Web.config File Detected on Target Web Application
Netsparker detected a possible ASP.NET configuration file (
Depending on the
file, database connection strings, username and passwords, the internal workings, used and referenced libraries and business logic of application might be revealed. With such information, an attacker can mount the following types of attacks:
- Access the database or other data resources. Depending on the privileges of the account obtained, it may be possible to read, update or delete arbitrary data from the database.
- Gain access to password protected administrative mechanisms such as dashboards, management consoles and admin panels, hence gaining full control of the application.
- Develop further attacks by investigating the application configuration.
Actions to Take
- Confirm the
web.config file is actually the web application's
- If it is a real
web.config file, change your configuration to prevent public users from accessing it. If it is not, then remove it from the web server.