A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Every file created on Windows gets an 8.3 short name. somefile.txt becomes SOMEFI~1.TXT. IIS versions up to 7.5 respond differently to requests containing valid short names versus invalid ones. That timing difference lets you enumerate hidden files character by character.
http://target/~s. If a file starting with 's' exists, IIS returns 200. If not, 404. Append characters: ~se, ~sec, ~secr. Each 200 response narrows the name. Eventually you discover secret~1 and can access the hidden resource.Three files and two directories discovered. TRANSF~1.ASP is interesting but the server doesn't allow GET access to it directly. You need to brute-force the remaining filename characters.
The full filename is revealed. What was hidden behind a short name is now directly accessible. This technique works on IIS 6.0 and 7.5 primarily. Newer versions patched the timing oracle, but legacy Windows servers in corporate networks still run these versions.
IIS 7.5 holds significant market share in enterprise Windows environments. The tilde technique costs you 553 HTTP requests and reveals files that administrators thought were hidden. Not security through obscurity—actual information disclosure. 8.3 name generation can be disabled, but rarely is.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.