[Go] Detect common ASP. NET Configuration security vulnerabilities

See a foreign MVP Troy Hunt article: 67% of the ASP. Websites has serious configuration related security vulnerabilities, to the effect of the statistics he collects , about 67% of the ASP. NET site is misconfigured and has a security risk.

Troy Hunt The analysis of the article came from a simple website scan service--asafaweb He developed, automated Security Analyser for ASP. Users who provide url,asafaweb that expose an ASP. NET site on the Internet will issue several request checks to see if there are some common security vulnerabilities.

The site records scanned from this January-March, excluding the Asafaweb test site and the non-ASP. NET site after a total of 7,184 test results, Hunt to make simple statistics. Although I think this result is the user actively provide the site for testing, and even can not exclude users will deliberately create a problem situation test asafaweb inspection effect, so the data may not be able to accurately reflect the actual situation, but still very valuable reference, it is worth our concern about ASP. NET has a common configuration vulnerability, it is absolutely a good thing to make sure that you know and check if there is a similar situation on the site at hand.

The following are common ASP. NET configuration security vulnerabilities listed in Hunt:

1. Error message not hidden
   Developers often will <customerrors mode= "Off"/> Convenient troubleshooting, but formally on-line but forget to remove, resulting in the program error, the relevant program code details and even the program fragments are shown naked. The hacker may find the relevant file location, database information, component version ... Information, and provide guidelines for intrusion.
2. Close Request Validation
   According to Hunt's statistics, nearly 30% of the site was heroic to close the entire station Request verification. If there is a need, it is good to close the page, at least the damage surface is smaller, but if the heart force, avoid this restriction to keep the door closed or the best policy.
3. Windows/iis not updated
   At the end of last year, the HTTP POST Hash DoS Vulnerability was uncovered, and the attacker could use a simple Request to get the site busy and end up in service paralysis. Microsoft has issued a fix in February, but it seems that 50% of the sites are not yet complete.
4. ELMAH Access Not set limit
   About the risk of ELMAH access settings before there is also the article "Uncle's Notes (18): The use of ELMAH and Google experience an invasion of pleasure" mentioned, a little careless, the secret of the program will be broadcast, very dangerous, even hackers may also be forged ASP. Pretty scary.
5. Trace not closed
   Although the proportion is not high, but through the Trace.axd hacker still can collect a lot of important information, online to the formal environment remember to close.

[Go] Detect common ASP. NET Configuration security vulnerabilities