ASP.NET版本泄露【原理扫描】

最新推荐文章于 2024-05-03 21:52:12 发布

tone1128

最新推荐文章于 2024-05-03 21:52:12 发布

阅读量1.1k

点赞数

分类专栏： web漏洞文章标签： asp.net 服务器后端

本文链接：https://blog.csdn.net/tone1128/article/details/131652131

版权

web漏洞专栏收录该内容

1 篇文章 0 订阅

订阅专栏

如果想屏蔽 Server，X-AspNet-Version，X-AspNetMvc-Version 和 X-Powered-By，需要增加：

<httpProtocol>
  <customerHeaders>
    <remove name="Server" />
    <remove name="X-AspNet-Version" />
    <remove name="X-AspNetMvc-Version" />
    <remove name="X-Powered-By" />
  </customerHeaders>
</httpProtocol>

和

 <system.web> 
    <httpRuntime targetFramework="4.7.2" enableVersionHeader="false" />
  </system.web>

修改之后的web.config:

<?xml version="1.0" encoding="utf-8"?>
<!-- For more information on how to configure your ASP.NET application, please visit
  https://go.microsoft.com/fwlink/?LinkId=301880 -->
<configuration>
  <appSettings>
    <add key="webpages:Version" value="3.0.0.0"/>
  </appSettings>
  <system.web>
    <compilation targetFramework="4.7.2"/>
    <httpRuntime targetFramework="4.7.2" enableVersionHeader="false" />
  </system.web>

   <system.webServer>      
        <httpProtocol>
            <customHeaders>
                <remove name="Server" />
                <remove name="X-AspNet-Version" />
                <remove name="X-AspNetMvc-Version" />
                <remove name="X-Powered-By" />
            </customHeaders>
        </httpProtocol>
        <security>
            <requestFiltering removeServerHeader="true" />
        </security>
    </system.webServer>
</configuration>