Hacking IIS (Recon) (Part 1)

Most IIS versions have been confirmed to be vulnerable to IIS shortname enumeration by default. This video goes into detail regarding what shortnames are, and how they are relevant when it comes to testing IIS servers. You will find some example successes in bug bounties at the end of the video.

I plan on making a few videos around IIS and .NET hacking. This is the first video in that series.

Links from the video:

https://twitter.com/irsdl
https://soroush.secproject.com/blog/
https://bit.ly/2DSwtX0
https://www.acunetix.com/blog/web-security-zone/windows-short-8-3-filenames-web-security-problem/
https://github.com/irsdl/IIS-ShortName-Scanner

Attack surface management platform: https://assetnote.io

Precious Time by Ketsa
Creative Commons Attribution
https://creativecommons.org/licenses/by-nc-nd/4.0/
Source: https://ketsamusic.com/track/1998282/precious-time

Видео Hacking IIS (Recon) (Part 1) канала Assetnote