Penetration Testing mailing list archives
RE: IIS 5.0 with Integrated Window Authentication
From: "Michael Howard" <mikehow () microsoft com>
Date: Wed, 6 Nov 2002 13:45:56 -0800
The easiest way, *by far*, is to write a C# app using the System.Net.WebClient class. Another tool is wfetch http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q284285& Cheers, Michael Secure Windows Initiative Writing Secure Code http://www.microsoft.com/mspress/books/5612.asp -----Original Message----- From: cc_mofo () hushmail com [mailto:cc_mofo () hushmail com] Sent: Wednesday, November 06, 2002 12:15 PM To: pen-test () securityfocus com; webappsec () securityfocus com Subject: IIS 5.0 with Integrated Window Authentication -----BEGIN PGP SIGNED MESSAGE----- I'm doing a security review and penetration test of a site running on IIS with Integrated Windows Authentication. Anyone know of an IIS Scanner that can do an IWA exchange before scanning? The SPIKE proxy looks promising, but it appears the NTLM support is not quite "there" yet for this purpose. The goofy three-message exchange that sets up the NTLM security doesn't seem to make it through the proxy, which leads me to believe that any tool that will work for this must have intentionally added support for IWA. -----BEGIN PGP SIGNATURE----- Version: Hush 2.2 (Java) Note: This signature can be verified at https://www.hushtools.com/verify wlwEARECABwFAj3JeFQVHGNjX21vZm9AaHVzaG1haWwuY29tAAoJEDsVajchvitlDKIA n1atyjW01supq8g9YhQqS3xC013lAJ9BjVmoqZOorkOOFLrjNEns9Ao4qw== =O5GH -----END PGP SIGNATURE----- Get your free encrypted email at https://www.hushmail.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
Current thread:
- IIS 5.0 with Integrated Window Authentication cc_mofo (Nov 07)
- Re: IIS 5.0 with Integrated Window Authentication Kevin Spett (Nov 07)
- Re: IIS 5.0 with Integrated Window Authentication Sebastian Flothow (Nov 08)
- Re: IIS 5.0 with Integrated Window Authentication Dave Aitel (Nov 07)
- Re: IIS 5.0 with Integrated Window Authentication sunzi (Nov 07)
- Re: IIS 5.0 with Integrated Window Authentication Haroon Meer (Nov 08)
- RE: IIS 5.0 with Integrated Window Authentication Jason Coombs (Nov 08)
- Re: IIS 5.0 with Integrated Window Authentication Dave Aitel (Nov 07)
- Re: [Spike] Re: IIS 5.0 with Integrated Window Authentication Dave Aitel (Nov 07)
- RE: IIS 5.0 with Integrated Window Authentication Jason Coombs (Nov 08)
- <Possible follow-ups>
- Re: IIS 5.0 with Integrated Window Authentication cc_mofo (Nov 09)
- RE: IIS 5.0 with Integrated Window Authentication Michael Howard (Nov 09)
- Re: IIS 5.0 with Integrated Window Authentication cc_mofo (Nov 12)