> For the complete documentation index, see [llms.txt](https://insecurecodes.gitbook.io/redbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://insecurecodes.gitbook.io/redbook/stages-of-ethical-hacking/enumeration/http/iis.md).

# IIS

Internet Information Services (IIS) for Windows® Server is a flexible, secure and manageable Web server for hosting anything on the Web.

## Enum

```bash
nmap $IP -sV -O

whatweb $IP

http $IP

dirb http://$IP

browsh --startup-url http://$IP.Default.aspx
```

### Nmap scripts

```bash
# Interesting folders
nmap $IP -sV -p 80 --script http-enum

# Verify if XSS is off
nmap $IP -sV -p 80 --script http-headers

# Replace $PATH with any folder, i.e. /webdav/
nmap $IP -sV -p 80 --script http-methods --script-args http-methods.url-path=/$PATH/

# webdav
nmap $IP -sV -p 80 --script http-webdav-scan --script-args http-methods.url-path=/webdav/
```

> **WebDAV** (**Web Distributed Authoring and Versioning**) is a set of extensions to the [Hypertext Transfer Protocol](https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol) (HTTP), which allows [user agents](https://en.wikipedia.org/wiki/User_agent) to collaboratively author contents *directly* in an [HTTP web server](https://en.wikipedia.org/wiki/Web_server) by providing facilities for [concurrency control](https://en.wikipedia.org/wiki/Concurrency_control) and [namespace operations](https://en.wikipedia.org/wiki/Namespace), thus allowing [Web](https://en.wikipedia.org/wiki/World_Wide_Web) to be viewed as a *writeable, collaborative medium* and not just a read-only medium