Security: HTTP headers that expose web application / server vulnerabilities
Today's blog post will cover how ASP.net response HTTP headers can expose security holes in your web application and servers. The post will also contain steps on how to remove this headers and mitigate chances of getting attacked using C# and ASP.net MVC.
Problem
When an attacker performs an attack on a web server, the first thing he /she needs to do is to identify the profile of his target. To profile a target web application / server, an attacker would have to perform the following steps:
- Identify the address of the web application.
- Identify the OS where the web application resides
- Identify the type of server (IIS, Apache, etc) that was hosting the web application
- Identify the frameworks (ASP.net MVC, PHP, JSF) used by the applications
After an attacker gathers the following information, the attacker would proceed on using penetration tools (Kali's Metasploit and Websploit) to perform different kinds of attacks to disrupt the target which could mean:
- Defacing the application
- Performing denial of service attacks
- Disabling of web server itself
- Kidnapping of database server for ransom
ASP.NET MVC Solution Github
One way to delay an attacker from executing an attack on your server is to remove HTTP headers that identify IIS and ASP.net powered applications. Below are the list of HTTP headers that needs to be removed from your applications response headers:
- Server
- X-AspNetMvc-Version
- X-AspNet-Version
- X-Powered-By
These HTTP headers can be removed by configuring an IIS server manually. This approach is OK but infeasible because the most common cause of an attack to a web server is scaling (Adding of servers / load balancers in a web farm) without configuring the additional machine. Sometimes, IT people in-charge of configuring newly added server nodes forget to disable the inclusion of these headers to the application's response objects. To make things worst, newbies are clueless with the existence of these headers. As responsible developers, we find this annoying and simply unacceptable.
To prevent hackers from retrieving HTTP server information headers, we can implement a class that would strip all these headers from all the responses emitted by an ASP.net application. The class below does the trick:
Clone it from Github
using System.Collections.Generic; using System.Linq; using System.Web; namespace ServerIdentityHttpHeaderStripping { /// <summary> /// Class that implements methods used for /// stripping out HTTP response headers. /// </summary> public class ServerIdentityStripper { #region Public Methods /// <summary> /// Method that strips out HTTP response headers /// from response. /// execution. /// </summary> /// <param name="context"> /// Http context associated with the response /// that would be stripped of server identity /// headers. /// </param> public void Execute(HttpContext context) { var serverHeaders = GetServerIdentityHeaders(); StripServerHeaders(context.Response, serverHeaders); } #endregion #region Private Methods private bool CheckIfHttpHeaderExists(HttpResponse response, string header) { return response.Headers .AllKeys .Any(k => k == header); } private List<string> GetServerIdentityHeaders() { return new List<string> { "Server", "X-AspNetMvc-Version", "X-AspNet-Version" }; } private void StripServerHeaders(HttpResponse response, List<string> headers) { foreach (var header in headers) { if (CheckIfHttpHeaderExists(response, header)) response.Headers.Remove(header); } } #endregion } }
You also have to add the following code on Global.Asax's Application_EndRequest event.
protected void Application_EndRequest() { var stripper = new ServerIdentityStripper(); stripper.Execute(HttpContext.Current); }
X-Powered-By
Unfortunately, the class can strip all necessary headers except for the "X-Powered-By" header. This happens because IIS is the one that attaches this HTTP header after the application release the response object. To ensure that this HTTP header would be removed from your server's response headers. You can add the configuration below on your application's web.config file.
<system.webServer> <httpProtocol> <customHeaders> <remove name="X-Powered-By" /> </customHeaders> </httpProtocol> </system.webServer>
Result
Way cool! Some extremely valid points! I appreciate you writing this post plus the rest of the site is also press very good.
ReplyDeleteI enjoyed over read your blog post. This was actually what i was looking for and i am glad to came here!
ReplyDeleteWebsite: Antique jewellery wholesale
Amazing Article,Really useful information to all So, I hope you will share more information to be check and share here.thanks for sharing .
ReplyDeleteWebsite: Vietnam Adventure Tours
Great blog! Thank you so much for sharing this pretty article, This blog is so good to read.
