Blog Stats
  • Posts - 45
  • Articles - 0
  • Comments - 15
  • Trackbacks - 20

 

localstart.asp

Localstart.asp is a default page on IIS installations. This page is protected by IIS using basic authentication. The problem with this is that if I am able to bruteforce the password, I know the password for the admin on the local box.
This can be very bad since the attacker now knows the admin's password. If the box enables any network services, this is almost fatal. Even if this particular box does not have any network services, the attacker has an idea of how the admins is making up passwords. For example, if the localstart.asp admin password is "Adm1nB0xname" - the attacker has a fairly good idea of what the password is going to be on another box in the network that has more previleges such as ssh.
A word of caution to those who decide that the best way to go about it is to remove localstart.asp. It seems that simply removing causes problems in IIS. The best solution is to replace localstart.asp with a blank page and have no authentication on it.

Feedback

# re: localstart.asp

Gravatar i hate this! 5/5/2006 6:28 PM | bpbb

# re: localstart.asp

Gravatar can you help me change default port 8080 of IIS wen server 5/11/2006 10:16 PM | pradeep

# re: localstart.asp

Gravatar
did you figure out how to disable this yet? I can't seem to disable it. 7/20/2006 11:54 AM | jay

# re: localstart.asp

Gravatar Jay:
Just delete localstart.asp completely, then remove the lines in iisstart.asp that Response.Redirect to localstart.asp

Pradeep:
I believe all you have to do is go to your Default Website in IIS and change the TCP port to whatever port desired, but remember you have to unblock that port in windows firewall to allow outside clients to be able to connect. 2/28/2008 7:03 PM | Mike

# re: localstart.asp

Gravatar I want know how to remove this service because in one customer our static ip is regestred with mac from our server but in the client end with out do any thing . internet is working so how i can remove this service it .


Radhesh chaudhray 10/8/2008 10:46 AM | Radhesh

Post a comment





 

 

 

Copyright © Rishi Pande