Insufficient Hardening – Default IIS Webpage In Use
TCM-KB-EXT-002
Last Updated: 6/26/2023
Microsoft Windows Server
The recommended remediation steps and configurations described in this response would primarily affect systems running Microsoft Windows Server.
IIS
IIS refers to Internet Information Services.
IIS is a web server service created by Microsoft. It’s used to host websites, web applications, and services on the Windows platform. You can find this service on Microsoft Windows Server machines.
Contributor
Joe Helle
Chief Hacking Officer
Recent Blogs
Top 5 Tools for Active Directory Penetration Testing
Are you on the road to becoming a penetration tester? Understanding Active Directory and how it is vulnerable to attackers is a crucial skill when it comes to infiltrating corporate networks. In this article, we look at some of our favorite tools for Active Directory...
How To Pass The PHDA Exam
The creator of the Practical Help Deck Associate certification gives helpful tips for taking this unique, beginner friendly assessment of entry-level IT skills.
Professional Pentester Toolbox: TCM Security Picks
We asked the TCM Security team to share the pentest tools they rely on regularly for testing internal, external, web application, and physical environments.
Issue
The server presents users with a default IIS webpage. This typically occurs when server administrators serve a website on 443 without a port 80 to 443 redirect, or stand up a web server using default settings, and forget to disable the unused port(s). Unused ports serve the IIS default page by default.
Recommended Remediation
The following outlines the recommended steps that the systems and network administrators should take in order to secure the environment.
Logging into the device with administrative privileges, access the Internet Information Services (IIS) Manager.
In the IIS management window, you may see one or more Connections listed on the left side of the page. Clicking the down arrow on the left side of the listing(s), select Sites.
In the center of the page, a listing of sites is presented. Right click the site to modify, and select Bindings.
In the Site Bindings window, click the host to disable, and select Remove. Click Yes when asked if you wish to remove the binding(s). Click Close.
One complete attempt to revisit the site in a browser to confirm its removal.
See What We Can Do For You
Download a sample penetration test report to see the results we can deliver for your organization.
See How We Can Secure Your Assets
Let’s talk about how TCM Security can solve your cybersecurity needs. Give us a call, send us an e-mail, or fill out the contact form below to get started.