{"id":4981,"date":"2024-01-08T15:51:13","date_gmt":"2024-01-08T23:51:13","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=4981"},"modified":"2024-01-08T15:51:16","modified_gmt":"2024-01-08T23:51:16","slug":"how-to-fix-iis-default-index-page-vulnerabilities","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=4981","title":{"rendered":"How to Fix IIS Default Index Page Vulnerabilities"},"content":{"rendered":"\n<p>TIPS: Scroll down this post and try soltuion#2 would be a easy and fast way to fix this.<\/p>\n\n\n\n<p><strong>Solution #1<\/strong><\/p>\n\n\n\n<p>Penetration tools may alert if IIS server is accepting requests with&nbsp;<strong>HTTP OPTIONS<\/strong>&nbsp;method. This is because the response to these requests may reveal what other methods are supported by the web server.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><strong>Warning:<\/strong>&nbsp;Disabling OPTIONS may have unintended consequences like CORS preflight requests to break. Please test the applications thoroughly after making the change below.<\/p><\/blockquote>\n\n\n\n<p>Follow the steps below to disable OPTIONS method.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Open IIS Manager<\/li><li>Click the server name<\/li><li>Double click on Request Filtering<\/li><li>Go to HTTP Verbs tab<\/li><li>On the right side, click Deny Verb<\/li><li>Type OPTIONS. Click OK<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/techcommunity.microsoft.com\/t5\/image\/serverpage\/image-id\/203405i370B44AD1FC545DF\/image-size\/medium?v=v2&amp;px=400\" alt=\"thumbnail image 1 of blog post titled \n\t\n\t\n\t \n\t\n\t\n\t\n\t\t\t\t\n\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\tHTTP OPTIONS and Default page vulnerabilities\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\n\t\t\t\n\t\t\n\t\n\t\t\t\n\t\n\t\n\t\n\t\n\t\n\"\/><\/figure>\n\n\n\n<p>Penetration tools may also raise an alarm if the default IIS page is still available in your server. This page comes by default when you install Web Server role.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><strong>Warning:<\/strong>&nbsp;Disabling the default page of a web application may cause unwanted results. Please make sure to test the application thoroughly after following the steps below.<\/p><\/blockquote>\n\n\n\n<p>Follow the steps below to disable it so this vulnerability don\u2019t come up in the reports anymore.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Open IIS Manager<\/li><li>Click the server name<\/li><li>Double click on Default Document<\/li><li>On the right side, click \u201cDisable\u201d<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/techcommunity.microsoft.com\/t5\/image\/serverpage\/image-id\/203406i727342CCB170D0B2\/image-size\/medium?v=v2&amp;px=400\" alt=\"thumbnail image 2 of blog post titled \n\t\n\t\n\t \n\t\n\t\n\t\n\t\t\t\t\n\t\t\n\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\tHTTP OPTIONS and Default page vulnerabilities\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\n\t\t\t\n\t\t\n\t\n\t\t\t\n\t\n\t\n\t\n\t\n\t\n\"\/><\/figure>\n\n\n\n<p><strong>Solution #2<\/strong><\/p>\n\n\n\n<p>\u00a0Just delete the iisstart.* pages at c:\\inetpub\\wwwroot and it should solve the problem.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>TIPS: Scroll down this post and try soltuion#2 would be a easy and fast way to fix this. Solution #1 Penetration tools may alert if IIS server is accepting requests with&nbsp;HTTP OPTIONS&nbsp;method. This is because the response to these requests may reveal what other methods are supported by the web server. Warning:&nbsp;Disabling OPTIONS may have <a class=\"read-more\" href=\"https:\/\/SUMMALAI.COM\/?p=4981\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[10,14,15],"tags":[1735,1736,1737],"class_list":["post-4981","post","type-post","status-publish","format-standard","hentry","category-microsoft","category-windows-7-8-10","category-windows-servers","tag-iis-default-index-page-vulnerabilities","tag-iis-default-index-page-vulnerability","tag-iis-http-options-vulnerability"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4981"}],"version-history":[{"count":1,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4981\/revisions"}],"predecessor-version":[{"id":4982,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/4981\/revisions\/4982"}],"wp:attachment":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4981"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4981"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}