Tools Used for IIS Security Research

I have used the following tools in my IIS security investigations.

• Network Monitor - to catch and examine network packets travelling between systems. Notice that you can install NetMon on Windows 2000 Server, Professional, NT 4.0 Server, NT 4.0 Workstation, and Windows 9X. I have a small section in this book that briefly describes the installation process.
• Access Token Dumper (DumpTokenCom) - my own custom made COM object that dumps contents of an access token to a file. I have used the security class library from the previous edition of this book to quickly create this object. The Iis\DumpTokenCom directory of the sample source code accompanying this book contains all source files. In addition, I have a simple Visual Basic based VbDumpTokenComTester project that I used to test the functionality of this object.
• Alternatively, you can use a nice Token Dump COM component developed by Keith Brown (tokdumpsrv.dll). It gets contents of an access token in HTML format and may be used in ASP pages, which is quite useful for debugging IIS security problems. I have downloaded the component using this url: http://www.develop.com/kbrown/security/samples.htm.

  Here is the entire contents of a sample ASP file that I used to test this component followed by a picture with its output:

  <%
  dim objTokDumper
  set objTokDumper = server.createobject("Tokdumpsrv.Tokdump.1")
  Response.Write(objTokDumper.TokenDump(&H177))
  set objTokDumper = nothing
  %>
  

The beginning of HTML output from Keith Brown' Token Dump COM object.