Security: HTTP headers that expose web application / server vulnerabilities

Today's blog post will cover how ASP.net response HTTP headers can expose security holes in your web application and servers. The post will also contain steps on how to remove this headers and mitigate chances of getting attacked using C# and ASP.net MVC.

Problem

When an attacker performs an attack on a web server, the first thing he /she needs to do is to identify the profile of his target. To profile a target web application / server, an attacker would have to perform the following steps:

  • Identify the address of the web application.
  • Identify the OS where the web application resides
  • Identify the type of server (IIS, Apache, etc) that was hosting the web application
  • Identify the frameworks (ASP.net MVC, PHP, JSF) used by the applications

After an attacker gathers the following information, the attacker would proceed on using penetration tools (Kali's Metasploit and Websploit) to perform different kinds of attacks to disrupt the target which could mean:

  • Defacing the application
  • Performing denial of service attacks
  • Disabling of web server itself
  • Kidnapping of database server for ransom

ASP.NET MVC Solution Github

One way to delay an attacker from executing an attack on your server is to remove HTTP headers that identify IIS and ASP.net powered applications. Below are the list of HTTP headers that needs to be removed from your applications response headers:

  • Server
  • X-AspNetMvc-Version
  • X-AspNet-Version
  • X-Powered-By

These HTTP headers can be removed by configuring an IIS server manually. This approach is OK but infeasible because the most common cause of an attack to a web server is scaling (Adding of servers / load balancers in a web farm) without configuring the additional machine. Sometimes, IT people in-charge of configuring newly added server nodes forget to disable the inclusion of these headers to the application's response objects. To make things worst, newbies are clueless with the existence of these headers. As responsible developers, we find this annoying and simply unacceptable.

To prevent hackers from retrieving HTTP server information headers, we can implement a class that would strip all these headers from all the responses emitted by an ASP.net application. The class below does the trick:

Clone it from Github

using System.Collections.Generic;
using System.Linq;
using System.Web;
namespace ServerIdentityHttpHeaderStripping
{
    /// <summary>
    /// Class that implements methods used for
    /// stripping out HTTP response headers.
    /// </summary>
    public class ServerIdentityStripper
    {
        #region Public Methods
        /// <summary>
        /// Method that strips out HTTP response headers 
        /// from response.
        /// execution.
        /// </summary>
        /// <param name="context">
        ///     Http context associated with the response 
        ///     that would be stripped of server identity 
        ///     headers.
        /// </param>
        public void Execute(HttpContext context)
        {
            var serverHeaders = GetServerIdentityHeaders();
            StripServerHeaders(context.Response, serverHeaders);
        }
        #endregion
        #region Private Methods
        private bool CheckIfHttpHeaderExists(HttpResponse response, string header)
        {
            return response.Headers
                           .AllKeys
                           .Any(k => k == header);
        }
        private List<string> GetServerIdentityHeaders()
        {
            return new List<string>
            {
                "Server",
                "X-AspNetMvc-Version",
                "X-AspNet-Version"
            };
        }
        private void StripServerHeaders(HttpResponse response, List<string> headers)
        {
            foreach (var header in headers)
            {
                if (CheckIfHttpHeaderExists(response, header))
                    response.Headers.Remove(header);
            }
        }
        #endregion
    }
}

You also have to add the following code on Global.Asax's Application_EndRequest event.

        protected void Application_EndRequest()
        {
            var stripper = new ServerIdentityStripper();

            stripper.Execute(HttpContext.Current);
        }

X-Powered-By

Unfortunately, the class can strip all necessary headers except for the "X-Powered-By" header. This happens because IIS is the one that attaches this HTTP header after the application release the response object. To ensure that this HTTP header would be removed from your server's response headers. You can add the configuration below on your application's web.config file.

   <system.webServer>
    <httpProtocol>
    <customHeaders>
    <remove name="X-Powered-By" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>

Result

Comments

  1. Way cool! Some extremely valid points! I appreciate you writing this post plus the rest of the site is also press very good.

