Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know how to check this setting in code, and I know where to look in the web.config, but I can't seem to find information on how a vulnerability scanner like Qualys would detect this.

I've considered the following, but I have no way of knowing if my guesses are any good:

  • Is there an http header that is sent from the web server when Debug=true?
  • Is the scanner/software intentionally causing an error and detecting debug information reflected back to the client?
  • Is the software looking for long-running requests (since debug mode effectively lengthens response times before a timeout occurs)?
share|improve this question
    
I don't think that is true. See my answer. –  Abe Miessler Oct 1 '13 at 19:44
    
@AbeMiessler I stand corrected :) –  NULLZ Oct 2 '13 at 0:16
add comment

1 Answer

up vote 5 down vote accepted

Setting the debug attribute will not result in a different error page. Custom error pages are handled in the web.config in the configuration/system.web/customErrors node. Some info.

One possibility is that the scanner is detecting this by looking at the Cache-Control http header. This header will return private when you are in debug mode and public when you are not. There is a good article that goes into some of this which can be found here.

A more likely possibility is that they are making a DEBUG request to the site and checking to see wether it is returning 200 or 403. There is a good SO post on this here.

While having the debug attribute set to true can cause performance problems, it's not the only thing that can cause performance problems, so it seems like using this method would generate a lot of false positives.

share|improve this answer
    
Thank you. That is quite helpful! –  David Stratton Oct 1 '13 at 21:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.