scanning IIS/6.0 web servers

shan75 · Post by **shan75** » 15 Apr 2010, 13:48

now i am trying to penetration on Microsoft-IIS/6.0 server with IIS 6.0 WebDav Remote Auth Bypass exploit. but when i am scanning with nmap to see Webdav is enable or not then i have got this error

nmap -n -PN -p80 --script=http-iis-webdav-vuln xxxx.com

Starting Nmap 5.21 ( http://nmap.org ) at 2010-04-16 00:52 India Standard Time
NSE: Script Scanning completed.
Nmap scan report for xxxx.com (xxx.xxx.xxx.xxx)
Host is up (0.34s latency).
PORT STATE SERVICE
80/tcp open http
|_http-iis-webdav-vuln: ERROR: This web server is not supported.

Nmap done: 1 IP address (1 host up) scanned in 24.28 seconds

i know its running Microsoft-IIS/6.0. i don't know what is the problem.

please solve this

Post by **ayu** » 15 Apr 2010, 14:45

Wrong section, moved

shan75 · Post by **shan75** » 15 Apr 2010, 14:48

why? whats wrong?

Post by **ayu** » 15 Apr 2010, 14:52

shan75 wrote:why? whats wrong?

You posted in the tutorial section ^^

It clearly says

DON'T post new tutorials here! Please use the "Pending Submissions" board so the staff can review them first.

Post by **bad_brain** » 16 Apr 2010, 05:01

add the -d switch to your scan to get the debug output....best save the output to a file. then search the file for "propfind /" and check what reply the server gives to that request, nmap expects a 501 or a 207, if something else is replied nmap labels the server as "not supported"....little bug I guess.

but to give more detailed help you will have to post the output for the request...

shan75 · Post by **shan75** » 16 Apr 2010, 06:44

@bad_brain

NSE: NSE Script Threads (3) running:
NSE: Starting http-iis-webdav-vuln against xxx.xxx.xxx.xxx:80.
NSE: Starting skypev2-version against xxx.xxx.xxx.xxx:443.
NSE: Starting http-iis-webdav-vuln against xxx.xxx.xxx.xxx:443.
NSE: Finished skypev2-version against xxx.xxx.xxx.xxx:443.
NSE: http-iis-webdav-vuln: Root folder is not password protected, continuing...
NSE: http-iis-webdav-vuln: PROPFIND request failed.
NSE: Finished http-iis-webdav-vuln against xxx.xxx.xxx.xxx:443.
NSE: http-iis-webdav-vuln: Root folder is not password protected, continuing...
NSE: http-iis-webdav-vuln: PROPFIND request failed.
NSE: Finished http-iis-webdav-vuln against xxx.xxx.xxx.xxx:80.
Completed NSE at 18:10, 19.06s elapsed
NSE: Script Scanning completed.

Post by **bad_brain** » 17 Apr 2010, 15:10

darn...I actually expected it will also show the reply of the scanned server...

try to use domain.com/ instead of domain.com, if this still not works you will have to capture the traffic of the scan with wireshark so we can see what the server actually responds...