IIS Vulnerabilities

[Nanda]

Hi,
Can some please provide me tips on securing the ASP application from the
below vulnerabilities?
· Cross Site Scripting (XSS) Findings
· Cross Site Tracing - Trace Method Enabled
· HTTP Header CRLF Injection (HTTP Response Splitting)

I know that these can be handled on the code level, but since the
application I am working on is a huge and old one, it would be difficult to
start fixing these vulnerabilities at code level. Can anyone suggest me
something like the "ValidateRequest" or handling user Request object at
Global.asax just like in the DotNet world?

Thanks in advance

 

[Bob Barrows [MVP]]

Hi,
Can some please provide me tips on securing the ASP application from
the below vulnerabilities?
· Cross Site Scripting (XSS) Findings
· Cross Site Tracing - Trace Method Enabled
· HTTP Header CRLF Injection (HTTP Response Splitting)

I know that these can be handled on the code level, but since the
application I am working on is a huge and old one, it would be
difficult to start fixing these vulnerabilities at code level. Can
anyone suggest me something like the "ValidateRequest" or handling
user Request object at Global.asax just like in the DotNet world?

There is nothing like that in classic asp. You will need to attack these
things at the code level. Do a google search on these terms and start
reading.

 

[Nanda]

Hi Bob,

Thanks a lot for the reply. However, as I said the application is huge and
there are many applications that have been running from years together. If I
start modifying the code at this point of time it will surely make things
worse. Does the installation of IIS Lockdown Tool and URL Scan help me in
doing this job?

Thanks,
Nanda

 

[Bob Barrows [MVP]]

Sorry, no, AFAIK, those tools fix other things*. There is no magic bullet.

I'm not so sure things will be made "worse". Many of the coding practices
that make sites vulnerable to these exploits are programming shortcuts that,
while they do help get sites up and running quicker, actually lead to less
efficient, less robust applications.

I believe you're just going to have to bite the bullet on this one.

*I may be wrong about this, so you should get the opinions of the experts
over at .inetserver.iis. If I am wrong, don't be shy about letting me know.
I don't want to be giving bad advice.

Bob Barrows