Improving Web Application Security: Threats and Countermeasures

At the time of writing (April 2003), URLScan 2.0 is installed when you run IISLockdown (IISLockd.exe,) or you can install it independently.

• Installing URLScan 2.0 with IISLockdown: You can install URLScan 2.0 as part of the IIS Lockdown Wizard (IISLockd.exe). IISLockd.exe is available as an Internet download from Microsoft's Web site at: http://download.microsoft.com/download/iis50/Utility/2.1/NT45XP/EN-US/iislockd.exe .

• Installing URLScan 2.0 without running IISLockdown: To install URLScan without running IISLockdown, you need to manually extract it from the IIS Lockdown Tool. First you need to save IISLockd.exe to a directory. Then to extract the URLScan setup files, run the following command at the command line from the directory where you installed IISLockd.exe:

  iislockd.exe /q /c

  This unpacks URLScan.exe which is the URLScan installation program.

  For more information, refer to Microsoft Knowledge Base article 315522, "How To: Extract the URLScan Tool and Lockdown Template Files from the IIS Lockdown Tool."

• Installing URLScan 2.5: URLScan 2.5 is currently the latest version of URLScan. If you want to install URLScan 2.5, you first need URLScan 1.0 or URLScan 2.0.

  For more information, refer to Microsoft Knowledge Base article 307608, " INFO : Availability of URLScan Version 2.5 Security Tool."

• Default installation directory: The URLScan files including Urlscan.dll, URLScan.ini and URLScan logs are stored in %windir%\system32\inetsrv\urlscan. URLScan.dll is the filter. You use URLScan.ini to configure the way it works.