Thread by @ctbbpodcast

IIS Hacking tips from the latest episode with the master himself @infosec_au:
1. NEVER leave that blue IIS page un-touched
"You see that blue page that comes up when you hit an IIS server? That should be your point where you think, I'm gonna find criticals on this bad boy.

2. Use shortscan or other shortname scanners to enumerate directory and file shortnames
IIS is vulnerable to short name file enumeration. This allows you to determine the first 6 chars of the name and 3 chars of extension.
github.com/bitquark/short…

3. Look for IIS reverse proxies and traverse using ..%2f
If you can find a place where there is a reverse proxy on IIS, you can traverse on the backend server using ..%2f
ie
if: /backend/ -> 10.0.0.1/api/
then: /backend/..%2ftest -> 10.0.0.1/test
See: bit.ly/2cxtct

4. When you manage to get LFD, grab the machine keys from web.conf to pivot to RCE
IIS is one of the easiest targets to get RCE on bc if you can leak the web.conf file, you normally have RCE via deserialization. See:
book.hacktricks.xyz/pentesting-web…

5. When you manage to get a file write, try all different IIS executable filetypes (.aspx, .asp, .ashx, etc)
Lots fo ways to get RCE with file write: learn.microsoft.com/en-us/previous…

Hit us with a retweet if you dig Shub's tips:

https://twitter.com/ctbbpodcast/status/1688607912434819073