Successful IIS Shortname Fuzzing Scan

Title: Successful IIS Shortname Fuzzing Scan
Status: test
Description:When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"
References:
  -https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml
  -https://www.exploit-db.com/exploits/19525
  -https://github.com/lijiejie/IIS_shortname_Scanner
Author: frack113
Date: 2021-10-06
modified:2023-01-02
Tags:

• -'attack.initial-access'
• -'attack.t1190'

Logsource:

• category: webserver

Detection:
  selection:
    cs-uri-query|contains: '~1'
    cs-uri-query|endswith: 'a.aspx'
    cs-method:
      -'GET'
      -'OPTIONS'

    sc-status:
      -'200'
      -'301'

  condition:selection
Falsepositives:
  -Unknown
Level: medium