iis security: How do you set the header and banner information returned by IIS 6's
services (FTP,
HTTP, SMTP, etc.) ???

I ran an external Security Audit scanner and it was able to tell in internal
host name and IP address as well as more.

TIA

See http://securityadmin.info/faq.asp#banner

I'm not sure this information on how to change banners all still applies to
IIS 6, but the link shows you how many different ways a hacker can tell what
software you're running. For example, if you have any .ASP on your server,
you're pretty much advertising that you're running IIS. And a large
percentage of attacks nowadays don't bother to check what version of
software you're running before attacking, they just attack.

Have you tried searching Google or Google Groups?

http://groups.google.com/groups?q=iis-6+banner
http://www.google.com/search?q=site%3Amicrosoft.com+iis-6+banner
http://www.google.com/search?q=site%3Amicrosoft.com+iis+banner
http://www.google.com/search?q=iis-6+banner
http://www.google.com/search?q=site%3Amicrosoft.com+iis+banner

[quoted text, click to view]

Hallo Ken,

[quoted text, click to view]

You can determine the internal IP address from the Content-Location
header:

http://support.microsoft.com/?id=218180

AFAIK the resolution given in this article doesn't work for IIS6
anymore. That's why I wrote a simple ISAPI Filter removing this header:

http://nogetec.de/files/contentlocation.zip

--
Regards, Olaf

You will need to tell us:
a) what security audit you ran
b) brief details of your internal configuration
c) how the tool determined your configuration from the information you're
giving out.

Something like the HTTP Server: header only contains

Server: Microsoft-IIS/6.0

That's it. From that information alone, it is impossible to determine
internal IP addresses, or hostnames

Cheers
Ken


[quoted text, click to view]
: How do you set the header and banner information returned by IIS 6's
: services (FTP,
: HTTP, SMTP, etc.) ???
:
: I ran an external Security Audit scanner and it was able to tell in
internal
: host name and IP address as well as more.
:
: TIA
:
:

I used Qualys (www.Qualys.com) to do a vulnerability check. This check will
check for all known vulnerabilities. It was able to tell the real server
name and internal IP address from the banner information that it was given.


[quoted text, click to view]

Here is the some of the info obtained by Qualys.com

1 Microsoft IIS Internal IP Address/Internal Network Name
Disclosure Vulnerability port 80/tcp

QID:86192 Category:Web server CVE ID:CAN-2000-0649
First Detected:05/03/2004 at 10:10:48 Last Detected:05/03/2004 at 10:10:48
Times Detected:1
DESCRIPTION:
Microsoft IIS contains a vulnerability that may disclose your internal IP
address or internal network name to remote attackers.
CONSEQUENCES:
Successful exploitation of this vulnerability could assist in further
attacks against the target host.
SOLUTION:
For more information about this vulnerability, and for a resolution offered
by Microsoft in the case when an internal IP address in its decimal-dot
notation is disclosed by IIS 5.0 and prior versions, read Microsoft Article
ID Q218180 - Internet Information Server Returns IP Address in HTTP Header
(Content-Location) and also
http://support.microsoft.com/support/kb/articles/Q218/1/80.ASP.
If an internal network name is disclosed, or if you are running IIS 6.0 or
6.1, please contact Microsoft to find out if there is a patch for this
issue.

RESULT:
192.168.1.16

Guess I'll probably have to wait till Microsoft realeases a patch for IIS 6.


[quoted text, click to view]


begin 666 tree_open.gif
M1TE&.#EA"@`*`( ``````/___R'Y! $*``$`+ `````*``H```(/C(^I:^ /
+`XQM)GH!VZL``#L`
`
end

begin 666 vuln_level1.gif
M1TE&.#EA. `.`)$``/___Z^OK^T<)-O:VB'Y! ``````+ `````X``X```)9
MC(^IR^TFHIP#V(LKWGK?[@'01(*>R86?:HVDA&8L$*^L^PJUM=-SCWOUAK]9
ML%1D$6^!'"RI6JJ.%&A(&J(^E=:3L>G4=5-<9EA<CHXQV@C6F\X^YO2ZH@``
!.P``
`
end

[quoted text, click to view]
: Hallo Ken,
:
[quoted text, click to view]
:
: > Something like the HTTP Server: header only contains
: >
: > Server: Microsoft-IIS/6.0
: >
: > That's it. From that information alone, it is impossible to determine
: > internal IP addresses, or hostnames
:
: You can determine the internal IP address from the Content-Location
: header:
:
: http://support.microsoft.com/?id=218180
:
: AFAIK the resolution given in this article doesn't work for IIS6
: anymore. That's why I wrote a simple ISAPI Filter removing this header:
:
: http://nogetec.de/files/contentlocation.zip
:

Definately. You may also be able to get more information by looking at the
SMTP headers that the MS SMTP server will create when sending out email. So,
in order to combat this we need to know more about what the OP actually
tested (he mentioned WWW, FTP and SMTP in the original message).

Cheers
Ken

Hallo _M_,

[quoted text, click to view]

Or, as a workaround, you could try to install the filter I mentioned
above.

--
Regards, Olaf

I just blog this :)
http://msmvps.com/bernard/posts/6227.aspx

and regarding the 218180 in IIS 6.0, you can put in a host header, I will
hide the IP (I think)
--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/



[quoted text, click to view]