https://github.com/lijiejie/IIS_shortname_Scanner

an IIS shortname Scanner
https://github.com/lijiejie/IIS_shortname_Scanner

Last synced: 21 days ago
JSON representation

an IIS shortname Scanner

• Host: GitHub
• URL: https://github.com/lijiejie/IIS_shortname_Scanner
• Owner: lijiejie
• Created: 2014-10-13T13:21:11.000Z (about 10 years ago)
• Default Branch: master
• Last Pushed: 2022-12-08T10:54:13.000Z (about 2 years ago)
• Last Synced: 2024-11-13T16:58:19.595Z (29 days ago)
• Language: Python
• Size: 10.7 KB
• Stars: 535
• Watchers: 18
• Forks: 227
• Open Issues: 2
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - lijiejie/IIS_shortname_Scanner - an IIS shortname Scanner (Python)

README

        
# IIS shortname Scanner #

Under certain circumstances, windows 8.3 short names may be bruteforce enumerated under IIS with .net enabled,

request these two urls:

* http://www.target.com/*~1****/a.aspx

* http://www.target.com/l1j1e*~1****/a.aspx

If the first one return HTTP 404 and the second one return no 404. Your server might be exploitable to this vulnerability.

## Change Log (Oct 27, 2016)

* Bug fixed: extention short than 4 letters like ```/webdeb~1.cs``` now could be enumerated

* Code reconstruction

## Usage

```

	iis_shortname_Scan.py target

```

from [http://www.lijiejie.com](http://www.lijiejie.com)    my[at]lijiejie.com