Published: 13/07/2000 Updated: 23/11/2020

CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9

VMScore: 307

Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N

Subscribe to Internet Information Services

IIS 4.0 allows remote malicious users to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft internet information services 2.0
microsoft internet information server 3.0
microsoft internet information server 4.0
microsoft internet information services 5.0

source: wwwsecurityfocuscom/bid/1499/info When a remote user attempts to access an area protected by basic authentication with no realm defined, while specifying HTTP 10, Microsoft IIS will return an Access Denied error message containing the internal IP address of the host Even if IIS is behind a firewall or NAT, it will disclose the t ...

Collect any leaked internal IPs by requesting commonly redirected locations from IIS CVE-2000-0649 references IIS 51 (win2k, XP) and older However, in newer servers such as IIS 7+, this occurs when the alternateHostName is not set or misconfigured Also collects internal IPs leaked from the PROPFIND method in certa ...

Collect any leaked internal IPs by requesting commonly redirected locations from IIS. CVE-2000-0649 references IIS 5.1 (win2k, XP) and older. However, in newer servers such as IIS 7+, this occurs when the alternateHostName is not set or misconfigured. Also collects internal IPs leaked from the PROPFIND method in certain IIS versions.

msf > use auxiliary/scanner/http/iis_internal_ip
msf auxiliary(iis_internal_ip) > show actions
    ...actions...
msf auxiliary(iis_internal_ip) > set ACTION < action-name >
msf auxiliary(iis_internal_ip) > show options
    ...show and set options...
msf auxiliary(iis_internal_ip) > run

Test for CVE-2000-0649, and return an IP address if vulnerable

CVE-2000-0649 CVE-2000-0649 is a low risk vulnerability that can potentially disclose the internal IP addresses of the server Official details are here: Rapid7 CVE NIST This particular vulnerability became of interest to me because it seems to affect current NGINX and some Apache setups as well This tool tests for the vulnerability on a given IP or domain, and is deliberate

Windows IIS admin

win-iisadmin Windows IIS admin For extensive reading see the SSL Labs document page [IIS BASIC HARDENING CHECKLIST] Apply common CVE registry changes 🚧👷‍♂️🚧 Ensure web content is on non-system partition Ensure ‘host headers’ are on all sites 🎉 Ensure ‘directory browsing’ is set to disabled Ensure ‘application p

You WHAT???

HackGPTV2 You WHAT??? (kali㉿kali) ┌──(kali㉿kali)-[~/Desktop] └─$ python3 mainpy Enter your prompt: You are in a Kali Linux Environment With the command line you have access to numerous tools that are used for penetration testing I want you to use these commands to do a full penetration test on this practice target that has an IP of 192168119103 - use the com

Script fo testing CVE-2000-0649 for Apache and MS IIS servers

CVE-2000-0649 for Apache CVE-2000-0649 is a low risk vulnerability that can potentially disclose the internal IP addresses of the server from the Location parameter in the respose header Official details are here: Rapid7: wwwrapid7com/db/modules/auxiliary/scanner/http/iis_internal_ip/ CVE: wwwcvedetailscom/cve/CVE-2000-0649/ NIST: nvdnistgov/vuln

Test for CVE-2000-0649, and return an IP address if vulnerable

CVE-2000-0649 CVE-2000-0649 is a low risk vulnerability that can potentially disclose the internal IP addresses of the server Official details are here: Rapid7 CVE NIST This particular vulnerability became of interest to me because it seems to affect current NGINX and some Apache setups as well This tool tests for the vulnerability on a given IP or domain, and is deliberate

As a LOTR fan I decided to start my CTF documentations by documenting the process of hacking this VulnHub Machine called Lord Of The Root.

CTF #2 - Lord Of The Root As a LOTR fan I decided to start my CTF documentations by documenting the process of hacking this VulnHub Machine called Lord Of The Root But first, let's have a look to my setup: My Setup A VirtualBox VM running Kali Linux Another VM running LOTRoot You can download the OVA file here A local network for both machines If you want to know ho

As a LOTR fan I decided to start my CTF documentations by documenting the process of hacking this VulnHub Machine called Lord Of The Root.

CTF #2 - Lord Of The Root As a LOTR fan I decided to start my CTF documentations by documenting the process of hacking this VulnHub Machine called Lord Of The Root But first, let's have a look to my setup: My Setup A VirtualBox VM running Kali Linux Another VM running LOTRoot You can download the OVA file here A local network for both machines If you want to know ho

CWE-200 http://www.securityfocus.com/bid/1499 http://archives.neohapsis.com/archives/ntbugtraq/2000-q3/0025.html https://nvd.nist.gov https://www.exploit-db.com/exploits/20096/https://github.com/rafaelh/CVE-2000-0643

CVE-2000-0649

Vulnerability Summary

Exploits

Metasploit Modules

Github Repositories

References

Vulmon Search

About

Products

Connect