Two methods to prevent internal IP address leakage

Internal IP address leakage prevention method: When the static html file on the iis, such as index.htm, the IIS response contains a Content-Location file header. If IIS is improperly configured, the Content-Location file header contains the IP address of the server, which leads to leakage of the Intranet IP address information hidden behind the NAT firewall or proxy server, attackers are allowed to bypass the attack.

Next, I will introduce two solutions to replace the IP address information with the domain name information to help the system administrator eliminate the risks of IP address leakage on the Intranet.

What is the response of IIS to the page file?

When we use a browser to access the page content on the Web server of the IIS website, IIS returns a complete response message to the user. In simple cases, we can think that the response information contains two parts:

1. system information:

Such as access status, server information, file type, and body length.

2. Body information:

Normally, it is the page content we see in the browser, that is, the page source code content that can be viewed in the browser.

When we use an Internet Control in advanced languages to access a page, for example, using the InternetControl control of VB to compile our own browser or download programs, in the end, you will get the complete response information that contains the preceding two parts.

First, let's take a look at an example, which shows the response information of IIS to HTML files by default installation:

HTTP/1.1 OK

Server: Microsoft-Microsoft IIS/5.0

Content-Location: http: // 192.168.1.1/index.htm

Date: Wed, 31Oct200104: 19: 40GMT

Content-Type: text/html

Accept-Ranges: bytes

Last-Modified: Fri, 12Oct200107: 48: 06GMT

ETag: "03f7e3af252c11: 9a2"

Content-Length: 7141

The first line of the response contains the IP address information of the Intranet, which we do not want. We want IIS to respond to the following content:

HTTP/1.1 OK

Server: Microsoft-Microsoft IIS/5.0

Content-Location: http://www.mywebsite.com/index.htm

Date: Wed, 31Oct200104: 19: 40GMT

Content-Type: text/html

Accept-Ranges: bytes

Last-Modified: Fri, 12Oct200107: 48: 06GMT

ETag: "03f7e3af252c11: 9a2"

Content-Length: 7141