The Vulnerability A while ago I found a bunch of web servers that had the Microsoft IIS Tilde Enumeration vulnerability on them. You can read more about the vuln http://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf or http://www.acunetix.com/blog/web-security-zone/windows-short-8-3-filenames-web-security-problem/. Essentially, you can brute force file names that are on IIS web servers and possibly retrieve them using the ye olde style Windows 8.3 naming... Continue Reading →