IIS Add-ons

PHP is a server-side, cross-platform, HTML embedded scripting language. With PHP you create dynamic web pages. PHP-enabled web pages are treated just like regular HTML pages and you can create and edit them the same way you normally create regular HTML pages. This version has MySQL support built-in, packaged as Windows installer to install and configure PHP, and automatically configure IIS, PWS and Xitami, with manual configuration for other servers.

URLScan, screens all incoming requests to the IIS web server, and filters them based on rules set by the administrator. This significantly improves the security of the server by helping ensure that it only responds to valid requests. URLScan is effective in protecting web servers because most attacks share a common characteristic they involve the use of a request thats unusual in some way. For instance, the request might be extremely long, request an unusual action, be encoded using an alternate character set, or include character sequences that are rarely seen in legitimate requests. By filtering out all unusual requests, URLScan prevents them from reaching the server and potentially causing damage. URLScan is extremely flexible. Its default rule set fully protects a server against virtually all known security vulnerabilities affecting IIS, as well as potentially protecting against additional, as-yet undiscovered attack methods. The default rules can be modified and new rules can be added in order to customize the tools actions to match the needs of a particular server.

URL Replacer is a ISAPI filter for IIS that allows you to replace part of the URL with other values. You can use it to hide true file extensions or to convert query string URLs into something that looks like a directory structure (can help with search engine indexing). For example, the URL `http://www.webattack.com/test.xhtml/id=123/user=joe` could be transparently converted to `http://www.webattack.com/test.php?id=123&user=joe`. The conversion is completely invisible to the user. URL Replacer provides an optional HTTP configuration interface.

Microsoft has released a new security tool that makes it simple to secure an IIS 4.0 or 5.0 web server. The tool, known as the IIS Lockdown Tool, allows web servers to quickly and easily be put into the right configuration in which the server provides all of the services the administrator wants to provide, and no others. Customers can use this tool to instantly protect their systems against security threats that target web servers. The tool offers two operating modes. The default is Express Lockdown which, with a single mouse click, configures the server in a highly secure way that is appropriate for most basic web servers. For administrators who want to pick and choose the technologies that will be enabled on the server, the tool offers an Advanced Lockdown mode. A comprehensive help system provides information and recommendations for selecting the best configuration, and an undo facility allows the most recent lockdown to be reversed.