IIS Security Presentation by Jeni Li
Common types of attacks against web servers
- Directory traversal

• Code Blue
• Effects
• unauthorized file access
• execution of command line commands

• Effects
• denial of service

• CodeRed
• Effects
• denial of service

• check logs for abnormal requests for executables (those you're not using in your application specifically)
• REMOVE all sample applications that come with any web server
• especially items in //iisadmin or /MSADC directories

• eliminate unnecessary mappings
• remove sample applications

• only allow known good extensions
• resolve URLs complete, then filter them

• eliminate the server header
• modify or eliminate the content location head
• bind te web service to the FQDN

• add as a snap-in to MMC
• select template(s) to use
• scans the computer based on the template(s) used
• configure the templates
• save the templates and use for configuring other

• www.microsoft.com/technet/security/tools/locktool/mspx
• always view the template settings that have been assigned to a role (just to be safe before arbitrarily assigning a role to a service.
• script maps - disable support for selected script maps
• install URL scan filter on the server

• can be configured to keep a log of error messages that have been encountered - very detailed and very helpful
• modify or eliminate the content location head
• bind te web service to the FQDN

• not installed by default (install can be disabled by Group Policy)
• specify what to install
• runs without System context, has restricted NetworkService user instead

• check permissions settings
• Web service disabled on upgrade
• recommend new install rather then upgrade

• Windows 2003 Web Edition-limited, better to get standard edition
• remote admin has multiple vulnerabilities already
• inetinfo.exe