Skip to main content

Web Hacking

Web hacking encompasses the identification and exploitation of vulnerabilities in web applications and services. This domain covers attack vectors including injection attacks, cross-site vulnerabilities, authentication bypasses, cryptographic failures, insecure deserialization, and framework-specific exploitations used in penetration testing and security research.

📄️ IIS Tilde Enumeration

IIS Tilde Enumeration (also known as IIS Short Name Disclosure or 8.3 Name Disclosure) is a vulnerability in Microsoft Internet Information Services (IIS) where attackers can enumerate files and directories using their short (8.3) names. Windows supports legacy 8.3 filenames (e.g., longfilename.txt → LONGFI~1.TXT), and IIS may expose these names due to improper handling of tilde (~) characters in URL requests. This allows attackers to infer the presence of files and folders, even if directory listing is disabled. By sending crafted HTTP requests with ~1, ~2, etc., attackers can systematically determine file and folder names, leading to potential information disclosure and aiding further exploitation. This issue affects IIS versions up to IIS 8.5 unless mitigated by disabling 8.3 filename support or applying security patches.