Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this:

Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319

can be used to determine whether the server is missing any patches?

If yes, is there a good resource available to map these version identifiers to patch levels?


No, these headers don't say anything about the server itself, only that it's running Windows (Because of the IIS).

The other two headers are the .Net and MVC framework version, which both are respective to the application running in the IIS.

You can find more information about those headers and how to remove them here.

  • 1
    Thanks! Yeah my issue is that Googling for this I only find references to how to switch off these headers. :) But I'm looking to determine whether there's an actual vulnerability there. – Mark Koek Apr 26 '16 at 15:25
  • @MarkKoek Hit it with a vulnerability scanner.. If you're authorized to do so. – HashHazard Apr 26 '16 at 15:46
  • All I get are generic issues about version number disclosure. I suspect vulnerability scanners don't look at this - maybe I should try setting up a server that sends a fake version header and see how vuln scanners respond... – Mark Koek Apr 29 '16 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.