ReplyDeletehow to learn java programming
cross platform app development
best social media campaigns
what is cloud service in azure
interview questions on tableau
it is really a great and helpful piece of info. I am glad that you shared this helpful information with us. Please keep us informed like this. Thank you for sharing.
ReplyDeleteWebsite: Punjab state lottery
I am really enjoying reading your well written articles. I think you spend numerous effort and time updating your blog.
ReplyDeleteonline electronics shopping sites in india
I always like to read a quality content having accurate information regarding the subject and the same thing I found in this post.
ReplyDeleteWebsite : Website Development Company |
Great information, i was searching of this kind of information, thank you very much for sharing with us.
ReplyDeleteWebsite :
Craigslist Posting Service for Car Dealers |
This is really amazing website that I have been found on google regarding website Blog Commenting sites. and I would like to thank admin who also given us to post the link on his side.
ReplyDeleteWebsite : Lubbock moving company |
This was something I was looking for, really helpful, and great work is done. Thank you so much for sharing such valuable information.
ReplyDeleteWebsite : Car Auction Software |
It’s really a cool and helpful piece of information. I am glad that you shared this useful information with us. Please keep us up to date like this. Thanks for sharing.
ReplyDeleteWebsite : Best CRM for Small Businesses |
Fabulous blog with lots of information. I am glad to visit this, waiting for more updates.
ReplyDeleteWeb Development Course in Chennai
Home Security Systems, This particular is usually apparently essential and moreover outstanding truth along with for sure fair-minded and moreover admittedly useful My business is looking to find in advance designed for this specific useful stuffs…
ReplyDeleteSexologist in chennai
ReplyDeleteSexologist doctor in chennai
Andrologist in chennai
spend your time with our hot Escorts in Mumbai
ReplyDeleteBest blog with effective information’s..!! Useful Information..!!!
ReplyDeleteswift developer training in chennai
Cyber security course fees in chennai
Testing Courses in Chennai
Artificial intelligence training in chennai
Full stack developer training in chennai
Best Graphic Design courses in Chennai
Thank you for sharing. Excellent post...! It is a very great idea and unique content. Thank you so much.
ReplyDeleteMalaysia passport renewal
Useful Information..!!! Best blog with effective information’s..!!
ReplyDeleteRPA course in Chennai
Android Course in Chennai
Angularjs course in Chennai
.net coaching centre in chennai
Hacking Course in Chennai
Digital Marketing Training in Chennai
I recently came across your blog and have been reading along. I thought I would leave my first comment. I don’t know what to say except that I have enjoyed reading.
ReplyDeleteWebsite: metal roofing company near me
Thank you for sharing. Excellent post...! It is a very great idea and unique content. Thank you so much.
ReplyDeletefirst copy mens watch omega
I am very glad to here it is very good post. Thanks for sharing
ReplyDeleteWebsite: Dear lotteries
Thanks for sharing this blog with required contents.
ReplyDeleteAWS Certification in Chennai
Best AWS Training in Bangalore
I read this article fully on the topic of the difference of most up-to-date and earlier technologies, it’s awesome article.
ReplyDeleteWebsite: online renew passport malaysia
ReplyDeleteAmazing Post. keep update more information.
Graphic Design Courses in Bangalore
Graphic Design Courses in Pune
Graphic Design Courses in Hyderabad
Excellent Information! your Blog is very intersting
ReplyDeleteBig Data training and placement in chennai
Hadoop Training in Chennai
Great post. keep sharing such a worthy information
ReplyDeleteswift training in bangalore
swift developer training in chennai
swift developer course in chennai
Great post. keep sharing such a worthy information
ReplyDeleteCloud Computing Training in Chennai
Cloud Training in Chennai
Great post. keep sharing such a worthy information
ReplyDeleteswift training in bangalore
swift developer training in chennai
Great post. keep sharing such a worthy information
ReplyDeleteDevOps Training in Chennai
DevOps Training in Bangalore
Great post. keep sharing such a worthy information
ReplyDeleteDigital Marketing Course in Chennai
Best digital marketing course online
Digital Marketing Courses in Bangalore
Great post. keep sharing such a worthy information
ReplyDeletePython Training in Chennai
Python Training in Bangalore
Great post. keep sharing such a worthy information
ReplyDeleteAWS Training in Chennai
AWS Training in Bangalore
Good Blog!! Keep sharing...
