Compliance check: IIS leaks internal IP

During security audit scans, it is sometimes seen that a Microsoft Internet Information Services (IIS) server is exposing the servers internal ip, when a speciel get request is sent to the server.

This can be due to misconfig, unpatched server or maybe something that is default.

It can be amended by running this on IIS servers from 2008 R2 and up:

appcmd.exe set config -section:system.webServer/serverRuntime /alternateHostName:”” /commit:apphost

Reboot is not needed and now it will display “” instead of it’s internal ip.


Leave a Comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.