Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 453Additional ConsiderationsAdditionally, you can configure IIS W3C Extended Log File Format Auditing. SelectW3C Extended Log File Format on the Web Site tab of the Web site’s propertiesdialog box. You can then choose Extended Properties such as URI Stem and URIQuery.Step 11. Sites and Virtual DirectoriesRelocate Web roots and virtual directories to a non-system partition to protect againstdirectory traversal attacks. These attacks allow an attacker to execute operatingsystem programs and utilities. It is not possible to traverse across drives. Forexample, this approach ensures that any future canonicalization worm that allows anattacker to access system files will fail. For example, if the attacker formulates a URLthat contains the following path, the request fails:/scripts/..%5c../winnt/system32/cmd.exeDuring this step, you:● Move your Web site to a non-system volume.●●●●●Disable the parent paths setting.Remove potentially dangerous virtual directories.Remove or secure RDS.Set Web permissions.Remove or secure FrontPage Server Extensions.Move Your Web site to a Non-System VolumeDo not use the default \inetpub\wwwroot directory. For example, if your system isinstalled on the C: drive, then move your site and content directory to the D: drive.This mitigates the risks associated with unforeseen canonicalization issues anddirectory traversal attacks.Disable the Parent Paths SettingThis IIS metabase setting prevents the use of “..” in script and application calls tofunctions such as MapPath. This helps guard against directory traversal attacks.