ReplyDeleteSEO Training in Bangalore
SEO Course in Bangalore
SEO Training Institute in Chennai
SEO Classes in Chennai
Best SEO Training in Chennai
Great article! This is the type of information that are meant to
ReplyDeletebe shared across the internet. Thank you for sharing such a useful post. Very Interesting Post! I regularly follow this kind of Blog.
scottishkiltcollection
Great post. keep sharing such a worthy information
ReplyDeletePython Training in Chennai
Python Training in Bangalore
Great post. keep sharing such a worthy information
ReplyDeleteDigital Marketing Training in Chennai
Digital marketing online course
Great post. keep sharing such a worthy information
ReplyDeleteDevOps course in Chennai
DevOps Course in Bangalore
Nice info!
ReplyDeleteCloud Computing Training in Chennai
Cloud Training in Chennai
Nice info!
ReplyDeleteRPA course in Chennai
Rpa training online
You are sharing excellent information.
ReplyDeleteSMO Company in Chennai
google adwords company in Chennai
google adwords Services company in Chennai
Thank you for providing the community with useful information. get best best website development services By Experienced Developer.
ReplyDeletewhite label website builder
no deposit bonus forex 2021 - takipƧi satın al - takipƧi satın al - takipƧi satın al - tiktok takipƧi satın al - instagram beÄeni satın al - instagram beÄeni satın al - google haritalara yer ekleme - btcturk güvenilir mi - izlenme-satin-al.com - numarasmsonay.com - borsagazete.com - takipcisatinals.com - izlenme-satin-al.com/youtube - google haritalara yer ekleme - altyapısız internet - mikrofiber havlu - forexbonus2020.com - tiktok jeton hilesi - tiktok beÄeni satın al - microsoft word ücretsiz indir - misli apk indir - binance güvenilir mi - takipƧi satın al - mikrofiber havlu - uc satın al - takipƧi satın al - takipƧi satın al - finanspedia.com
ReplyDeleteCan someone Take My Online Class For Me? Yes, we’ve been helping students since 2010. The process of taking a class at our end is so very easy and quick. Hire our experts to Take My Online Class on your behalf and get guaranteed A grade. Don't hesitate to contact us to get the best online class experts.
ReplyDeleteTake My Online Class
Though we are a small company yet we truly believe in quality. All the products which we sell are premium quality triple AAA swiss replica first copy with all necessary markings in it and lowest price guaranteed always. Be aware of poor quality watch sellers who sell poor watches at much lower rates. Also, we are the stockist of premium triple AAA quality Swiss replica watches . Be aware of zero stock seller.
ReplyDeleteomega watch price in india
takipƧi satın al
ReplyDeletetakipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
takipƧi satın al
instagram takipƧi satın al
instagram takipƧi satın al
takipƧi satın al
takipƧi satın al
instagram takipƧi satın al
instagram takipƧi satın al
instagram takipƧi satın al
instagram takipƧi satın al
takipƧi satın al
instagram takipƧi satın al
Great post. keep sharing such a worthy information
ReplyDeleteAndroid Training in Chennai
Android Training in Bangalore
some points are extremely valid.
ReplyDeleteWeb Development Easy With AngularJS
This comment has been removed by the author.
ReplyDeleteNeed fence repair and staining services? We are reputed fence Repair Company that offers wide range of affordable fence replacement, fence repair and installation and much more!
ReplyDeleteresidential fence specialist Frisco
takipƧi satın al
ReplyDeletetakipƧi satın al
takipƧi satın al
ReplyDeleteGreat article! This is the type of information that are meant to
be shared across the internet. Thank you for sharing such a useful post. Nice post ! I love its your site after reading ! thanks for sharing.
professional graphic installation
Great article! This is the type of information that are meant to
ReplyDeletebe shared across the internet. Thank you for sharing such a useful post. Nice post ! I love its your site after reading ! thanks for sharing.
