Download Netsparker
Pricing
Blog
Contact
Netsparker

ASP.NET Tracing File Trace.axd Detected

Netsparker detected that ASP.NET tracing is enabled and Trace.axd is accessible remotely.

This vulnerability can be used to obtain sensitive data on current sessions.

Impact

ASP.NET's trace feature is a powerful mechanism that helps developers debug and resolve problems in their applications, but it can also be used by attackers to gain information about requests and responses to the application. An attacker can obtain information such as:
  • Session cookies
  • Session state
  • Query string and POST variables
  • Physical path of the requested file
  • Execution time
This means that the attacker can hijack almost every active user's session by using their session details.

Remedy

Apply the following changes on your web.config file to disable ASP.NET tracing:
<System.Web>
     < trace enabled="false" /> 
</System.Web>


Go back to the Complete list of Vulnerability Checks.