Humiliating IIS servers for fun and jail time

Join the discussion

• Hacker News
• This is extremely well done design (at least on full desktop browsers). Amazing content as well.
  by sytelus
• Would love to see a write yo on nginx!
  by Group_B
• Ah webpage formatting cooked but otherwise a fun read
  by AuthAuth
• Does anyone use IIS anymore?
  by t1234s
• Oh man this takes me back.

  Once upon a time, all server logs were basically unusable because of the amount of IIS scanners out there. There was a directory traversal that was literally just url encoding “../“ that absolutely lit the internet on fire for many months.

  by xmcp123
• The tone of this is something else
  by hstaab
• > IIS has a legacy behavior inherited from the old DOS 8.3 filename convention.

  Is this exposing the underlying OS's behavior coupled with the fact that the IIS document root is `C:\Inetpub` by default? Eight-dot-three filenames are enabled by default on the C drive but disabled by default on all other drives on Windows 10/11:

    PS> (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion
    24H2
  
    PS> fsutil 8dot3name query C:
    The volume state is: 0 (8dot3 name creation is ENABLED)
    The registry state is: 2 (Per volume setting - the default)
    Based on the above settings, 8dot3 name creation is ENABLED on "C:"
  
    PS> fsutil 8dot3name query U:
    The volume state is: 1 (8dot3 name creation is DISABLED)
    The registry state is: 2 (Per volume setting - the default)
    Based on the above settings, 8dot3 name creation is DISABLED on "U:"

  by Lammy
• I front all my honeypots with the IIS landing page precisely because it attracts black hat jagoffs.

  Nothing makes me happier than knowing I've wasted hours of their time chasing their own tails.

  by naturalmovement