2

I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like:

/CFIDE/administrator/

and

/muieblackcat/ 

I discovered the first is a scan to try access some cold fusion admin page, and the second is scanning for PHP vunerabilities...

I was calm because I'm using MS stack, but then I know that there are scanners for IIS/ASP.Net Servers.

What measures/tools that I can do/use to defend against that kind of scanner in ASP.Net/IIS stack?

closed as too broad by techraf, Stephane, Serge Ballesta, Xander, Steve Apr 19 '17 at 14:50

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I wonder what this question would look like if you did not take measures against it being so broad... – techraf Apr 18 '17 at 4:37
  • 1
    You want to stop clients from checking to see if certain paths exist in your site? I'm not sure that's possible and still have a site. – schroeder Apr 18 '17 at 7:13
6

The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, outdated, easily vulnerable servers.

You are looking for how to secure it, and that is a really important first step. You can not stop the scans. However, that does not make you vulnerable.

Things you can do:

  • Change the HTTP Server headers
    • This doesnt make you more secure, but you can remove identifying information that makes scanners less effective.
  • Set up a firewall and block non-essential services

    • Windows comes with a firewall. Use it to block all inbound traffic that is not port 80 and 443. This will make scans get less results and reduce your attack surface. If you need to RDP in, open up port 3389 to your own subnet, or a few select IP addresses, but certainly not to the whole internet.
  • Install something that will protect your server from common exploitable attacks, such as XSS, and SQL Injection.

    • You can't block all attacks 100%, but you can install something like ModSecurity that will inspect the data submitted and block/log known attacks.
  • Start logging to a remote server
    • Your server might get compromised. Thats just reality. Have a plan for how you find out what happened, and a plan to restore the server if you need to.
  • The folks who post guides and content at OWASP are the real MVPs. I'm glad the .net cheatsheet helped. – Nik Roby Apr 18 '17 at 19:23
3

You "defend" against them by scanning your sites yourself and remediating any vulnerabilities found.

Yourself could mean running a vulnerability scanner (e.g. Nessus in web mode or Burp Suite) or if you are more concerned, booking a penetration test by an external company.

Web Application Firewalls and Intrusion Prevention Systems can help, but they will simply be making any vulnerabilities harder to find or exploit rather than fixing the root cause.

0

You might want to setup an 'automated scanner trap'. This can be done by creating up a hidden page on your site which includes a hidden form, which will only be found by scanners. Anyone (or anything) posting the web form will have its IP address logged and blocked.

We have an article explaining how to do this - https://www.acunetix.com/blog/articles/block-automated-scanners/

If you go for this option, you need to ensure that whatever you do, you do not block friendly search engine bots. This can be done by configuring robots.txt accordingly

  • 1
    Please disclose your relationship to the links you include. You are an Acunetix employee. – schroeder Apr 19 '17 at 9:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.