IIS Reconnaissance: From Shodan to Tilde Enumeration

IIS servers remain one of the most consistently misconfigured web servers on the internet. A blue splash page isn't a dead end — it's an invitation. Here's how to approach IIS targets during bug bounty.

Finding IIS Servers

Shodan queries are the fastest way to discover IIS boxes tied to an organization:

ssl:"target.com" http.title:"IIS"
org:"target" http.title:"IIS"

These often reveal staging servers, forgotten admin panels, and internal tools exposed to the internet.

Google dorks catch indexed IIS pages:

site:target.com intitle:"IIS Windows Server"
site:target.com ext:aspx | ext:ashx | ext:asmx
site:target.com intext:"Microsoft-IIS" | intext:"X-Powered-By: ASP.NET"

The aspnet_client folder and _vti_bin (FrontPage extensions) are dead giveaways. Stacked wildcards like site:*.*.target.com catch nested subdomains.

Active fingerprinting with httpx:

httpx -l targets.txt -td | grep IIS | tee iis-targets.txt

Look for Server: Microsoft-IIS/10.0 and X-Powered-By: ASP.NET headers.

Internal IP Disclosure

Send an HTTP/1.0 request to certain IIS setups (especially Exchange or OWA fronts):

curl -v --http1.0 http://example.com

Response may leak internal IPs in the Location header and expose internal hostnames via X-FEServer headers:

HTTP/1.1 302 Moved Temporarily
Location: https://192.168.5.237/owa/
X-FEServer: NHEXCHANGE2016

Automate with Nuclei

Once you have a target list, blast them with IIS-specific templates:

nuclei -l iis-targets.txt \
  -tags microsoft,windows,asp,aspx,iis,azure,config,exposure -silent

The HTTPAPI 2.0 Dead End That Isn't

A generic HTTPAPI 2.0 404 error means the server didn't receive the correct Host header. Two approaches:

  • Check the SSL certificate's Subject Alternative Name (SAN) for the correct hostname.
  • Brute-force virtual hosts with ffuf:
ffuf -u https://TARGET_IP/ -H "Host: FUZZ.target.com" -w vhosts.txt -fs 0

IIS Tilde Enumeration: The Gift That Keeps Giving

IIS leaks 8.3 shortnames of files and directories via a legacy DOS behavior. Use shortscan:

shortscan https://target.com/ -F -p 1

Output reveals fragments like WEB~1.CON (web.config) or SITEBA~1.ZIP. Now you need to resolve the full filename.

Resolving Shortnames

Using LLMs — prompt a model to generate guesses given the snippet:

Return only a list of words, separated by newlines... Snippet: {shortname}

GitHub dorks — search GitHub's code search for filenames matching the first 6 characters:

path:/.ds_st
path:/global*.asa
path:/connec*.config

Tools like GSNW automate this:

python gsnw.py "siteba" output.txt

Using BigQuery — query GitHub's dataset for matching filenames:

SELECT DISTINCT path
FROM `bigquery-public-data.github_repos.files`
WHERE REGEXP_CONTAINS(path, r'(?i)(\/siteba[a-z0-9]+\.zip|^siteba[a-z0-9]+\.zip)')
LIMIT 1000

This returns real filenames like sitebackup.zip, sitebase.zip, etc.

Brute-forcing with crunch — when smart methods fail, generate all possible combinations:

crunch 4 6 abcdefghijklmnopqrstuvwxyz -o wordlist.txt
ffuf -w wordlist.txt -u https://target.com/desktoFUZZ.zip -mc 200,301,302,403

IIS-Specific Fuzzing Wordlists

Generic wordlists miss IIS-specific endpoints. High-value targets:

  • /web.config, /web.config.bak, /web.config.old
  • /trace.axd (ASP.NET trace viewer — full request/response logs)
  • /elmah.axd (error log viewer)
  • /global.asax, /connectionstrings.config
  • /WS_FTP.LOG, /_vti_pvt/service.cnf

Use IIS-specific extensions:

ffuf -u https://target.com/FUZZ -w iis-wordlist.txt \
  -e .asp,.aspx,.ashx,.asmx,.config,.json,.xml,.zip,.bak,.txt \
  -mc 200,301,302,403 -fs 0

Recommended wordlists: orwa's iis.txt (battle-tested), SecLists IIS.txt, Assetnote ASP and ASPX wordlists.

web.config: The Keys to the Kingdom

If you find web.config, it often contains connection strings, API keys, or configuration secrets. Path traversal attacks can retrieve it:

GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows/system32/inetsrv/config/applicationHost.config

Also check for bin directory DLL exposure via cookieless sessions, reverse proxy path confusion, and authentication bypass via NTFS alternate data streams.

File Upload Tricks & WAF Bypasses

  • Upload .config files disguised as images (e.g., web.config.png)
  • Use HTTP Parameter Pollution (HPP) to bypass WAF rules
  • Exploit IIS's handling of %00 null bytes to truncate file extensions

Next Steps

Add these techniques to your bug bounty toolkit. Start with shortscan on any IIS target, then use BigQuery or GitHub dorks to resolve shortnames. Fuzz for web.config, trace.axd, and elmah.axd — these debug endpoints often leak credentials. Automate the boring parts with nuclei and ffuf. Remember: behind that blue splash page lies a treasure trove of misconfigurations.