Securing the Server
Extension Scanning tips
- Deny executables that could run on the server
- .exe (Exe executable file)
- .bat (Executable batch file)
- .cmd (Windows NT Command Script)
- .com (MS-DOS Application)
- Deny infrequently used scripts
- .htw (Maps to webhits.dll, part of Index Server)
- .ida (Maps to idq.dll, part of Index Server)
- .idq (Maps to idq.dll, part of Index Server)
- .htr (Maps to ism.dll, a legacy administrative tool)
- .idc (Maps to httpodbc.dll, a legacy database access tool)
- .shtm (Maps to ssinc.dll, for Server Side Includes)
- .html (Maps to ssinc.dll, for Server Side Includes)
- .stm (Maps to ssinc.dll, for Server Side Includes)
- .printer (Maps to msw3prt.dll, for Internet Printing Services)
- Various static files
- .ini (Don't allow access to Configuration files)
- .log (Don't allow access to Log files)
- .pol (Don't allow access to Policy files)
- .dat (Don't allow access to Configuration files)
URL Scanning Tips
- URL Scanning
- .. (Don't allow directory traversals)
- /. (Don't allow trailing dot after a directory name)
- ./ (Don't allow trailing dot on a directory name)
- \ (Don't allow backslashes in URL)
- : (Don't allow alternate stream access)
- %% (Don't allow escaping after normalization)
- & (Don't allow multiple CGI processes to run on a single request)