By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.
| Software | From | Fixed in |
|---|---|---|
| microsoft / internet_information_server | 4.0 | 4.0.x |