Hack Websites using IIS (Internet Information Services) Exploit.

NOTE : This Post is only for Educational Purposes.This is to make Site Owners aware of the consequences of leaving their sites vulnerable to the IIS exploit and to teach them How to Fix it.

Hello Friends,
                     Today I'll tell you about How to Hack Websites Using IIS (Internet Information Services) Exploit.So,First I'll like to explain to you all that "What is IIS?" ; "What is IIS Exploit?" ; "What can you do with IIS Exploit?" ; "What Countermeasures you should take?" and much more.
So lets get started.

What is IIS?
Internet Information Services (IIS) – formerly called Internet Information Server – is a web server application and set of feature extension modules created by Microsoft for use with Microsoft Windows.

What is IIS Exploit?
IIS Exploit simply means remote system exploit.Through this exploit,we can connect to a site's database which is hosted on a Microsoft IIS Server without the need of any kind of authorization.IIS Exploit  is said to be the most easiest and quickest method of hacking a site.

What can you do with IIS Exploit?
We can insert a Deface Page so that every person visiting that site comes to know that you've hacked this site.If you want to get the site's files,then you can insert your Shell into the site and get the files.Even edit or delete any file from the server.Create a Mass Deface.

What Countermeasures you should take?
Before carrying out this operation,be sure that you have a VPN or a Proxy and that it is turned "ON" so that while uploading your shell or deface page,you cannot be tracked by anyone.After your work is finished,be sure to "DELETE" your shell (In case if you've uploaded any).The most important safety measure is- "Never tell anyone that you are doing any kind of hacking or tell him what site you are hacking"

What things are needed for carrying out IIS Exploit?
You need the following things for hacking a Website through IIS Exploit-

1. Website hosted on "Microsoft IIS Server".2. Computer running "Microsoft Windows 7".3. Shell (ASP).4. Deface Page.5. VPN or Proxy.
So,Lets get started.
STEP 01 :-Find the Target Website which you are going to hack(The site must be hosted on a Microsoft IIS Server). 

STEP 02 :-Make sure that your VPN or Proxy is connected and you can surf the Web anonymously.You can find a List of VPNs and Proxies Here.

STEP 03 :-
Open My Computer and right click to see the context menu,Select the 8th Option which is "Add a Network Location".

Click the Photo to Enlarge.

STEP 04 :-
"Add a Network Location Wizard" will open,Click next.

Click Photo to Enlarge.

STEP 05 :-

Next dialogue box will ask you where do you want to create this network location.Click Next. 

Click Photo to Enlarge.

STEP 06 :-

Now,It'll ask you to enter your site's name,Enter the site name and Click Next.

Click the Photo to Enlarge.

STEP 07 :-Now,It'll ask you what do you want to name this location,For better remembering,I suggest let it be the default which Windows suggests.Click Next.

Click the Photo to Enlarge.

STEP 08 :-

Now,it'll display that you've successfully created the network location.Put a Check Mark on the option which says "Open this Network Location when I click FINISH."Now click Finish.

Click the Photo to Enlarge.

STEP 09 :-

Now,Your Network Location's window will open.Just Copy and Paste your Shell (ASP) or deface page to the window.You can download ASP Shell Here.

Click Photo to Enlarge.

STEP 10 :-
Now,to access your shell or to see your Deface Page,just open your browser and type the site name and your shell name of deface page name like this-

Shell-

http://www.site.com/shell.asp;.jpg
(Where Site.com is your site and Shell.asp; is the name of your shell)

Deface Page-
http://www.site.com/deface-page.html
(Where Site.com is your site and Deface-page.html is the name of your deface page)

And then you can see your deface page or shell.

How to Fix this Vulnerability in your site?
This exploit only affects Microsoft IIS Versions of 5.0 (Windows 2000),5.1 (Windows XP) and 6.0 (Windows Server 2003).The Versions 7.0 or later which come with Windows Vista/Server 2008/7 are not vulnerable.So,to fix this vulnerability,just upgrade your Microsoft IIS Version from any older to 7.0 or higher.

Once Again,I am reminding to you all that this tutorial is only to make site owners aware of the consequences of leaving their site vulnerable to the Microsoft IIS Exploit.This is not intended for teaching hackers.

-KANISHK SINGH