Improving Web Application Security: Threats and - CGISecurity

804 Improving Web Application Security: Threats and CountermeasuresMasking Content Headers (Banners)To prevent banner information that reveals the type and version of your Web server,locate the RemoveServerHeader attribute in URLScan.ini, and set its value to 1 asshown below.RemoveServerHeader=1PitfallsFor more information, see Microsoft Knowledge Base article, 317741, “How To: MaskIIS Version Information from Network Trace and Telnet.”If you use URLScan, you might run into the following issues:●●●ReferencesURLScan blocks the DEBUG verb which breaks application debugging. If youneed to support debugging, add the DEBUG verb to the [AllowVerbs] section inURLScan.ini.You need to recycle IIS for changes to take effect. URLScan is an ISAPI filter thatruns inside the IIS process (Inetinfo.exe) and URLScan’s options are loaded fromURLScan.ini when IIS starts up. You can run the IISReset command from acommand prompt to recycle IIS.URLScan blocks requests that contain potentially harmful characters, for example,characters that have been used to exploit vulnerabilities in the past such as “.”used for directory traversal. It is not recommended that project paths contain the“.” character. If you must allow this, you need to set AllowDotInPath=1 inURLScan.ini.If your Web application directories include dots in the path, for example, adirectory containing the name “Asp.Net”, then URLScan will reject the requestand a “404 not found” message will be returned to the client.Other characters to avoid in project names because they will be rejected byURLScan include comma (,) and the pound sign (#).For additional information, refer to the following resources:● For more information about how to modify the various sections in Urlscan.ini,refer to Microsoft Knowledge Base article 815155 “How To: Configure URLScan toProtect ASP.NET Web Applications.”● For more information about using URLScan, see http://www.nardware.co.uk/Security/Docs/Nmsurlscan.html.● For more information about URLScan 2.5, refer to Microsoft Knowledge Basearticle 307608, “INFO: Availability of URLScan Version 2.5 Security Tool.”