10 security vulnerabilities in. Net configuration files

Application in ASP. NETProgramDuring deployment in the production environment, check whether the following 10 incorrect configurations exist in the web. config file, which may cause security vulnerabilities:

 

1. Disabling custom errors

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Custom mode = "off"> <customerrors mode = "remoteonly">

 

2. Leaving tracing enabled

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Trace enabled = "true" <trace enabled = "false"

Localonly = "false"> localonly = "true">

 

3. enabling debugging

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Compilation DEBUG = "true"> <compilation DEBUG = "false">

 

4. Making cookies accessible through client-side script

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Httpcookies

Httponlycookies = "false"> httponlycookies = "true">

 

5. Enabling cookieless session state

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Sessionstate

Cookieless = "useuri"> cookieless = "usecookies">

 

6. Enabling cookieless Authentication

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Authentication mode = "forms"> <Authentication mode = "forms">

<Forms cookieless = "useuri"> <forms cookieless = "usecookies">

 

7. Failing to require SSL for authentication cookies

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Authentication mode = "forms"> <Authentication mode = "forms">

<Forms requiressl = "false"> <forms requiressl = "true">

 

8. Using Sliding expiration

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Authentication mode = "forms"> <Authentication mode = "forms">

<Forms slidingexpiration = "true"> <forms slidingexpiration = "false">

 

9. Using Non-unique authentication cookies

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Authentication mode = "forms"> <Authentication mode = "forms">

<Forms name = ". aspxauth"> <forms name = "{abcd1234 ...}"

 

10. using hard-coded credentials

Vulnerable: Secure:

<Configuration>

<System. Web> <system. Web>

<Authentication mode = "forms"> <Authentication mode = "forms">

<Forms>

<Credentials>...

...

</Credentials> </Forms>

</Forms>