Windows Forum

Ask something
Discussion Locked

IIS Security

0 helpful
6 replies

by tech010

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am responsible for testing the security for my companies web site before it goes live. We are running IIS 5 off of a Windows 2000 server. How can I attempt to hack into IIS. I know that a lot of hackers use the ISAPI extensions to hack IIS but is there anywhere I can go that will tell me specifically how to do this so that I can be sure we're secure? Thanks.

6 replies

by dicksanm

If I were you I would use the IIS lockdown tool provided by microsoft first. Also use a tool they have called patch checker. It will let you know about patches that the windows update does not along with the associated article numbers to explain what they fix. After you do all this you should be ok on the IIS side you have to make sure of course that your server is not directly connected to the internet. You want to be behind a firewall with only the ports you need open. I hope this helps you although this is not directly related to hacking in it was very useful to me.

by faisalmasood

Try to use these articles to secure your server first.

http://www.microsoft.com/technet/security/iis5chk.asp

Also search for "securing_iis_whpaper" white paper at IIS or technet site.
http://www.microsoft.com/technet

IIS lockdown tool:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=19889

IIS hot fix checking tool:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=24168

& IIS tunning
http://www.microsoft.com/TechNet/iis/iis5tune.asp

IIS Security planning tool:

http://www.microsoft.com/downloads/release.asp?ReleaseID=24973

by faisalmasood

Don't forget to install MS01-044 IIS cumulative Patch fir IIS beside other patches & service packs for your OS & applications.

This discussion is closed to new replies.