IIS Vulnerability Checker

[SteveC]

Anyone got any useful programs to test for security holes in a website hosted on an IIS web server?

[Dogbert]

(I hope I'm not being silly here)

You can try ShieldsUp at www.grc.com and his other little apps.

[SteveC]

You're not being silly, but those checks are really for testing the machine's network security, not the IIS application security if that makes sense. I just want an easy way of checking that security patches/hotfixes are installed and there's no silly settings left set wrongly.

[Holerith]

GRC

There is also a utility on the Gibson Research site for testing the server for proper patching etc.

[SteveC]

I found Microsoft's Baseline Security Analyser which seems just what I want.

[Duty]

Have you gone here?

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/tools.asp

There is also the active role to IIS security.

http://www.argus-systems.com/catalogue/protector/

Jeff