| Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp. |
All interactive programs must be placed in unique designated folders based on CGI or ASP script type. For modular and/or third-party applications, it is permissible to have script files in multiple folders.
Open the IIS 8.5 Manager.
Right-click the IIS 8.5 web site name and select "Explore".
Search for the listed script extensions. Each script type must be in its unique designated folder.
If scripts are not segregated from web content and in their own unique folders, this is a finding.