Improving Web Application Security: Threats and - CGISecurity

796 Improving Web Application Security: Threats and Countermeasures●●It removes the following virtual directories:●●●●●IIS SamplesMSADCIISHelpScriptsIISAdminIt restricts anonymous access to system utilities as well as the ability to write toWeb content directories. To do this, IISLockdown creates two new local groupscalled Web Anonymous Users and Web Applications and then it adds denyaccess control entries (ACEs) for these groups to the access control list (ACL) onkey utilities and directories.Next, IISLockdown adds the default anonymous Internet user account(IUSR_MACHINE) to Web Anonymous Users and the IWAM_MACHINEaccount to Web Applications.Note If you create custom, anonymous Internet user accounts, add them to theWeb Anonymous Users group.●●It disables Web Distributed Authoring and Versioning (WebDAV).It installs the URLScan ISAPI filter.Installing IISLockdownTo install IISlockdown, download it from the Microsoft Web site athttp://download.microsoft.com/download/iis50/Utility/2.1/NT45XP/EN-US/iislockd.exe.You can save it locally or run it directly by clicking Open when you are prompted. Ifyou save IISLockd.exe, you can unpack helpful files by running the followingcommand:iislockd.exe /q /cThis command unpacks the following files:● IISLockd.chm. This is the compiled help file for the IISLockdown tool.●●RunLockdUnattended.doc. This file includes instructions for unattendedIISLockdown execution.URLScan.exe and associated files. These files install URLScan without runningIISLockdown.exe.