Water heater service in Nagpur
Great article! This is the type of information that are meant to
ReplyDeletebe shared across the internet. Thank you for sharing such a useful post. Nice post ! I love its your site after reading ! thanks for sharing.
Website: eligibility for gmat
This is so helpful to me. Keep updating more articles.
ReplyDeleteUbs accounting
Myob Singapore
Best Accounting software Singapore
Need fence repair and staining services? We are reputed fence Repair Company that offers wide range of affordable fence replacement, fence repair and installation and much more!
ReplyDeletefence replacement in mckinney tx
I am very happy to have seen your website and hope you have so many entertaining times reading here. Thanks for all the details. Nice Post thanks for the information, good information & very helpful for others. you sharing such a useful post. Very Interesting Post! I regularly follow this kind of Blog.
ReplyDeleteWebsite: milan kalyan satta matka
Riverside Chevrolet is one of the best Used Car Dealers Peoria Il. Visit our website and check out our inventory of new and used vehicles. We are your one-stop shop for all your automobile needs.
ReplyDeleteVisit here - Used Car Dealers Peoria Il
Thanks for Sharing this Valuable Information with us: this is very useful for me. Keep it Up. Trending Blogs India 2021, Most Popular Blog Topics India 2021, Trending Topics in India 2021
ReplyDeleteVisit here - viral news india
Thanks for Sharing..Keep Update…
ReplyDeleteWeb Hosting is the process of buying space for a website on the World Wide Web.
What is Web Hosting
Web Hosting for Beginners
Very nice post. I just came across your blog and want to say that I really enjoyed browsing your blog posts. Getting a Turkey evisa from Turkey used to be one of the most difficult tasks for travelers, but now you can get a Turkey e visa online.
ReplyDeleteGreat blog! This is really helpful for my reference. Do share more such posts and keep us updated. Looking forward to more informative blogs from you.
ReplyDeleteCloud Computing Training in Chennai
Cloud Computing Online Course
Cloud Computing Training in Coimbatore
ReplyDeleteMore impressive Blog!!! Its more useful for us...Thanks for sharing with us...
Why is Big Data Important?
Why Big Data
This comment has been removed by the author.
ReplyDeleteGreat Blog with Good Information.
ReplyDeletePHP Certification Online
PHP Training in Chennai
PHP Training in Bangalore
Nice Blog, it is very Impressive.keep sharing good information with us.
ReplyDeleteSwift Online Course
Swift Developer Certification Training in Chennai
Swift Developer Training in Bangalore
Great work.. Thanks for this post. Foreign travelers who wish to apply for Azerbaijan visa must check the Azerbaijan visa requirement before filling the application.
ReplyDeleteNice Blog, it is very Impressive. keep sharing good information with us.
ReplyDeleteBest Cyber Security Courses Online
Cyber Security Training in Chennai
Cyber Security Training In Bangalore
Great Post!!! Thanks for the data update and waiting for your new updates.
ReplyDeletewhat does .net framework do
do i need .net framework
ReplyDeleteGreat Blog with Good Information. keep sharing with us.
RPA Certification Course
Robotics Process Automation Training in Chennai
Best RPA Training In Bangalore
Great job, this is essential information that is shared by you. This information is meaningful and very important for us to increase our knowledge about it. Always keep sharing this type of information. Thanks once again for sharing it. Information security auditors
ReplyDeleteNice Blog, it is very Impressive. keep sharing good information with us.
ReplyDeleteAWS Online Course
AWS Course in Chennai
AWS Course in Bangalore
Great blog.thanks for sharing such a useful information
ReplyDeletebest german language institute in chennai
Happy to read the informative blog. Thanks for sharing
ReplyDeletebest digital marketing course in chennai
best digital marketing training in chennai
I read your blog now share great information here. Popular Bloggers
ReplyDeleteGandhi Brothers Lottery Group was founded by Mr Manmeet Singh when he was 12 years old and today, it has been developed as a very reputed the well-established business firm of providing secure Lottery of Punjab State Lottery since the last 36 years. It has two Lottery system. Bumper Prizes weekly Prizes. The biggest jackpot hit from the Punjab State Lottery is New Year Bumper 2012 on 19-01-12 amounting Rs.2.00 crore Monthly Lottery Bumper 2012 held on 23-07-12 amounting Rs. 51 Lakhs distributed over prize money. Gandhi Brother’s lottery is Authorized and legal, assuring each player of a fair playing lottery.
