IIS 8.3 short-name enumeration (tilde)

Some versions of Microsoft IIS leak the 8.3 short names (the old MS-DOS format: eight characters, a dot, a three-character extension) that Windows generates for every file and folder. By requesting paths with the tilde (~) character followed by a sequence number, the server answers with different status codes depending on whether a short name starting with those letters exists. Chaining requests reconstructs, letter by letter, the short name of hidden files and directories, even when they are not linked anywhere, and from there we reach the real resource.

Mechanism

The base idea is to try each letter after the tilde and observe the response. A 200 OK confirms a short name starting with that sequence exists; we keep extending it until we hit the name NAME~1:

GET /~s HTTP/1.1
GET /~se HTTP/1.1
GET /~sec HTTP/1.1

Doing this by hand is tedious, so we automate it with IIS-ShortName-Scanner (Java), which also picks the HTTP method and the magic part that triggers the behaviour:

java -jar iis_shortname_scanner.jar 0 5 http://<ip>/

|_ Result: Vulnerable!
|_ Used HTTP method: OPTIONS
|_ Suffix (magic part): /~1/
  |_ Identified directories: 2
    |_ ASPNET~1
    |_ UPLOAD~1
  |_ Identified files: 3
    |_ CSASPX~1.CS
    |_ TRANSF~1.ASP

The short name only reveals the first six characters and the trimmed extension (TRANSF~1.ASP), not the full name. To recover it we build a wordlist of words starting with that prefix and brute force with gobuster, adding the real extensions:

egrep -r ^transf /usr/share/wordlists/* | sed 's/^[^:]*://' > /tmp/list.txt
gobuster dir -u http://<ip>/ -w /tmp/list.txt -x .aspx,.asp

/transfer.aspx        (Status: 200) [Size: 941]

Requirements

An affected IIS version (classically IIS 6.0 to 7.5, though it depends on the configuration and on whether the file system keeps 8.3 names). It needs no authentication: it is blind enumeration against the web server. The result is hints (prefixes + extension), not full paths, so it almost always has to be finished off with targeted content discovery.

How to detect it. It gives itself away with a burst of requests carrying ~ and a single varying letter (/~a, /~b, /~c...) and with unusual methods such as OPTIONS using /~1/.rem suffixes. IIS logs show a high volume of 404/400 with URLs containing the tilde. A WAF or a detection rule on the tilde in the path is usually enough to alert.

Defence. Disable 8.3 short-name generation (fsutil 8dot3name set 1 and regenerate), keep IIS patched, and do not rely on security through obscurity: a sensitive file is still reachable even if it is not linked. It complements web content discovery and vhost fuzzing, and often leads to web.config abuse on IIS or to turning the version into an exploit.