- SSL / HTTPS
- Microsoft IIS Web Server
Is there a way to retrieve a list of all URLs that a web server using IIS will respond to?
Here's the scenario:
I have a web application that creates a number of web sites on the server it's installed. Is there a way to get a list of all the URLs used on IIS on that server? I'd like to see any URL that's listed whether it directs to a web page, redirects to another URL, etc.
I've tried googling this, but I just get pages and pages of things to try that never seem to give me the info I'm looking for.
I'm a complete newbie to IIS.
I have a web application that creates a number of web sites on the server it's installed. Is there a way to get a list of all the URLs used on IIS on that server? I'd like to see any URL that's listed whether it directs to a web page, redirects to another URL, etc.
I've tried googling this, but I just get pages and pages of things to try that never seem to give me the info I'm looking for.
I'm a complete newbie to IIS.
Do you really mean every url that might be served, which would mean every page (every dynamic or static file)?
Or do you mean perhaps every DOMAIN (or IP) that IIS is defined to be served?
The former would be more challenging, but it could be obtained by various means to just list every file in every web accessible folder.
The latter may really be what you mean, and that can be found by listing every binding in every site in iis, which can be done via the iis ui or at the command line such as with tools like appcmd.
Even then, note that if you have a binding for all ips (*) and no domain name (like the default site is defined out of the box), then you CANNOT tell from that info what domains might come in, as ANY could, if directed to your server's ip address from the definition in any dns server or hosts file.
(I have just added another reply, answering the question a different way.)
Or do you mean perhaps every DOMAIN (or IP) that IIS is defined to be served?
The former would be more challenging, but it could be obtained by various means to just list every file in every web accessible folder.
The latter may really be what you mean, and that can be found by listing every binding in every site in iis, which can be done via the iis ui or at the command line such as with tools like appcmd.
Even then, note that if you have a binding for all ips (*) and no domain name (like the default site is defined out of the box), then you CANNOT tell from that info what domains might come in, as ANY could, if directed to your server's ip address from the definition in any dns server or hosts file.
(I have just added another reply, answering the question a different way.)
Adding to my last reply, I was responding to what was asked: what urls COULD a given IIS server serve.
A different question would be to list all urls that a given IIS server (or site/s) HAD ever served.
The latter could be obtained via the IIS logs, for all sites served. There are tools (like the free and venerable logparser) which could aggregate all logs for all sites and produce a report of each distinct url ever served.
A different question would be to list all urls that a given IIS server (or site/s) HAD ever served.
The latter could be obtained via the IIS logs, for all sites served. There are tools (like the free and venerable logparser) which could aggregate all logs for all sites and produce a report of each distinct url ever served.
Thanks for the reply.
In this case I mean every URL. This particular IIS deployment has a single role which is for an internal application server. We want to make some aspects of that application available over the Internet using a reverse proxy. We've found that once published, any external user can access the IIS default page (I've heard this can be disabled in IIS), including many pages, like the application's admin console, which we do not want to be accessible externally. The solution we've come up with is within the reverse proxy, point specific URLs that we don't want to be accessible to an error page or possibly a redirect. We need a list of URLs from the application server to do so.
I'm new to a lot of these concepts, so I apologize if I'm not explaining this very well.
In this case I mean every URL. This particular IIS deployment has a single role which is for an internal application server. We want to make some aspects of that application available over the Internet using a reverse proxy. We've found that once published, any external user can access the IIS default page (I've heard this can be disabled in IIS), including many pages, like the application's admin console, which we do not want to be accessible externally. The solution we've come up with is within the reverse proxy, point specific URLs that we don't want to be accessible to an error page or possibly a redirect. We need a list of URLs from the application server to do so.
I'm new to a lot of these concepts, so I apologize if I'm not explaining this very well.
Again, no. Nothing can provide "every URL" that IIS might possible serve.
But now that you have added more explanation to your request, which is about securing WHAT pages can be served by IIS and by WHOM, just note that you can find many features in IIS (let alone in your proxy) to control WHAT is allowed to be served.
IIS offers features that can require authentication, or can literally block or only allow certain requests (in the "request filtering" feature), and these settings can be done within the IIS UI either at the entire server level (affecting all sites then, by default), or at a site level (which can override server-level settings), and some things can even be done at the folder level (within a site).
I hear you saying you're new to these things, and fair enough. But the point here is that it sounds like you would benefit greatly by reading even fundamental IIS resources explaining things like this. Among examples only from MS are:
I will also point out that back in 2012, MS evangelist Scott Forsyth did 50 videos on different aspects of IIS. The site where they existed is no more, but I had done in 2016 a blog post pointing them out, including pointing to a youtube playlist of the videos. See my post here.
Perhaps still others here may point to some other equally substantial and suitable resources for someone like you getting started with things. But if all you wanted was to solve this one problem, I hope somehow I have.
But now that you have added more explanation to your request, which is about securing WHAT pages can be served by IIS and by WHOM, just note that you can find many features in IIS (let alone in your proxy) to control WHAT is allowed to be served.
IIS offers features that can require authentication, or can literally block or only allow certain requests (in the "request filtering" feature), and these settings can be done within the IIS UI either at the entire server level (affecting all sites then, by default), or at a site level (which can override server-level settings), and some things can even be done at the folder level (within a site).
I hear you saying you're new to these things, and fair enough. But the point here is that it sounds like you would benefit greatly by reading even fundamental IIS resources explaining things like this. Among examples only from MS are:
- https://www.iis.net/overview
- https://docs.microsoft.com/en-us/iis/get-started/getting-started-with-iis/getting-started-with-the-iis-manager-in-iis-7-and-iis-8
I will also point out that back in 2012, MS evangelist Scott Forsyth did 50 videos on different aspects of IIS. The site where they existed is no more, but I had done in 2016 a blog post pointing them out, including pointing to a youtube playlist of the videos. See my post here.
Perhaps still others here may point to some other equally substantial and suitable resources for someone like you getting started with things. But if all you wanted was to solve this one problem, I hope somehow I have.
Explore More Content
Explore More ContentExplore courses, solutions, and other research materials related to this topic.
-
![]()
received a Solution
How to import a certificate into IIS without creating a new CSR request from that IIS server? -
![]()
wrote an Article
How to Fix a Common WordPress Update Error in IIS -
![]()
created a Video
![]()
Exchange 2019 - Change the cypher suites using IIS Crypto 3.0
-
Explore Cloud Class® ![]()
Certification: MCP Microsoft Certified Partner - Installing and Configuring Windows 7
Premium Content
You need an Expert Office subscription to comment.Start Free Trial