ReplyDeleteMonthly lottery
It was a great blog with so much information of the beautiful places to visit.
ReplyDeletePest control provider in Nagpur
This is very useful software for you and me. No errors were found during the check.
ReplyDeleteYou can use it. I hope you like it.
Marketing and Advertising Graphics
Great Article Cyber Security Projects projects for cse Networking Security Projects JavaScript Training in Chennai JavaScript Training in Chennai The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training
ReplyDeleteGreat blog with good information.
ReplyDeleteSwift Online Course
swift developer training in chennai
swift developer training in Bangalore
Thank you for sharing such a useful article. It will be useful to those who are looking for knowledge. Continue to share your knowledge with others through posts like these, and keep posting on
ReplyDeleteBig Data Solutions
Advanced Data Analytics Services
Data Modernization Solutions
AI & ML Service Provider
Money swift gateway
ReplyDeleteMoney swift is best reliable payment gateway in Canada. We have extensive knowledge of payment technologies. Our service is secure and easy way to get paid.
Thank you for sharing such a useful post. Very Interesting Post! I regularly follow this kind of Blog.
ReplyDeleteWebsite Punjab state dear lohri makar sankranti bumper lottery
Thank you for sharing so insightful article. Rozana.in has a far-reaching presence across various cities in India.
ReplyDeleteVisit for more info groceries stores
Hello there, You have done a great job. As we all know how much Bill of Sale being used. This document is usually used for sale and purchase between two parties like Buyer & seller.
ReplyDeleteVisit here IL Bill of sale
Nice post
ReplyDeleteWeb development company
Website Development company in india
ReplyDeleteNice blog, it is very impressive.
Swift Developer Training in chennai
Swift Online Training
Swift Developer Course in Bangalore
This post is so interactive and informative.keep update more information...
ReplyDeleteSoftware testing Training in Velachery
Software testing training in chennai
Impressive content sharing, reading your blog gives me a clear understanding of cyber security. Thanks for sharing valuable information. network security companies in india
ReplyDeleteGreat post. keep sharing such a worthy information.
ReplyDeleteSocial Media Marketing Course in Chennai
Social Media Marketing Online Course
Thanks for a very interesting blog. What else may I get that kind of info written in such a perfect approach? I’ve a undertaking that I am simply now operating on, and I have been at the look out for such info web hosting company
ReplyDeleteThis is very educational content and written well for a change. It's nice to see that some people still understand how to write a quality post! B2B Cyber Security
ReplyDeleteThe content you shared with us is great. Thanks for sharing it. You can apply for an Indian business visa by clicking the link we just provided. Thanks for adding value to the post.
ReplyDeleteMindblowing blog very useful thanks
ReplyDeleteTally Course in Velachery
Tally course in Chennai
These tips may help me in the future about Mobile Manager App For Forex Brokers .
ReplyDeleteI am impressed with your work and skills visit also App development companies UAE .
ReplyDeleteThanks for sharing this valuable information about Domain Registration Usa. I have gone through your post and got meaningful information.
ReplyDeleteThank you for sharing good knowledge and information about dedicated server malaysia. It's very helpful and understanding. as we have been looking for this information for a long time.
ReplyDeleteI am very thankful to you that you have shared this information with us. I got some different kinds of knowledge from your web page, and it is really helpful for everyone. Thanks for sharing it. Read more info about travel portal development cost online
ReplyDeleteIt is truly a practical blog to discover some various resource to include my knowledge. Telstra Business Phone system
ReplyDeleteI always like to read a quality content having accurate information regarding the subject.
ReplyDeletegagner de l'argent sur internet
Perfect post with amazing information and thanks for sharing!!
