71–80 of 106 posts
Once upon a time, all server logs were basically unusable because of the amount of IIS scanners out there. There was a directory traversal that was literally just url encoding “../“ that absolutely lit the internet on fire for many months.
Does anyone use IIS anymore?
A lot of Microsoft devs know very little Linux historically as they used windows and are comfortable with it
Decreasing due to cloud and Nodejs takeup
Does anyone use IIS anymore?
Earlier quoted context omitted.
That's just security by obscurity, which is rated pretty appropriately.
Obscurity is a perfectly adequate layer of security. It shouldn't be the only layer but those who argue against adding it heard at some point "security through obscurity is not security" and never dug deeper.
Bear Defense Plan: Hide, Non-lethal, Lethal.
> IIS has a legacy behavior inherited from the old DOS 8.3 filename convention. Is this exposing the underlying OS's behavior coupled with the fact that the IIS document root is `C:\Inetpub` by default? Eight-dot-three filenames are enabled by default on the C drive but disabled by default on all other drives on Windows 10/11: PS> (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVe…
I got no response to that command on my W10 box, turns out for older (eg LTSC) versions it appears to need:
(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').ReleaseId
1809Earlier quoted context omitted.
It's from Hackers: https://www.scifiscripts.com/scripts/hackers.txt#:~:text=Any...
You'know, there ought to be a way to deep link into a tortent file.
https://memes.getyarn.io/yarn-clip/e9d8176d-e936-4224-a1d1-f...
Oh man this takes me back. Once upon a time, all server logs were basically unusable because of the amount of IIS scanners out there. There was a directory traversal that was literally just url encoding “../“ that absolutely lit the internet on fire for many months.
Earlier quoted context omitted.
Several times, I wondered if Claude wrote it.
One confusing part is that the blue screen is not a reference to BSOD but to the IIS default page with the blue squares. That’s probably jargon. The article lists all the tricks I’ve collected over the years doing pentesting and then some, with great tool references. The signal to noise ratio is very high and there’s little “here’s why” filler which instead might just be someone’s way of storytelling. The article dro…
Earlier quoted context omitted.
but...why?
Really simple. I read the prerequisites of whatever software im asked to install and do what it says. I'm not spending the next 3 years of my life trying to make some monitoring platform run on WebLogic i have other jobs to do in 4-8-12 hours.
Earlier quoted context omitted.
Obscurity is a perfectly adequate layer of security. It shouldn't be the only layer but those who argue against adding it heard at some point "security through obscurity is not security" and never dug deeper.
I agree. Hiding from a grizzly bear is a good strategy. But if that fails, you will need pepper spray and maybe a shotgun. Bear Defense Plan: Hide, Non-lethal, Lethal.