Download - Error codes & custom 404s
![Page 1: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/1.jpg)
Application Error Codes & Custom Error Pages
Security Issue, Remediation & Fun
![Page 2: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/2.jpg)
Contents• Introduction
• Security Issue
• Examples
• ASP.NET – Error Codes
• Yellow Screen of Death
• Remediation
• Custom Error Codes
![Page 3: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/3.jpg)
Introduction
• Error Codes are very common during Web Application Security tests
• Often seen as a non-security issue
• Easy to remediate
![Page 4: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/4.jpg)
Security Issue
• Error Codes can unveil a lot of information regarding an Application to an attacker
• This includes:– Databases– Bugs– Server Config
![Page 5: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/5.jpg)
Examples• MySQL Error:
– Microsoft OLE DB Provider for ODBC Drivers (0x80004005) [MySQL][ODBC 3.51 Driver]Unknown MySQL server
• Database Error:– Microsoft OLE DB Provider for ODBC Drivers error '80004005'
[Microsoft][ODBC Access 97 ODBC driver Driver]General error Unable to open registry key 'DriverId‘
• Web Server Error: – Not Found The requested URL /page.html was not found on
this server. Apache/2.2.3 (Unix) mod_ssl/2.2.3 OpenSSL/0.9.7g DAV/2 PHP/5.1.2 Server at localhost Port 80
![Page 6: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/6.jpg)
ASP.NET – Error Codes
• If a user requests a dynamic resource that does not exist (for example, an ASPX file), then the user sees the default server error message generated by ASP.NET for HTTP 404 errors:
![Page 7: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/7.jpg)
• If an unhandled exception occurs in the application, then the user sees the default server error message generated by ASP.NET for HTTP 500 errors:
![Page 8: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/8.jpg)
Yellow Screen of Death
• ASP.NET web application developers call these the "Yellow Screen of Death" (YSOD)
• Similar to this traffic light, Users and Developers are unaware of the risk these errors can have
![Page 9: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/9.jpg)
Remediation
• Add error pages for 404 and 500 error codes from within the application configuration file (web.config)
• This instruct IIS to use the specified custom pages for these error codes
![Page 10: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/10.jpg)
Custom Error Codes
![Page 11: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/11.jpg)
![Page 12: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/12.jpg)
![Page 13: Error codes & custom 404s](https://reader036.vdocuments.mx/reader036/viewer/2022081413/5495a5d5b479594c4d8b4d79/html5/thumbnails/13.jpg)