A potentially dangerous Request.Path - asp.net

Been getting a lot of errors like this lately. I did some research and found that this is because html was detected in the input text. Does this mean that someone is trying to hack my website?
I can stop this from happeneing by turning off page validation, but this hardly seems like a good solution.
Here is some info from one of the errors:
HTTP_CONNECTION:keep-alive HTTP_ACCEPT:*/* HTTP_ACCEPT_ENCODING:gzip, deflate HTTP_ACCEPT_LANGUAGE:en-us HTTP_HOST:www.easymuaythai.com HTTP_REFERER:http://www.google.com/search?q=symbolic+tattoos&hl=en&client=safari&tbo=d&source=lnms&tbm=isch&ei=u5c1T8L-JfLYiAKRs5ixCg&sa=X&oi=mode_link&ct=mode&cd=2&ved=0CAkQ_AUoAQ&biw=1024&bih=622 HTTP_USER_AGENT:Mozilla/5.0 (iPad; CPU OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3
Don't know if it matters, but I have a rule in my IIS to prevent image hotlinking.
Thanks.

Few days ago, while working on an ASP.NET 4.0 Web project, I got an issue. The issue was, when user enters unencoded HTML content into a comment text box s/he got something like the following error message:
"A potentially dangerous Request.Form value was detected from the client".
This was because .NET detected something in the entered text which looked like an HTML statement. Then I got a link Request Validation, that is a feature put in place to protect your application cross site scripting attack and followed accordingly.
To disable request validation, I added the following to the existing "page" directive in that .aspx file.
ValidateRequest="false"
But still I got the same error.
Later I found, for .NET 4, we need to add requestValidationMode="2.0" to the httpRuntime configuration section of the web.config file like the following:
<httpRuntime requestValidationMode="2.0"/>
But if there is no httpRuntime section in the web.config file, then this goes inside the <system.web> section.
If anyone wants to turn off request validation for globally user, the following line in the web.config file within section:
<pages validateRequest="false" />
(source)

First the string you give here seems like some search on google images for two words (symbolic tattoos) and end up to your site. Maybe its false, but the words have do with your site.
99.9% this call is not attack.
Now asp.net by default take care for every input that maybe use for script injection, or render anything on page. But after your familure with this and you know what you must do you can disabled it.
What to do: You can read anything, but write them on page using HtmlEncode, or UrlEncode if you place them on URL, or Attribute Encode if you place this input on attributes. If you import them on SQL then also take care to make your sql queries with parametres.
HotLinking
The image hotlinking just check if the reference come from your site and I do not think that have to do with this error. How ever because this is an image search, maybe the one is click on this google image, the google creates a script to show this image above and this some how is throw an error... hmmm maybe have to do...
Update
I found the link that you give is here Here is what your users come and see from the above reference. From google chrome is not make any error.
This link is found on the above reference link.
http://www.google.com/search?q=symbolic+tattoos&hl=en&client=safari&tbo=d&source=lnms&tbm=isch&ei=u5c1T8L-JfLYiAKRs5ixCg&sa=X&oi=mode_link&ct=mode&cd=2&ved=0CAkQ_AUoAQ&biw=1024&bih=622 HTTP_USER_AGENT:Mozilla/5.0 (iPad; CPU OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3

Related

WebResource.axd not loaded when using latest Google Chrome Browser

I'm having a strange issue:
I can't login at http://maskatel.info/login, when I try to click the login button (the blue button that says Connexion), nothing happens at all.
So I opened up the developer tools in Chrome (f12) and saw the following JavaScript error every time I click the button: Uncaught ReferenceError: WebForm_PostBackOptions
I then found out that this function should be in WebResource.axd, I then went to the Resources tab in the developers tool and found out that this 'file' is not there and it is not loaded in the HTML source.
I tried a lot of different things without any success and finally tried another browser and it works fine in any other browsers. That same page was working perfectly previously in Chrome on the same computer in the past.
So then I tried to click the small gear in the Chrome developer tools and went to the overrides section and changed the UserAgent to something else and refreshed the page and it works perfectly with any other UserAgent string. The correct UserAgent when not overridden for my browser is Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.57 Safari/537.36
So right now I really don't know what to do next:
Is this issue related to the latest version of Chrome? I have not found any information on release dates for chrome.
It could also be a DotNetNuke problem but I doubt it since nothing there changed before and after the problem
It could also be asp.net related (I renamed App_Browsers to App_Browsers2 and still no luck.
Any help would be appreciated.
A data file which addresses this issue is available to download from the following url.
http://51degrees.mobi/portals/0/downloads/51Degrees.mobi-Premium-20130823.dat
.NET users will need to perform the following steps.
Download the above data file.
Replace the file 51Degrees.mobi-Premium.dat in the App_Data folder of the web site with the data file downloaded, renaming the downloaded data file to 51Degrees.mobi-Premium.dat
Restart the application pool servicing the web site to apply the new data file.
Some configurations may place the 51Degrees.mobi-Premium.dat file in a location other than App_Data. The web sites current location can be found in the 51Degrees.mobi.config file found in either the web site’s root folder or the App_Data folder. See the following page for more details.
https://51degrees.mobi/Support/Documentation/NET/WebApplications/Config/Detection.aspx
Please use contact us if you have any issues deploying this data file.
We are having this problem on all our DNN6 sites at work (we can't update to DNN7 since we are stuck on SQL Server 2005 and Windows 2003 boxes). DNN support ticket response was:
"This is a known issue with the Google Chrome update to version 29, the browser is having many issues with ASP.Net pages. The current workaround is to use a different web browser until Google can release a new update."
but I know big asp.net sites like redbox and msdn.microsoft.com are working fine, so it's definitely not a global problem.
Our servers are patched by our infrastructure folks, and they are usually up to date (patched regularly), so not sure what specifically is the issue.
I have personal sites on DNN6 (3essentials hosting), that are working fine. So its definitely not all DNN6/7 sites that are having problems. Maybe its DNN6 sites that are running on Windows 2003 boxes?????
It looks like someone has found the culprit at google. It is related to 51degrees that reports a version 0 for Chrome 29 user-agent string.
More details at https://code.google.com/p/chromium/issues/detail?id=277303
I tried to update the premium data (it is a professional edition installation) but I only get the same version that was aready there dating from 2013-08-15 and having 109 properties.
Then I tried renaming the App_Data/51Degrees.mobi-Premium.dat to add a .old at then end, but the system redownloads that file (same one looks like) to that directory.
So I went away and commented out the fiftyone configuration in the web.config file which instantly made the site work again for Chrome 29.
Let's hope there could be an update on a beter solution for this, but I think the culprit is finally found at least.
On a DNN 7.1.0 site, that uses the Popup feature in DNN (login window opens in a modal popup) the login functionality appears to work fine.
I would recommend you try the Popup option, and if that doesn't work, look at upgrading to the latest release of DNN.
update: I tested the same 7.1.0 site using /login instead of the login popup and it also still works fine, so I would encourage you to look at upgrading your DNN instance.

