After a few years of finding IIS Short File Name DisclosureĀ vulnerability/feature, I discovered a new method that can work on the latest versions of IIS!
It is a simple trick: If OPTIONS method is used instead of aĀ GET method, the latest versions of IIS will produce a different error message when a short file name is available on the server. The actual bug is exactly the same as the original report and therefore this does not count as a new issue but a new technique.
I have also updated my Java scanner which is accessible via my GitHub repository: https://github.com/irsdl/iis-shortname-scanner/tree/master/
I have successfully tested thisĀ scanner on a freshly installed IIS7.5 on Windows 2008 R2 and also on an IIS8.0 on Windows 2012. It seems 8.3 names are still enabled by defaultā¦ and Microsoft does not seem to be keenĀ to patch this low risk issue after a few years. Well, it is a feature now just like the semi-colon vulnerability in IIS6! ;-)
Test your IIS server and see if it is vulnerable! You may need to add valid headers and cookies to the scanner to be able to scan some special servers.