Exploit the possiblities

Microsoft IIS UrlScan Module Bypass

Microsoft IIS UrlScan Module Bypass
Posted Oct 3, 2017
Authored by Steve Kaun

The Microsoft IIS UrlScan module suffers from a bypass vulnerability.

tags | exploit, bypass
MD5 | 9508fb9d121697442b8bd2d57e43604e

Microsoft IIS UrlScan Module Bypass

Change Mirror Download
#Paper Title: Microsoft IIS UrlScan Module Bypass
#Date: 16 AUG 2017
#Software Link: https://www.iis.net/downloads/microsoft/urlscan
#Author: Steven Kaun (Gh0st)
#Contact: https://twitter.com/AngryMilks
#Website: https://gh0sthacks.blogspot.com/
#Category: WAF Bypass

dmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmh
````dmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmh`````
shhhhmmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmdhhhhh
hmmmmmmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmmmmmmm
hmmmmmmmmd mmmmmmmmmm` hmmmmmmmmh `mmmmmmmmmm
hmmmm` `mmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmd .mmmmm
hmmmmmmmmmmmmmmmmmmm .mmmmmmmmmmmmmmmmmmmm .mmmmmmmmmmmmmmmmmmmm
yddddmmmmmmmmmmddddd `dddddmmmmmmmmmmddddd `dddddmmmmmmmmmmddddd
`....dmmmmmmmmm-.... .....dmmmmmmmmm-.... .....dmmmmmmmmh.....
dmmmmmmmmm. dmmmmmmmmm. dmmmmmmmmh
+ooooooooo` +ooooooooo` +oooooooo/


Identified after coming up with null for help with bypassing a WAF identified as UrlScan. After identifying that a web application was filtering and essentially dropping most attacks and their associated payloads a delve into how to bypass this was constructed. This is as simple as bypasses can possibly get, but at the same time is unique enough to warrant writing about.


We all understand that WAFs are in place to identify and block malicious requests before the reach the application, so in effect I need to figure out exactly what makes it tick or how to make it tick for us. To that regard the development of this came after exhaustive research into UrlScan and trying to see if anyone had run across this in the professional or unethical realm. Well, guess you can figure out how well that went.

Anyways... I've identified the IIS module "UrlScan 3.1" running on a IIS6 machine (Note this can be IIS 7.5, 6, 5, etc.), I've identified that the application is filtering certain characters, but I'm stuck because whatever malicious requests I send get dropped or filtered by UrlScan anyways.


So after perusing developer forums, Microsoft technical documentation, and various SQLmap documentation and tamper methods I had learned that appending %00 (Null-Byte) can be performed by the tamper script "appendnullbyte". This however refused to work, and the UrlScan module picked it up right away. So what was I supposed to do? Well apparently UrlScan doesn't know how to handle or what to do when the prefix is the nullbyte, and as far as I'm aware there are no SQLmap tamper scripts that would perform this bypass.

So after formatting the sqlmap command with the real value of a parameter I know that this page exists and has dynamic content depending on the "users" integer value

Original Unmodified

I quickly learn that the appendnullbyte tamper script only modifys the payload like this (note this is just generic payload)

http://somesite.com/blog?users=3389' WAITFOR DELAY '0:0:10'--%00

So after analyzing the responses from the application it seemed like it wouldn't take it at all... However, not all is lost and after performing more research into the matter the solution became apparent after some random dev was complaining about UrlScan filter rule of %00 basically crashing their application. So what I can extrapolate from that is that %00 is a null value (obvious), but more so than that I can deduce that %00 is not only not interpreted by UrlScan, but its completely overlooked because of the null value where it expects something.

Imagine if you will, you are an application looking for a value of anything greater than 0, but then you encounter 0. Would you simply stop interpreting it because to you there is nothing there? Well if you said yes, your in the same boat as UrlScan's logic apparently.

The Attack

So I've come to the conclusion that UrlScan expects some value to interpret or inspect whether it be in the Url, Url parameter, or POST body. I've also come to understand that if the value is null UrlScan simply ignores it on the basis that there is nothing to inspect, thus giving us the path towards carnage.

So here I am, at the end of the road... Will it work or not?

http://somesite.com/blog?users=3389%00' WAITFOR DELAY '0:0:10'--

IT WORKS! This little null value gave me the ability to perform SQL injection where SQL had failed time and time before.

This also allowed XSS to any arbitrary parameter I wanted...



In the end I've learned the following...

1. UrlScan's logic is flawed in the manner of interpreting null values - Expects 1, but gets 0 and does not continue inspection
2. %00 allows us to bypass UrlScan's logic to perform XSS and SQL injection where it would normally fail
3. %00 filtering within UrlScan breaks applications for whatever reason
4. SQLmap does not have a tamper script with which to bypass UrlScan, only has the ability to append %00 to end of payload where instead requires it be prepended to the payload


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?

Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

March 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    14 Files
  • 2
    Mar 2nd
    12 Files
  • 3
    Mar 3rd
    1 Files
  • 4
    Mar 4th
    3 Files
  • 5
    Mar 5th
    15 Files
  • 6
    Mar 6th
    23 Files
  • 7
    Mar 7th
    15 Files
  • 8
    Mar 8th
    15 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    2 Files
  • 11
    Mar 11th
    1 Files
  • 12
    Mar 12th
    16 Files
  • 13
    Mar 13th
    20 Files
  • 14
    Mar 14th
    12 Files
  • 15
    Mar 15th
    10 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By