This talk will discuss and demonstrate how an attacker would attempt to break into a web server running Lotus Domino on an NT or UNIX platform and how to secure against the methods used. Further to the known issues, David will examine four new features and bugs with Domino that can allow an attacker to read arbitrary files from the file system, enumerate every Notes database on the server and discover every form, agent and view, both hidden and visible, in a given database remotely. Lastly, David will consider the security implications of running Domino as a component of Microsoft's Internet Information Server and what new holes are opened up by this and what must be done to secure the server.