Which IIS versions leak short names?

Any IIS server that generates 8.3 short names and answers requests for them can leak, which spans IIS 6 through 10 depending on configuration. The tilde short-name behavior can be turned off, so a hardened host reports no leak.

How do I reconstruct the full filename from an 8.3 name?

Pass a combined wordlist and rainbow table with --wordlist. That table, generated by the companion upstream tool shortutil, maps a leaked fragment like ADMIN~1.ASP back to candidate long names such as Admin.aspx.

How do I check a host without running a full scan?

Run with --isvuln so shortscan bails as soon as it decides whether the service is vulnerable, instead of enumerating every name. Raise --patience to 1 on a slow or noisy target to make the decision more reliable.

What output formats does shortscan support?

Set --output human for readable console output or --output json for structured records you can parse downstream. Add --fullurl to print the full URL of each confirmed file rather than the short name alone.

Updated Jul 14, 2026

Fuzzing

Recover hidden IIS paths from short-name leaks

Enumerate IIS 8.3 short filenames to recover hidden paths.

Recover hidden filenames on IIS Confirm the short-name leak fast Seed content discovery

overview

What shortscan does

shortscan reconstructs hidden IIS file and directory names by probing 8.3 short-name responses. It walks a character set, recurses into subdirs, and can expand fragments with a --wordlist rainbow table.

Run it against Microsoft IIS hosts when you suspect tilde short-name disclosure. --isvuln stops after the leak check; raise --patience or enable --stabilise on inconsistent servers.

It is IIS-specific. For general path brute force, feed recovered fragments into a content-discovery fuzzer rather than treating shortscan as a broad directory scanner.

source github.com/bitquark/shortscan

use cases

Where shortscan fits

Recover hidden filenames on IIS

Enumerate 8.3 short names to reconstruct files and directories the server exposes through legacy naming, including backups and config files.

Confirm the short-name leak fast

Run with --isvuln to bail the moment shortscan decides whether the service leaks short names, when you only need a yes or no on a host.

Seed content discovery

Feed recovered short-name fragments into a directory-fuzzing stage to expand them into full paths worth requesting.

Tune against unstable servers

Raise --patience and enable --stabilise so the tool still produces coherent autocomplete results when a server responds inconsistently under load.

reference

shortscan inputs and flags

15 inputs

Name	Type	Flag	Description
urls	FILE	·	File of URLs to scan.
output	STRING	--output	Output format: human (readable) or json (default human).
is-vuln	BOOLEAN	--isvuln	Bail after determining whether the service is vulnerable.
wordlist	FILE	--wordlist	Combined wordlist and rainbow table generated with shortutil.
header	STRING	--header	Header to send with each request (repeat for multiple headers).
concurrency	STRING	--concurrency	Number of requests to make at once (default 20).
patience	STRING	--patience	Patience level when determining vulnerability (0 patient, 1 very patient).
autocomplete	STRING	--autocomplete	Autocomplete detection mode: auto, method, status, distance, or none.

Showing key inputs. shortscan exposes 15 inputs in total.

Full flag reference (15 inputs)

Name	Type	Flag	Description
urls	FILE	·	urls to scan
header	STRING	--header	header to send with each request (use multiple times for multiple headers)
output	STRING	--output	output format (human = human readable; json = JSON) [default: human]
is-vuln	BOOLEAN	--isvuln	bail after determining whether the service is vulnerable [default: false]
timeout	STRING	--timeout	per-request timeout in seconds [default: 10]
full-url	BOOLEAN	--fullurl	display the full URL for confirmed files rather than just the filename [default: false]
patience	STRING	--patience	patience level when determining vulnerability (0 = patient; 1 = very patient) [default: 0]
wordlist	FILE	--wordlist	combined wordlist + rainbow table generated with shortutil
stabilise	BOOLEAN	--stabilise	attempt to get coherent autocomplete results from an unstable server (generates more requests) [default: false]
verbosity	STRING	--verbosity	how much noise to make (0 = quiet; 1 = debug; 2 = trace) [default: 0]
characters	STRING	--characters	filename characters to enumerate [default: JFKGOTMYVHSPCANDXLRWEBQUIZ8549176320-_()&'!#$%@^{}~]
no-recurse	BOOLEAN	--norecurse	don't detect and recurse into subdirectories (disabled when autocomplete is disabled) [default: false]
concurrency	STRING	--concurrency	number of requests to make at once [default: 20]
header-file	FILE	--header-file	headers to send with each request (one per line)
autocomplete	STRING	--autocomplete	autocomplete detection mode (auto = autoselect; method = HTTP method magic; status = HTTP status; distance = Levenshtein distance; none = disable) [default: auto]

example

Run shortscan

shortscan · command

# confirm the host leaks 8.3 names, then enumerate with a wordlistshortscan --isvuln http://example.com/shortscan --wordlist resources/rainbow.txt --output json --fullurl --concurrency 40 http://example.com/

sample output

Shortscan v0.9.1 · an IIS short filename enumeration tool by bitquark━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━URL:                   http://example.com/Running:               Microsoft-IIS/10.0Vulnerable:            Yes!━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ADMIN~1.ASP    File   Admin (Admin.asp, Admin.aspx)BACKUP~1.ZIP   File   Backup (Backup.zip)CONFIG~1.BAK   File   Config (Config.bak)UPLOAD~1       Dir    Uploads

guidance

Choosing shortscan

Use shortscan against Microsoft IIS targets to recover hidden file and directory names through 8.3 short-name leakage. For general directory brute force, pair recovered fragments with a content-discovery fuzzer.

snallygaster

Looks for exposed files on any web server. Broader server-agnostic checks, not IIS short-name specific.

smuggler

Tests for request smuggling rather than filename leakage. A different class of HTTP proxy bug.

shuffledns

Subdomain resolution rather than path enumeration. Runs earlier in a recon pipeline.

faq

shortscan questions

It targets one specific IIS weakness, the 8.3 short-name disclosure, rather than running a broad vulnerability scan. Run it with --isvuln for a fast yes or no on whether a host leaks short names, then let it enumerate the names in full.

Run shortscan yourself

A file of IIS URLs feeds shortscan, which enumerates 8.3 short names and writes the recovered filenames as a queryable output.

Open shortscan in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.