Collaborate Disseminate
I have an IIS server and while monitoring the windows logs I encounter an interesting sysmon log.
It was an Event ID 7: Image loaded log which showed that w3wp.exe loaded wmiutils.dl.
They’re both legitimate versions and not tampered with…. Continue reading Suspicious wmiutils.dll Loaded [closed]
When I enter my site’s URL in IE, it shows a popup asking me to choose a certificate.
I want to understand:
What is it that is causing the popup to show up? Is it some code in the website that forces IE to ask me to choose a certificate?
… Continue reading What causes the certificate popup in IE? [closed]
“It was 20 years ago today…” that we learned a few lessons that are well worth revisiting! Continue reading The Code Red worm 20 years on – what have we learned?
I would like to simulate a HTTP host header injection on a local IIS webserver, however, I do not see any redirection occurring.
I have the default website configured on port 80 and another site on port 80 but this has a hostname test.site… Continue reading Simulate host header injection on IIS not working [closed]
Entender o que auditar em uma rede pode ser caótico e confuso. Construir uma lista de verificação de segurança de rede completa é crucial para organizações com computadores conectados à Internet ou entre si. Pense nisso como uma varredura antivírus …
T… Continue reading Construindo uma lista completa de verificação de segurança de rede
I am trying to find the configuration settings for this hardening on Windows 2019:
Block IIS sites configuration change from the IIS GUI, even for administrators.
The sites web.config change should be possible using a text editor.
I hav… Continue reading Block IIS GUI sites configuration change for hardening
We have a web application on https port with server certificate valid from 01/01/2021 and valid to 31/12/2021. Due to some constraints the clients which are going to use web application are behind current date, while the server is on curre… Continue reading Skip date check in Server certificate in Chrome
I was testing an HTTP Request Smuggling, front-end server is HTTPAPI while backend is IIS, I noticed a weird thing during my test, if inside burp I send two GET Requests together I get two response together,
POST /Track HTTP/1.1
Host: x.x…. Continue reading HTTP Request Smuggling weird behaviour
So, my website was recently hacked. And going through the logs, I had some questions on them.
The day I was hacked, my logs were like this(IIS server):
2020-05-02 18:35:19 [server-IP] GET /default2.php -80 [attacker-IP] [User-Agent] 404 0 … Continue reading Website got hacked – help on explaining where did the leak come from
There is PHP website and IIS web server. The website has unrestricted file upload vulnerability. When I upload a reverse shell to connect back to netcat listener or meterpreter it connects with username iis_met, but when I upload a PHP she… Continue reading IIS Different user with reverse shell