Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this:

Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319

can be used to determine whether the server is missing any patches?

If yes, is there a good resource available to map these version identifiers to patch levels?

1 Answer 1


No, these headers don't say anything about the server itself, only that it's running Windows (Because of the IIS).

The other two headers are the .Net and MVC framework version, which both are respective to the application running in the IIS.

You can find more information about those headers and how to remove them here.

  • 1
    Thanks! Yeah my issue is that Googling for this I only find references to how to switch off these headers. :) But I'm looking to determine whether there's an actual vulnerability there.
    – Mark Koek
    Commented Apr 26, 2016 at 15:25
  • @MarkKoek Hit it with a vulnerability scanner.. If you're authorized to do so.
    – HashHazard
    Commented Apr 26, 2016 at 15:46
  • All I get are generic issues about version number disclosure. I suspect vulnerability scanners don't look at this - maybe I should try setting up a server that sends a fake version header and see how vuln scanners respond...
    – Mark Koek
    Commented Apr 29, 2016 at 8:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .