Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 457During this step, you:● Map IIS file extensions.●Map .NET Framework file extensions.Map IIS File ExtensionsOn Windows 2000, the IIS file extensions of interest include: .asp, .asa, .cer, .cdx, .htr,.idc, .shtm, .shtml, .stm, and .printer.If you do not use any one of these extensions, map the extension to the 404.dll, whichis provided by IISLockdown. For example, if you do not want to serve ASP pages toclients, map .asp to the 404.dll.The mappings altered by IISLockdown depend on the server template that youchoose:● Static Web Server. If you run IISLockdown and choose the Static Web serveroption, then all of the above extensions are mapped to the 404.dll.● Dynamic Web Server. If you choose the Dynamic Web server option, which is thepreferred option when serving ASP.NET pages, then .htr, .idc, .shtm, .shtml, .stm,and .printer are mapped to the 404.dll, while .asp, .cer, .cdx, and .asa are not. Inthis case, you should manually map .cer, .cdx, and .asa to the 404.dll. If you are notserving .asp, then you can map that as well.Why Map to the 404.dll?By mapping file extensions to the 404.dll, you prevent files from being returned anddownloaded over HTTP. If you request a file with an extension mapped to the 404.dll,a Web page with the message “HTTP 404 - File not found” is displayed. You arerecommended to map unused extensions to the 404.dll rather than deleting themapping. If you delete a mapping, and a file is mistakenly left on the server (or putthere by mistake) it can be displayed in clear text when it is requested because IISdoes not know how to process it. To map a file extension to the 404.dll1. Start IIS.2. Right-click your server name in the left window, and then click Properties.3. Ensure that the WWWService is selected in the Master Properties drop-down list,and then click the adjacent Edit button.4. Click the Home Directory tab.