Of all the ridiculous things I’ve seen in my time in cybersecurity, the continued pervasiveness of IIS shortname enumeration might be among the most egregious. At a glance, you might disagree. The vulnerability poses a medium risk at best: a 5.3 from CVSS for low confidentiality, with nothing else to note. Recently, however, it’s become something of a favorite vulnerability of mine.
I see IIS shortname enumeration as something like an enabler, a yes-man; like a friend who has had one drink too many and thinks any idea you propose is the greatest idea in the history of mankind. This silly little sixteen-year-old vulnerability, so often overlooked by developers and application owners, has opened the gates to multiple critical vulnerabilities, all the while with an innocent smile on its face. Sure, IIS shortname enumeration is a medium-risk vulnerability, but it’s a medium with an asterisk. And that asterisk is carrying a lot of weight.
What is this shortname thingy, anyhow?
IIS shortname enumeration has a long history beginning all the way back with MS-DOS. In days of yore, DOS’s FAT filesystem could only support filenames of a certain length: eight characters for the actual file name, and another three for the file extension. These are commonly referred to as “8.3 short filenames” (or just “shortnames” for, well, short). Any file with a name longer than the eight-character limit had to be truncated. Eventually with the advent of NTFS and Windows 95 after it, longer filenames came to be supported, and the 8.3 limit was done away with.
Except, not actually at all. Microsoft needed backwards compatibility with older DOS programs and the like, so they came up with the solution that every long filename would automatically have a shortname alias generated. This way, NTFS could feed any DOS-based programs the shortname while still keeping the real name visible to the end user. Shortnames are made of the first six characters of the filename, a tilde, and a number, with the file extension truncated to three characters. For example, microsoft_is_stupid.txt would be given the shortname MICROS~1.TXT. If another file also started with micros (e.g., microsoft_is_really_stupid.txt), it would become MICROS~2.TXT. Over the years, DOS programs faded into obscurity, and Microsoft understandably phased out the now-obsolete 8.3 shortname feature.
Just kidding! To this day, 8.3 shortname creation is still enabled by default on NTFS volumes.
So where does the vulnerability come in? Well, in 2010, security research Soroush Dalili discovered that 8.3 shortnames could be detected and enumerated over Microsoft IIS, a finding he documented thoroughly. While the files are not directly accessible over HTTP via shortnames, IIS servers commonly send variable responses depending upon whether a valid shortname is submitted. By exploiting this quirk, the first six characters of any file or directory that NTFS has created a shortname alias for can be very quickly enumerated: an added value to web content discovery that cannot be understated.
“Pwning” is only six characters long
Imagine, if you will, an admin portal within a hidden directory titled zzzxx_administration. There are a grand total of zero wordlist-based scanning tools that will find such a directory for you, precisely because of the obscure prefix. Now imagine that this hidden directory is on an IIS server, and you are able to use an IIS shortname scanner against it. In a matter of seconds, you could discover this directory’s 8.3 shortname: ZZZXX_~1. Those six characters make a world of difference: a wordlist scanning tool like ffuf could easily find the actual directory by scanning for zzzxx_FUZZ.
Now I know this sounds like one of those things that you’d learn about in a “basics of web app pen testing” course and never once actually see in the wild, but we in the Attack Surface Management Operations Center (ASMOC) have come across this vulnerability more times than we can count. In fact, across every client we have, IIS shortname enumeration regularly sees the highest number of affected resources in any finding. Every month we find more new instances of it, while many previous ones continue to fly unpatched, perhaps in part due to their unassuming “medium” CVSS score. It certainly doesn’t help that Microsoft continues to leave 8.3 shortname aliases enabled by default, and discoverable over even the latest versions of IIS.
But the real cost, as is often the case with the medium findings, is how they can potentially be chained to form much greater vulnerabilities. With the sheer volume of vulnerable assets out there, there are bound to be a few hiding something much uglier beneath the surface. Twice now, the ASMOC has arrived at critical vulnerabilities thanks to endpoints leaked through IIS shortname enumeration. We were even able to publish one of those findings as CVE-2025-10183, as was highlighted in our write-up from last year. Those endpoints would never have been found through traditional fuzzing or directory brute forcing, but with a quick IIS shortname scan, they were unearthed in minutes; their underlying critical vulnerabilities - an XXE and a SQL injection, respectively - were quickly reported to the clients for remediation.
BUGFIX~1.txt
Disabling shortnames on your web server is frustratingly inconvenient, mainly owed to the fact that Microsoft continues to view it as a core feature. To start with, 8.3 shortname creation is dictated entirely by the NtfsDisable8dot3NameCreation registry key. By default, this value is set to 2, meaning shortname creation happens on a “per volume basis” - by default, always for the system drive and potentially for other drives depending on their format. The value must be manually changed to 1 to disable shortname creation, but here lies a common pitfall: even with this feature turned off, all files created prior to disabling the registry key will still have shortnames. Therefore, one must also use Microsoft’s fsutil 8dot3name command to remove existent 8.3 shortnames. Alternatively, web servers can be configured to strip or reject tilde characters to prevent enumeration outright (notably, IIS does not do this by default). All that to disable a legacy feature whose intended use cases are vastly outnumbered by malicious abuses of an unintended loophole. Microsoft, you never fail to disappoint.
Dear reader, thirty-three years have passed since Microsoft introduced NTFS to the world. MS-DOS and FAT systems are as obsolete as obsolete gets. Fixing IIS shortname enumeration is long overdue; it’s high time for application owners to start disabling this feature on web servers. Until then, 8.3 shortname compatibility will continue to benefit attackers, and attackers alone.
If you’re interested in learning how Black Lantern Security’s Attack Surface Management Operations Center can help identify IIS Shortname Enumeration and other vulnerabilities on your external attack surface, click here to contact us.