Improving Web Application Security: Threats and - CGISecurity

How To: Secure Your Developer Workstation 7712. During setup, choose the Dynamic Web Site option, and choose the option toinstall URLScan. ASP.NET Web Forms use the HTTP POST verb. Choosing thestatic option and installing URLScan blocks the POST verb in URLScan.ini.The Dynamic Web Site option does the following:●Adds POST to the [AllowVerbs] section as shown below.[AllowVerbs]GETHEADPOST●●●●●●Disables the following Internet Services: Web service (HTTP), File TransferProtocol (FTP), the Simple Mail Transport Protocol (SMTP) e-mail service,and the Network News Transport Protocol (NNTP) news service.Maps the following script maps to 404.dll: Index Server, Web Interface(.idq, .htw, .ida), server side includes (.shtml, .shtm, .stm), Internet DataConnector (.idc), HTR scripting (.htr), Internet printing (.printer)Removes the following virtual directories: IIS Samples, MSADC, IISHelp,Scripts, and IISAdmin.Restricts anonymous access to system utilities and the ability to write toWeb content directories.Disables Web Distributed Authoring and Versioning (WebDAV).Installs the URLScan ISAPI filter.PitfallsIf you use IISLockdown, note the following pitfalls:● IIS metabase updates can be lost. If you undo IISLockdown changes by runningIislockd.exe a second time, you lose any changes made to the IIS metabase sincethe last time IISLockdown was run. For example, if you configure a virtualdirectory as an application root after running IIS lockdown, that change is lostwhen you run IISLockdown again.● Resources are blocked by 404.dll. If you receive a 404 error for a previouslyavailable resource, it might be because the resource type is blocked by 404.dll. Toconfirm whether or not this is the case, check the script mapping for the requestedresource type in IIS.Configure URLScanThe URLScan ISAPI filter installs when you run IISLockdown. If you do not explicitlyallow the DEBUG verb, URLScan prevents debugging. Also, URLScan blocksrequests that contain unsafe characters such as the period (.) used for directorytraversal.