Web.config File Detected

Depending on the web.config file, database connection strings, username and passwords, the internal workings, used and referenced libraries and business logic of application might be revealed. With such information, an attacker can mount the following types of attacks:

• Access the database or other data resources. Depending on the privileges of the account obtained, it may be possible to read, update or delete arbitrary data from the database.
• Gain access to password protected administrative mechanisms such as dashboards, management consoles and admin panels, hence gaining full control of the application.
• Develop further attacks by investigating the application configuration.