    ReplyDelete
  2. I enjoyed over read your blog post. This was actually what i was looking for and i am glad to came here!
    Website: Antique jewellery wholesale

    ReplyDelete
  3. I am really enjoying reading your well written articles. I think you spend numerous effort and time updating your blog.
    online electronics shopping sites in india

    ReplyDelete
  4. Fabulous blog with lots of information. I am glad to visit this, waiting for more updates.
    Web Development Course in Chennai

    ReplyDelete
  5. Thank you for sharing. Excellent post...! It is a very great idea and unique content. Thank you so much.
    Malaysia passport renewal

    ReplyDelete
  6. I recently came across your blog and have been reading along. I thought I would leave my first comment. I don’t know what to say except that I have enjoyed reading.
    Website: metal roofing company near me

    ReplyDelete
  7. I read this article fully on the topic of the difference of most up-to-date and earlier technologies, it’s awesome article.
    Website: online renew passport malaysia

    ReplyDelete
  8. Great article! This is the type of information that are meant to
    be shared across the internet. Thank you for sharing such a useful post. Very Interesting Post! I regularly follow this kind of Blog.
    scottishkiltcollection

    ReplyDelete
  9. This comment has been removed by the author.

    ReplyDelete
  10. Need fence repair and staining services? We are reputed fence Repair Company that offers wide range of affordable fence replacement, fence repair and installation and much more!

    residential fence specialist Frisco

    ReplyDelete

  11. Great article! This is the type of information that are meant to
    be shared across the internet. Thank you for sharing such a useful post. Nice post ! I love its your site after reading ! thanks for sharing.
    professional graphic installation

    ReplyDelete
  12. Great article! This is the type of information that are meant to
    be shared across the internet. Thank you for sharing such a useful post. Nice post ! I love its your site after reading ! thanks for sharing.

    Website: eligibility for gmat

    ReplyDelete
  13. Need fence repair and staining services? We are reputed fence Repair Company that offers wide range of affordable fence replacement, fence repair and installation and much more!
    fence replacement in mckinney tx

    ReplyDelete

  14. More impressive Blog!!! Its more useful for us...Thanks for sharing with us...
    Why is Big Data Important?
    Why Big Data

    ReplyDelete
  15. This comment has been removed by the author.

    ReplyDelete
  16. Great Post!!! Thanks for the data update and waiting for your new updates.
    what does .net framework do
    do i need .net framework

    ReplyDelete
  17. Great job, this is essential information that is shared by you. This information is meaningful and very important for us to increase our knowledge about it. Always keep sharing this type of information. Thanks once again for sharing it. Information security auditors

    ReplyDelete
  18. Gandhi Brothers Lottery Group was founded by Mr Manmeet Singh when he was 12 years old and today, it has been developed as a very reputed the well-established business firm of providing secure Lottery of Punjab State Lottery since the last 36 years. It has two Lottery system. Bumper Prizes weekly Prizes. The biggest jackpot hit from the Punjab State Lottery is New Year Bumper 2012 on 19-01-12 amounting Rs.2.00 crore Monthly Lottery Bumper 2012 held on 23-07-12 amounting Rs. 51 Lakhs distributed over prize money. Gandhi Brother’s lottery is Authorized and legal, assuring each player of a fair playing lottery.
    Monthly lottery

    ReplyDelete
  19. It was a great blog with so much information of the beautiful places to visit.
    Pest control provider in Nagpur

    ReplyDelete
  20. This is very useful software for you and me. No errors were found during the check.
    You can use it. I hope you like it.
    Marketing and Advertising Graphics

    ReplyDelete
  21. Thank you for sharing such a useful post. Very Interesting Post! I regularly follow this kind of Blog.
    Website Punjab state dear lohri makar sankranti bumper lottery

    ReplyDelete
  22. Thank you for sharing so insightful article. Rozana.in has a far-reaching presence across various cities in India.
    Visit for more info groceries stores

    ReplyDelete
  23. Hello there, You have done a great job. As we all know how much Bill of Sale being used. This document is usually used for sale and purchase between two parties like Buyer & seller.
    Visit here IL Bill of sale

    ReplyDelete
  24. Impressive content sharing, reading your blog gives me a clear understanding of cyber security. Thanks for sharing valuable information. network security companies in india

    ReplyDelete
  25. This is very educational content and written well for a change. It's nice to see that some people still understand how to write a quality post! B2B Cyber Security

    ReplyDelete
  26. I am impressed with your work and skills visit also App development companies UAE .

    ReplyDelete
  27. Thanks for sharing this valuable information about Domain Registration Usa. I have gone through your post and got meaningful information.

    ReplyDelete
  28. Thank you for sharing good knowledge and information about dedicated server malaysia. It's very helpful and understanding. as we have been looking for this information for a long time.

