From IIS 8.5 Site Security Technical Implementation Guide
Part of SRG-APP-000266-WSR-000142
Associated with: CCI-001312
The goal is to control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Also, enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server’s directory structure by locating directories with default pages. This practice helps ensure the anonymous web user will not obtain directory browsing information or an error message revealing the server type and version.
Note: This requirement is only for each site's root directory. Follow the procedures below for each site hosted on the IIS 8.5 web server: Click the site name under review. Double-click "Default Document". In the "Actions" pane, verify the "Default Document" feature is enabled. If an "Enable" option is listed under the "Actions" pane, the "Default Document" feature is not enabled and this is a finding. If "Default Document" is "Enabled, review the document types. Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Verify there is a document of that type in the directory. If "Default Document" is "Enabled" but no listed document types are present in the "Content View", this is a finding.
Follow the procedures below for each site hosted on the IIS 8.5 web server: Open the IIS 8.5 Manager. Click the site name under review. Double-click "Default Document". In the “Actions” pane select "Enable". Click the "Content View" tab, click on each listed "Default Document" and click on "Explore" under the "Actions" pane. Create a valid document for the listed "Default Document".
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer