Categories: intrusive, brute
Attempts to brute force the 8.3 filenames (commonly known as short names) of files and directories in the root folder of vulnerable IIS servers. This script is an implementation of the PoC "iis shortname scanner".
The script uses ~,? and * to bruteforce the short name of files present in the IIS document root. Short names have a restriction of 6 character file name followed by a three character extension.
- The script might have to be run twice (according to the original author).
- Tested against IIS 6.0 and 5.1.
- Research paper: http://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf
- IIS Shortname Scanner PoC: https://github.com/irsdl/IIS-ShortName-Scanner
See the documentation for the slaxml library.
- http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent
See the documentation for the http library.
- smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername
See the documentation for the smbauth library.
- vulns.short, vulns.showall
See the documentation for the vulns library.
nmap -p80 --script http-iis-short-name-brute <target>
PORT STATE SERVICE 80/tcp open http | http-iis-short-name-brute: | VULNERABLE: | Microsoft IIS tilde character "~" short name disclosure and denial of service | State: VULNERABLE (Exploitable) | Description: | Vulnerable IIS servers disclose folder and file names with a Windows 8.3 naming scheme inside the webroot folder. | Shortnames can be used to guess or brute force sensitive filenames. Attackers can exploit this vulnerability to | cause a denial of service condition. | | Extra information: | | 8.3 filenames found: | Folders | admini~1 | Files | backup~1.zip | certsb~2.zip | siteba~1.zip | | References: | http://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf |_ https://github.com/irsdl/IIS-ShortName-Scanner
License: Same as Nmap--See https://nmap.org/book/man-legal.html