WIP – How to harden your Web.Config in ASP. NET application

0) Disable Trace

The trace feature of ASP.NET is one of the most useful tools that you can use to ensure application security by debugging and profiling your Web-based applications. Unfortunately, it is also one of the most useful tools that a hacker can use to attack your Web-based applications if it is left enabled in a production environment.

<configuration>
  <system.web>
    <trace enabled="false" localOnly="true">

1) Disable Debugger

Deploying Web-based applications in debug mode is a very common mistake. Virtually all Web-based applications require some debugging. Visual Studio 2005 will even automatically modify the Web.config file to allow debugging when you start to debug your application.

<configuration>
  <system.web>
    <compilation debug="false" targetFramework="4.6.1"/>

2) Deployment retail

If you want to be really confident your stack traces are not going to bubble up to the user, just set the machine.config of the server to retail mode inside the system.web element. This prevent applications running if debug=true.

<configuration>
  <system.web>
     <deployment retail="true"/>

3) Cookies Accessible through Client-Side Script

Any cookie marked with this property will be accessible only from server-side code, and not to any client-side scripting code like JavaScript or VBScript

<configuration>
  <system.web>
    <httpCookies httpOnlyCookies="true"/>

4) EnableRequest Validation, Event Validation, Sesison State and ViewStateMac

• validateRequest : enable the Request validation which is performed by comparing all input data to a list of potentially dangerous values;
• enableEventValidation – when the EnableEventValidation property is set to true, ASP.NET validates that a control event originated from the user interface that was rendered by that control. A control registers its events during rendering and then validates the events during postback or callback handling. For example, if a list control includes options numbered 1, 2, or 3 when the page is rendered, and if a postback request is received specifying option number 4, ASP.NET raises an exception.
• enableSessionState : Enable session in application, never manage the session yourself, this should use the ASP.NET Session State
• enableViewStateMac : A view-state MAC is an encrypted version of the hidden variable that a page’s view state is persisted to when the page is sent to the browser. When this property is set to true, the encrypted view state is checked to verify that it has not been tampered with on the client.

<configuration>
  <system.web>
    <pages validateRequest="true" enableEventValidation="true" enableSessionState="true" enableViewStateMac="true" controlRenderingCompatibilityVersion="4.0"/>

5) Cookieless Session State Enabled and Renamed Session’s cookie name

In the initial 1.0 release of ASP.NET, you had no choice about how to transmit the session token between requests when your Web application needed to maintain session state: it was always stored in a cookie. Unfortunately, this meant that users who would not accept cookies could not use your application. So, in ASP.NET 1.1, Microsoft added support for cookieless session tokens via the use of the “cookieless” setting.

<configuration>
  <system.web>
    <sessionState cookieless="UseCookies" cookieName="s" />

6) Disable ASP.NET version HTTP header and Validation Mode 4

enableVersionHeader – ASP Net version from HTTP header
requestValidationMode – There are enhancements added to request validation starting with ASP.NET 4.5 that include deferred (“lazy”) validation, the ability to opt-out at the server control level, and the ability to access unvalidated data. In order to leverage these enhancements you will need to ensure that requestValidationMode has been set to “4.5”
file : Web.Config

<configuration>
  <system.web>
    <httpRuntime enableVersionHeader="false" requestValidationMode="4.5" />

7) Remove unwanted http headers

This will makes more difficult to retrieve information about server
file : Web.Config

<system.webServer>
  <httpProtocol>
      <customHeaders>
        <remove name="Server" />
        <remove name="X-Powered-By" />
        <remove name="X-AspNet-Version" />
        <remove name="X-AspNetMvc-Version" />
      </customHeaders>
    </httpProtocol>
</system.webServer>

8 ) HTTP error handling

Instead of specific error page, create a default error page when redirect all the error that occurs :
file : error-handler.aspx

<div>
 <h1>An Error has occurred</h1>
</div>

Then customize http errors from web.config.
file : Web.config

<configuration>
<system.webServer>
  <httpErrors errorMode="Custom">
    <remove statusCode="502" subStatusCode="-1" />
    <remove statusCode="501" subStatusCode="-1" />
    <remove statusCode="500" subStatusCode="-1" />
    <remove statusCode="412" subStatusCode="-1" />
    <remove statusCode="406" subStatusCode="-1" />
    <remove statusCode="405" subStatusCode="-1" />
    <remove statusCode="404" subStatusCode="-1" />
    <remove statusCode="403" subStatusCode="-1" />
    <remove statusCode="401" subStatusCode="-1" />
    <remove statusCode="400" subStatusCode="-1" />

    <error statusCode="400" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="401" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="402" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="403" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="404" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="405" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="406" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="412" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="500" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="501" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
    <error statusCode="502" subStatusCode="-1" path="/error-handler.aspx" prefixLanguageFilePath="" responseMode="ExecuteURL" />
  </httpErrors>
</system.webServer>

9) Enable custom error

To avoid the stack trace disclosure. On, Specifies that custom errors are enabled. If no defaultRedirect attribute is specified, users see a generic error. The custom errors are shown to the remote clients and to the local host.

  <system.web>
    <customErrors defaultRedirect="error-handler.aspx" mode="On">
    </customErrors>

10) Encrypt Connection String

Before ASP.NET can decrypt encrypted information in the Web.config file, the identity of your ASP.NET application must have read access to the encryption key that is used to encrypt and decrypt the encrypted sections. This walkthrough uses the default RsaProtectedConfigurationProvider provider that is specified in the Machine.config file and named “RsaProtectedConfigurationProvider”. The RSA key container that is used by the default RsaProtectedConfigurationProvider provider is named “NetFrameworkConfigurationKey”.
Run this from command prompt (Runned as Administrator):

C:UsersIEUser>C:WindowsMicrosoft.NETFrameworkv2.0.50727aspnet_regiis.exe -pa "NetFrameworkConfigurationKey" "MSEDGEWIN10IEUser"
Adding ACL for access to the RSA Key container...
Succeeded!

Then you can Encrypt the connection String.Run this from command prompt (Runned as Administrator):

C:UsersIEUser>C:WindowsMicrosoft.NETFrameworkv2.0.50727aspnet_regiis.exe -pef "connectionStrings" "C:UsersIEUserDesktopSuperSecureBank-MindedSuperSecureBank"
Encrypting configuration section...
Succeeded!

References :

• https://msdn.microsoft.com/en-us/library/bb763179.aspx
• https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/w8h3skw9(v=vs.100)
• https://www.owasp.org/index.php/ASP.NET_Request_Validation
• https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/ms228262(v=vs.100)

Contattaci https://www.intuity.it/cybersecurity-padova-azienda-cyber-security/