    by chainingsolid
  • Yep.

    And as an ignoramus: what it is that you are supposed to be using nowadays?

    Think in the context of a small company making enterprise .NET (framework) code where Windows is the world, cloud wouldn't fly with the customers, SOAP is still king and your one IT guy is too busy to notice anything happened after 2010. Suppose also that entire software rewrites are impossibly impractical, and that while you'd love to take some security gains, you just don't have the capacity to do configuration deep dives let alone to gamble on something complex like Kubernetes.

    by bartnp
  • A lot of big corps still use it.

    https://bloomberry.com/data/windows-server/

    by AznHisoka
  • Yeah, I regularly speak to folks still running IIS on Windows Server. There are a lot of old apps out there, sadly. Some really, really important ones.
    by qingcharles
  • Some banks still use IIS.

    Every large company big enough to host an intranet is running IIS somewhere, possibly everywhere. It integrates well with AD so some really complex tasks become stupid simple.

    It's seeing less and less usage as the world moves to AWS which is equally stupid because you're tied to one vendor's proprietary products (Amazon) again. Except this time you don't own the hardware.

    Public sector IT loves IIS. Check your municipality's tax or property website it's probably got .aspx scripts out the ass.

    I've seen it hosting European web apps, public sector if I recall. Lots of bespoke .NET applications out there with SQL Server backends running entire local governments.

    Asian countries especially China and Taiwan love IIS and use it to host anything and everything. This is a personal observation.

    Sure the world has mostly moved on, but there's tons of legacy code out there that keeps cities and really important organizations humming that runs on IIS and it's never changing.

    You think that's bad, there's still places out there running AS/400 stuff on the web, Lotus Notes, and Novell Groupwise (gasp).

    by naturalmovement
  • Way, WAY too many corporate IT divisions.
    by samplatt
  • I do. As others have replied, Windows Server--including IIS, means you have a domain joined machine, likely with an SPN of HOST/MACHINE.DOMAIN. Windows services and IIS App Pool Identities log in with an (g)MSA or virtual accounts (NT Service*) and you get a fully working and managed Kerberos experience without having to deal with 30, 60, 90 day password rotations. Log into your MS SQL Server with Kerberos, log into some other webapp's oauth2 flow with Kerberos, etc, it all just works. You can use WinRM with your native Windows shell without having to do anything special, and even technically bypass 2FA since that's just how it really works.

    Can you do all this on Linux? Yes. Will it ever be set up correctly? Depends where you work, but based on my experience so far, not likely.

    by prussian
  • Oh man this takes me back.

    Once upon a time, all server logs were basically unusable because of the amount of IIS scanners out there. There was a directory traversal that was literally just url encoding “../“ that absolutely lit the internet on fire for many months.

    by xmcp123
  • Those traversal attempts are still very common, right next to the PHP/WordPress script kiddie attacks.
    by 0x1d7
  • The tone of this is something else
    by hstaab
  • Several times, I wondered if Claude wrote it.
    by andai
  • > IIS has a legacy behavior inherited from the old DOS 8.3 filename convention.

    Is this exposing the underlying OS's behavior coupled with the fact that the IIS document root is `C:\Inetpub` by default? Eight-dot-three filenames are enabled by default on the C drive but disabled by default on all other drives on Windows 10/11:

      PS> (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion
  24H2

  PS> fsutil 8dot3name query C:
  The volume state is: 0 (8dot3 name creation is ENABLED)
  The registry state is: 2 (Per volume setting - the default)
  Based on the above settings, 8dot3 name creation is ENABLED on "C:"

  PS> fsutil 8dot3name query U:
  The volume state is: 1 (8dot3 name creation is DISABLED)
  The registry state is: 2 (Per volume setting - the default)
  Based on the above settings, 8dot3 name creation is DISABLED on "U:"
    by Lammy
  • > PS> (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\WindowsNT\CurrentVersion').DisplayVersion > 24H2

    I got no response to that command on my W10 box, turns out for older (eg LTSC) versions it appears to need:

      (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').ReleaseId
  1809
    by logifail
  • The original research for this is at https://soroush.me/downloadable/microsoft_iis_tilde_characte...
    by raesene9
  • Tangentially, that reminds me of how a Windows update created c:\inetpub on everybody's non-server computers, to "increase protection" for unspecified reasons.

    https://www.pcworld.com/article/2684062/why-is-windows-11-la...

    by Terr_
  • I front all my honeypots with the IIS landing page precisely because it attracts black hat jagoffs.

    Nothing makes me happier than knowing I've wasted hours of their time chasing their own tails.

    by naturalmovement
  • Tell me more…I opened a plex and Nintendo switch port, the scans were out of control. I’d love to screw over port scanner over.
    by wil421
  • Sounds like creating an url like aspnet_client/admin.php returning a WebObjects header might be a good hobby
    by raverbashing
  • Noise is a really underrated security layer.
    by themafia
  • Unless you're honeypotting in the IP range of an established organization, all you're doing is getting bot traffic.

    High-tier blackhats focus on big targets, and low-tier ones focus on low-hanging fruits they find off shodan or application 0days they've found.

    by DaSHacka
  • Why stop there? Front the honeypot with a real IIS server, build a matryoshka doll of honeypots and see how far people get.
    by p1necone