What type of attacks can ISAPI filters potentially expose a webserver to?

• A. Email spoofing.
• B. Webserver attacks.
• C. DNS hijacking.
• D. Physical tampering.

Answer: (B)

ISAPI filters are DLLs loaded by the web server to process HTTP requests, and they run inside the server process with the server’s privileges. If a filter is insecure or compromised, an attacker can exploit it to execute code on the server, read or modify files, or alter responses. Because the filters operate within the server context, vulnerabilities in them broaden the web server’s attack surface and can lead to full or partial server compromise. In short, issues with ISAPI filters expose the web server to webserver-style attacks, rather than to email spoofing, DNS hijacking, or physical tampering.