IIS 7 Header Block Module - Released

Context Information Security have released a module for IIS 7 to block information leakage from HTTP headers. A standard web application penetration test recommends the removal of any version number information. Previously the IIS urlscan tool could be used to block this information, however, for IIS 7 this is no longer possible, therefore Context have released this module to block this information.

HTTP headers are name/value sets of data that are transmitted between the client (web browser) and the web server. HTTP headers are used to transmit key data such as HTTP cookies.

Excessive HTTP headers can aid an attacker by either identifying particular technologies used within a web application or presenting specific software version information. Whilst minimising the attack surface by preventing information leakage is not a panacea it is a step towards improving security.

With the introduction of new Microsoft frameworks such as ASP.Net and MVC it appears that the number of HTTP headers returned by the IIS web server is increasing. An example of these headers is shown below:

Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 2.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET

The commonly recommended method for removing HTTP headers within a Microsoft environment involves a combination of URLScan, application web.config changes and changes via the IIS Manager application. However, this is not convenient for large scale infrastructures and it should also be noted that the Server header cannot be removed by any of these methods for IIS 7. With the increased popularity of the Microsoft IIS7 web server, it is important that specific security recommendations can be applied to the latest web server technologies.

HeaderBlock is a .Net module that presents an easy way to remove key HTTP headers before they are transmitted from the web server to the client. The module will block the Server, X-AspNet-Version
and X-AspNetMvc-Version headers.

The module comes in both binary and source formats so the code can be modified by the user if required.

Download from: http://www.contextis.co.uk/resources/tools/headerblock/

This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.


Relevant Pages

  • Re: AVG7 update 23/11/2005 (267.13.6/179)
    ... >> here but ta muchly kind sir. ... the HTTP Headers of the File, so you could know when it was made ... You can use that .VBS Script to check the Headers of *any* File, ... from any Web Server, not just the AdAware Ref Update thing that ...
  • Re: How do I do full access logging including HTTP headers?
    ... script that can do full logging of all the HTTP headers for each hit. ... Logging can only be done by the tool, that is performing the action. ... therefore the web server must log its own action. ...
  • Re: How do I do full access logging including HTTP headers?
    ... can do full logging of all the HTTP headers for each hit. ... choses to put into the %ENV hash. ... to change the web server behavior to get at that data. ...
  • Re: Accented letters
    ... HTTP headers, HTTP headers will usually be present to override them, ... so they confuse more than they assist. ... They will be present if the web server serves only documents in one ... encoding, if the web server has a way to determine the encoding ...