Directory enumeration technique utilised to uncover hidden files, directories, and short file names on some version of Internet Information Services (IIS).
When a folder or file is created Windows generates a short file name in the 8.3 format,, consisting of eight chracters for the file name, a period, and three characters for the extension. The ~ tilde followed by a secquence number, signifies a short file name in a URL. If someone determine’s a file or folder’s short file name they can use the tilde and short file name in the URL to access sensitive data.
The IIS will reply with 200 OK if the beginning characters are valid for the file name.
In 8.3 short file names, such as somefi~1.txt, the number “1” is a unique identifier that distinguishes files with similar names within the same directory. The numbers following the tilde (~) assist the file system in differentiating between files that share similarities in their names, ensuring each file has a distinct 8.3 short file name.
Enumeration
A tool can automate this task: IIS-ShortName-Scanner.
java -jar iis_shortname_scanner.jar 0 5 http://10.129.204.231/