ReplyDeleteSwift Developer Course in Mumbai
Swift Developer Course in Pune
Swift Developer Course in Gurgaon
Wow, your post is really very useful thanks for sharing about Maintenance Management Software Bahrain. It's really informative. keep sharing more with us.
ReplyDeleteWriting a post is really important for the growth of your websites. Thanks for sharing amazing tips about Buy Hosting with Perfect Money. Following these steps will transform the standard of your post for sure.
ReplyDeleteOutstanding as well as powerful suggestion by the writer of this blog site are truly valuable to me. Brisbane IT Support
ReplyDeleteThank You for Providing Such insightful information. If someone is looking for the Quickbooks Customer Service in US.
ReplyDeleteThanks for a very interesting blog. What else may I get that kind of info written in such a perfect approach about Bluehost Shared Hosting Online Review ? I’ve got an undertaking that I am simply now operating on, and I have been on the lookout for such info.
ReplyDeleteThis post is Awesome. It’s helped me a lot. Please keep up your good work. We are always with you and Waiting for your new interesting articles. Visit also Cloud Vps Hosting Services Provider
ReplyDeleteThis post is Awesome. It’s helped me a lot. Please keep up your good work. We are always with you and Waiting for your new interesting articles. Visit also Dansk marketing bureau
ReplyDeleteGreat Post!!! Thanks for the data update and waiting for your new updates.
ReplyDeleteDOT NET Training in Chennai
Dot net Training Online
Dot Net Training in Coimbatore
This is very informative and interesting for me. thank you for such a wonderful post and for sharing. God bless you. we also provide service. Cost Effective Monitors for Programming for more info visit our website.
ReplyDeleteVisit Quickbooks Customer Service in US and find out QuickBooks is a software that helps you manage your business and track your income and expenses. It also helps you plan for future transactions, which in turn saves you time, money, and effort.
ReplyDeleteHello, I am one of the most impressed people in your article. What is an east Africa tourist visa ? It is a travel document which allows travelers to get entry into the 3 countries.
ReplyDelete1.Kenya, 2. Uganda and 3. Rwanda.
This comment has been removed by the author.
ReplyDeleteThis is a very interesting post. Your information related faster 3d GPU rendering service in North America is very important to me. Thanks for sharing.
ReplyDeleteI learned some very valuable information from this article. After reading it, I believe you have a solid knowledge base. education resources for teachers Thank you for letting me know. Continue your amazing work.
ReplyDeleteAmazing post, thanks for sharing such an informative article. The information provided in the article is among the most beneficial. website development firm tampa We appreciate you sharing it with us.
ReplyDeleteI read the above article and got some knowledge from your article which is about for us. It's actually great and useful data for us. Cantonese Lessons Hong Kong Thanks for sharing it.
ReplyDeleteThis comment has been removed by the author.
ReplyDeleteVery interesting, you have done a good job and thanks for sharing such a good blog. customized erp software in chennai
ReplyDeleteNice
ReplyDeleteI really enjoyed reading your blog post about software architecture and web development. I found it interesting that you mentioned an attacker needs to identify a server's HTTP headers in order to find security holes. I'm glad you shared this information with the community. Learn ASP.NET
ReplyDeleteThis post is Awesome. It’s helped me a lot. Please keep up your good work. We are always with you and Waiting for your new interesting articles. Visit also Credit Repair Consultant
ReplyDeleteI like this post. I was searching about Humanoid Robots For Rental over search engines and found your post and it really helps thank you very much.
ReplyDeleteThis content is fantastic because it provides some excellent information that will prove quite helpful to me in the future. Thanks for sharing this Shopify developer. Please continue to uphold.
ReplyDeleteI am looking at some of your posts on this website and I think this website is really instructive! Keep it up. Visit also Npdes Permit Analysis Service USA thank you
ReplyDeleteThis is great content for your readers. Thanks for sharing.
ReplyDeleteGaleón Delrin Pratten Irish Flute 3 piece Tunable
I am glad to read this post, it's a good one. Best erp software in chennai
ReplyDeleteYou have shared a great article Australia Cyber Security Centre because it provides a wealth of information that is exceptionally useful to me. Thank you for sharing that. Please continue to write.
ReplyDelete