SCG WF ASPNET - Revision history

Alexander Antukh: /* Debug mode misconfiguration */

2015-03-10T12:55:18Z

‎Debug mode misconfiguration

2015-03-10T12:54:02Z

‎Remediation

2015-03-10T12:51:35Z

‎Remediation

2015-03-10T12:51:17Z

‎Request validation misconfiguration

2015-03-10T12:50:49Z

‎ViewState Encryption misconfiguration

2015-03-10T12:50:06Z

‎View state MAC misconfiguration

2015-03-10T12:49:12Z

‎Remediation

2015-03-10T12:48:52Z

‎Remediation

2015-03-10T12:48:07Z

‎Remediation

2015-03-10T12:47:46Z

‎Remediation

@@ Line 258: / Line 258: @@
 ==== How to test ====
-# Make a request http://[target]/<random_page>.aspx
+# Make a request
 # Another way is if Page receive param (like ID) you can duplicate this param in request ID=1&ID=1. That will cause framework to show error page.
@@ Line 267: / Line 268: @@
 ==== Remediation ====
 Turn off Debug Mode in web.config
-<compilation debug="false" />
+ <compilation debug="false" />
 ----

@@ Line 243: / Line 243: @@
 ==== Remediation ====
 Turn on EventValidation in web.config.
 <configuration>
    <system.web>
@@ Line 249: / Line 250: @@
 <configuration>
    <system.web>
-     <machineKey validation="AES" validationKey="AutoGenerate,IsolateApps" />
+     <machineKey validation="AES" validationKey="AutoGenerate,IsolateApps" /></nowiki>
 === Debug mode misconfiguration ===
 ==== Description ====

@@ Line 226: / Line 226: @@
 ==== Remediation ====
 Turn on RequestValidation in web.config.
-<nowiki>
+ <nowiki>
 <configuration>
    <system.web>

@@ Line 226: / Line 226: @@
 ==== Remediation ====
 Turn on RequestValidation in web.config.
 <configuration>
    <system.web>
-     <pages validateRequest="true" />
+     <pages validateRequest="true" /></nowiki>
 ----

@@ Line 201: / Line 201: @@
 Inside web page source code find __VIEWSTATE param, decode its value with base64. Check if it can be decoded from base64. If not then its encrypted.
-Example: <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="..." />
+Example:
 ==== Remediation ====
 Configure following options inside web.config.
 <machineKey validationKey="AutoGenerate,IsolateApps"  decryptionKey="AutoGenerate,IsolateApps" validation="HMACSHA256"
    decryption="AES" />
@@ Line 210: / Line 212: @@
 <system.web>
    <pages viewStateEncryptionMode="Auto" />
-</system.web>
+</system.web></nowiki>
 ----

@@ Line 82: / Line 82: @@
       <section name="security" requirePermission="false" type="Elmah.SecuritySectionHandler, Elmah" />
    </sectionGroup>
-</configSections>
+</configSections></nowiki>
 There's a default section group named elmah which contains custom configuration sections to tune several aspects concerning security.

@@ Line 163: / Line 163: @@
 inside Web.config:
 <system.webServer>
 <httpProtocol>
@@ Line 169: / Line 170: @@
      </customHeaders>
    </httpProtocol>
-</system.webServer>
+</system.webServer></nowiki>
 ----

@@ Line 145: / Line 145: @@
 ==== Remediation ====
 The "secure" flag should always be set to ensure that cookie values can't be exposed over unprotected communication.
-<httpCookies requireSSL="true" />
+ <httpCookies requireSSL="true" />
 ----

@@ Line 131: / Line 131: @@
 Unless the cookie legitimately needs to be read by JavaScript on the client, the "HttpOnly" flag should always be set to ensure it cannot be read by the client and used in an XSS attack.
-<httpCookies httpOnlyCookies="true" />
+ <httpCookies httpOnlyCookies="true" />
 ----