IIS Tilde Enumeration Scanner
Summary: PortSwigger's BApp Store lists an extension by Michele 'cyberaz0r' Di Bonaventura, version 2.0 and last updated 20 July 2023, that checks for the IIS Tilde Enumeration/IIS short name (8.3) disclosure vulnerability and exploits it by enumerating all short names on an IIS web server. The extension adds an Active Scanner check for detection and a new Burp UI tab for manually checking and exploiting the vulnerability, and is based on IIS ShortName Scanner.
What's compelling: The extension carries an overall system impact rating of Low and is written by a third-party user, with PortSwigger stating it makes no warranty about its quality or usefulness - so a tool that enumerates short names on your IIS servers arrives with no vendor assurance behind it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026