    ReplyDelete
  29. I am very thankful to you that you have shared this information with us. I got some different kinds of knowledge from your web page, and it is really helpful for everyone. Thanks for sharing it. Read more info about travel portal development cost online

    ReplyDelete
  30. It is truly a practical blog to discover some various resource to include my knowledge. Telstra Business Phone system

    ReplyDelete
  31. I always like to read a quality content having accurate information regarding the subject.

    gagner de l'argent sur internet

    ReplyDelete
  32. Wow, your post is really very useful thanks for sharing about Maintenance Management Software Bahrain. It's really informative. keep sharing more with us.

    ReplyDelete
  33. Writing a post is really important for the growth of your websites. Thanks for sharing amazing tips about Buy Hosting with Perfect Money. Following these steps will transform the standard of your post for sure.

    ReplyDelete
  34. Thanks for a very interesting blog. What else may I get that kind of info written in such a perfect approach about Bluehost Shared Hosting Online Review ? I’ve got an undertaking that I am simply now operating on, and I have been on the lookout for such info.

    ReplyDelete
  35. This post is Awesome. It’s helped me a lot. Please keep up your good work. We are always with you and Waiting for your new interesting articles. Visit also Cloud Vps Hosting Services Provider

    ReplyDelete
  36. This post is Awesome. It’s helped me a lot. Please keep up your good work. We are always with you and Waiting for your new interesting articles. Visit also Dansk marketing bureau

    ReplyDelete
  37. This is very informative and interesting for me. thank you for such a wonderful post and for sharing. God bless you. we also provide service. Cost Effective Monitors for Programming for more info visit our website.

    ReplyDelete
  38. This is a very interesting post. Your information related faster 3d GPU rendering service in North America is very important to me. Thanks for sharing.

    ReplyDelete
  39. I learned some very valuable information from this article. After reading it, I believe you have a solid knowledge base. education resources for teachers Thank you for letting me know. Continue your amazing work.

    ReplyDelete
  40. Amazing post, thanks for sharing such an informative article. The information provided in the article is among the most beneficial. website development firm tampa We appreciate you sharing it with us.

    ReplyDelete
  41. I read the above article and got some knowledge from your article which is about for us. It's actually great and useful data for us. Cantonese Lessons Hong Kong Thanks for sharing it.

    ReplyDelete
  42. This comment has been removed by the author.

    ReplyDelete
  43. Very interesting, you have done a good job and thanks for sharing such a good blog. customized erp software in chennai

    ReplyDelete
  44. I really enjoyed reading your blog post about software architecture and web development. I found it interesting that you mentioned an attacker needs to identify a server's HTTP headers in order to find security holes. I'm glad you shared this information with the community. Learn ASP.NET

    ReplyDelete
  45. This post is Awesome. It’s helped me a lot. Please keep up your good work. We are always with you and Waiting for your new interesting articles. Visit also Credit Repair Consultant

    ReplyDelete
  46. I like this post. I was searching about Humanoid Robots For Rental over search engines and found your post and it really helps thank you very much.

    ReplyDelete
  47. This content is fantastic because it provides some excellent information that will prove quite helpful to me in the future. Thanks for sharing this Shopify developer. Please continue to uphold.

    ReplyDelete
  48. I am looking at some of your posts on this website and I think this website is really instructive! Keep it up. Visit also Npdes Permit Analysis Service USA thank you

    ReplyDelete
  49. I am glad to read this post, it's a good one. Best erp software in chennai

    ReplyDelete
  50. You have shared a great article Australia Cyber Security Centre because it provides a wealth of information that is exceptionally useful to me. Thank you for sharing that. Please continue to write.

    ReplyDelete
  51. Throughout this post learn hacking and cyber security, it provides me with some excellent information. The material you presented during this write-up was very useful. Keep posting.

    ReplyDelete
  52. If you're searching for the best urologist in Chennai, look no further than Curi Hospital. Our team of highly skilled and experienced urologist doctors in Chennai provides comprehensive care for a range of urological conditions. As the best urologist hospital in Chennai, we are committed to providing the latest and most effective prostate cancer treatments, with the support of our top-notch oncologist.

    ReplyDelete
  53. Clan Muir tartan Pattern skillfully blend history and art, giving a classic elegance to many types of creations.

    ReplyDelete

Post a Comment

Popular posts from this blog

API Gateway in a Nutshell

Building Simple API Gateways with Ocelot and ASP.net Core

API Gateway: Response Aggregation with Ocelot and ASP.net Core