Is there a way to retrieve a list of all URLs that a web server using IIS will respond to?

Do you really mean every url that might be served, which would mean every page (every dynamic or static file)?

Or do you mean perhaps every DOMAIN (or IP) that IIS is defined to be served?

The former would be more challenging, but it could be obtained by various means to just list every file in every web accessible folder.

The latter may really be what you mean, and that can be found by listing every binding in every site in iis, which can be done via the iis ui or at the command line such as with tools like appcmd.

Even then, note that if you have a binding for all ips (*) and no domain name (like the default site is defined out of the box), then you CANNOT tell from that info what domains might come in, as ANY could, if directed to your server's ip address from the definition in any dns server or hosts file.

(I have just added another reply, answering the question a different way.)

Adding to my last reply, I was responding to what was asked: what urls COULD a given IIS server serve.

A different question would be to list all urls that a given IIS server (or site/s) HAD ever served.

The latter could be obtained via the IIS logs, for all sites served. There are tools (like the free and venerable logparser) which could aggregate all logs for all sites and produce a report of each distinct url ever served.

Thanks for the reply.

In this case I mean every URL.  This particular IIS deployment has a single role which is for an internal application server.  We want to make some aspects of that application available over the Internet using a reverse proxy.  We've found that once published, any external user can access the IIS default page (I've heard this can be disabled in IIS), including many pages, like the application's admin console, which we do not want to be accessible externally.  The solution we've come up with is within the reverse proxy, point specific URLs that we don't want to be accessible to an error page or possibly a redirect.  We need a list of URLs from the application server to do so.

I'm new to a lot of these concepts, so I apologize if I'm not explaining this very well.

Thanks.