Twenty Year Anniversary

Microsoft IIS UrlScan Module Bypass

Microsoft IIS UrlScan Module Bypass
Posted Oct 3, 2017
Authored by Steve Kaun

The Microsoft IIS UrlScan module suffers from a bypass vulnerability.

tags | exploit, bypass
MD5 | 9508fb9d121697442b8bd2d57e43604e

Microsoft IIS UrlScan Module Bypass

Change Mirror Download
#Paper Title: Microsoft IIS UrlScan Module Bypass
#Date: 16 AUG 2017
#Software Link:
#Author: Steven Kaun (Gh0st)
#Category: WAF Bypass

dmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmh
````dmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmh`````
shhhhmmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmdhhhhh
hmmmmmmmmmmmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmmmmmmmmmmmm
hmmmmmmmmd mmmmmmmmmm` hmmmmmmmmh `mmmmmmmmmm
hmmmm` `mmmmmmmmmm dmmmmmmmmm. .mmmmmmmmmd .mmmmm
hmmmmmmmmmmmmmmmmmmm .mmmmmmmmmmmmmmmmmmmm .mmmmmmmmmmmmmmmmmmmm
yddddmmmmmmmmmmddddd `dddddmmmmmmmmmmddddd `dddddmmmmmmmmmmddddd
`....dmmmmmmmmm-.... .....dmmmmmmmmm-.... .....dmmmmmmmmh.....
dmmmmmmmmm. dmmmmmmmmm. dmmmmmmmmh
+ooooooooo` +ooooooooo` +oooooooo/


Identified after coming up with null for help with bypassing a WAF identified as UrlScan. After identifying that a web application was filtering and essentially dropping most attacks and their associated payloads a delve into how to bypass this was constructed. This is as simple as bypasses can possibly get, but at the same time is unique enough to warrant writing about.


We all understand that WAFs are in place to identify and block malicious requests before the reach the application, so in effect I need to figure out exactly what makes it tick or how to make it tick for us. To that regard the development of this came after exhaustive research into UrlScan and trying to see if anyone had run across this in the professional or unethical realm. Well, guess you can figure out how well that went.

Anyways... I've identified the IIS module "UrlScan 3.1" running on a IIS6 machine (Note this can be IIS 7.5, 6, 5, etc.), I've identified that the application is filtering certain characters, but I'm stuck because whatever malicious requests I send get dropped or filtered by UrlScan anyways.


So after perusing developer forums, Microsoft technical documentation, and various SQLmap documentation and tamper methods I had learned that appending %00 (Null-Byte) can be performed by the tamper script "appendnullbyte". This however refused to work, and the UrlScan module picked it up right away. So what was I supposed to do? Well apparently UrlScan doesn't know how to handle or what to do when the prefix is the nullbyte, and as far as I'm aware there are no SQLmap tamper scripts that would perform this bypass.

So after formatting the sqlmap command with the real value of a parameter I know that this page exists and has dynamic content depending on the "users" integer value

Original Unmodified

I quickly learn that the appendnullbyte tamper script only modifys the payload like this (note this is just generic payload)' WAITFOR DELAY '0:0:10'--%00

So after analyzing the responses from the application it seemed like it wouldn't take it at all... However, not all is lost and after performing more research into the matter the solution became apparent after some random dev was complaining about UrlScan filter rule of %00 basically crashing their application. So what I can extrapolate from that is that %00 is a null value (obvious), but more so than that I can deduce that %00 is not only not interpreted by UrlScan, but its completely overlooked because of the null value where it expects something.

Imagine if you will, you are an application looking for a value of anything greater than 0, but then you encounter 0. Would you simply stop interpreting it because to you there is nothing there? Well if you said yes, your in the same boat as UrlScan's logic apparently.

The Attack

So I've come to the conclusion that UrlScan expects some value to interpret or inspect whether it be in the Url, Url parameter, or POST body. I've also come to understand that if the value is null UrlScan simply ignores it on the basis that there is nothing to inspect, thus giving us the path towards carnage.

So here I am, at the end of the road... Will it work or not?' WAITFOR DELAY '0:0:10'--

IT WORKS! This little null value gave me the ability to perform SQL injection where SQL had failed time and time before.

This also allowed XSS to any arbitrary parameter I wanted...'><script>alert("XSS")</script>


In the end I've learned the following...

1. UrlScan's logic is flawed in the manner of interpreting null values - Expects 1, but gets 0 and does not continue inspection
2. %00 allows us to bypass UrlScan's logic to perform XSS and SQL injection where it would normally fail
3. %00 filtering within UrlScan breaks applications for whatever reason
4. SQLmap does not have a tamper script with which to bypass UrlScan, only has the ability to append %00 to end of payload where instead requires it be prepended to the payload


RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?

Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

August 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    19 Files
  • 2
    Aug 2nd
    17 Files
  • 3
    Aug 3rd
    16 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    1 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    15 Files
  • 8
    Aug 8th
    9 Files
  • 9
    Aug 9th
    7 Files
  • 10
    Aug 10th
    10 Files
  • 11
    Aug 11th
    1 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    14 Files
  • 14
    Aug 14th
    18 Files
  • 15
    Aug 15th
    38 Files
  • 16
    Aug 16th
    16 Files
  • 17
    Aug 17th
    22 Files
  • 18
    Aug 18th
    3 Files
  • 19
    Aug 19th
    3 Files
  • 20
    Aug 20th
    21 Files
  • 21
    Aug 21st
    7 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2018 Packet Storm. All rights reserved.

Security Services
Hosting By