URL Rewriting Postback with ViewStateMac Enabled

Using: Visual Studio 2010 with ASP.net 4.0
I have a website which uses URL rewriting and I want to keep the rewritten URL on Postback. I've read a lot of the topics on this subject and I still haven't been able to figure out if this is possible.
For example:
http://localhost/ActualPage.aspx?PageID=4
Is rewritten as:
http://localhost/member/forum.aspx
The page contains a number of controls which use a Postback (for example a Telerik RadGrid with sorting and paging). Normally when the postback takes place the browser is redirected to the unrewritten url - the address bar shows /ActualPage.aspx?PageID=4 etc. In this scenario everything works correctly.
However I want to retain the rewritten URL after the postback, so I have coded to change the Form.Action property to be the rewritten URL like so:
Page.Form.Action = "/member/forum.aspx"
Now the page correctly retains the URL in the address bar but throws a "Validation of viewstate MAC failed" error when the postback occurs - which I would expect it too as the viewstate originated from a different URL.
Strangely this problem occurs even when enableViewStateMac is set to false (either in the page or in the web.config) - but I don't want to disable this anyway.
Effectively I think what I need to do is tell the page / viewstate mac authorisation that is it ok to accept input from this alternative URL but I can't find anyway of doing this. I've tried different URL rewrite system to see if that makes a difference, and i've tried added a generated machineKey - neither of which has made any difference. Is there any way of doing this?
In short I want:
Rewritten page with postback going to the rewritten URL
ViewStateMac enabled
No viewstate validation errors
I remember in earlier versions of .NET using a .browser file with FormRewriterControlAdapter but this doesn't seem to make any difference in .NET 4 (I don't remember if it successfully retained the URL anyway).
I have found a solution - it turns out the problem was actually unrelated and masking itself as a ViewStateMac issue.
Previously I had been redirecting all the URLs to one page, doing a database lookup and then using Server.Transfer() to deliver the correct page to the browser. The real problem was being caused by using Server.Transfer() - which it seems is recognised by Microsoft to be an issue when working with the viewstate.
I have made adjustments so IIS performs the database lookup, the entire rewrite and therefore Server.Transfer() is not used - and the original problem I had has been resolved.

Unable to start debugging IIS 7.5 Detailed Error - 500.19

I tried to run my WebApp on my local machine today (nothing has changed on it) and I had the above error. I know my machine had a windows update recently (not sure if that has anything to do with it).
The error produces a big print out of css styles and html markup.
In the markup it also says "The requested page cannot be accecssed because the related configuration data for the page is invalid".
Maybe you accidentally changed the web.config and now contains a malformed section. I'd recommend you take a close look to your configuration file.
I'd say that the error page should tell you the necessary information to solve the problem but I assume that if you're asking if because it's not the case :)
I changed the user info. (windows password which was changed) in the IIS & that helped me :)
You may need to enable windows (or some other type of) authentication in IIS for the site specifically.

Global.asax not firing for .aspx pages in IIS7

We run a link redirection service which can handle links thrown at it in various formats. One of these formats is to append the destination URL to the end of the link, for example
http://url.fwd/abcd/http://www.mydomain.com/page.aspx
This was working on a Windows Server 2003 / IIS6 box for the last two years, but now we're trying to move to a Windows Server 2008 / IIS7 setup and its not working anymore.
I've read about the problem with colons in the URL but it doesn't affect pages not ending in '.aspx'. For instance,
http://url.fwd/abcd/http://www.mydomain.com/page.php
would redirect fine.
http://url.fwd/abcd/http//www.mydomain.com/page.aspx
also works fine (note the lack of a second colon). Despite being the wrong URL, it does get handled by our URL forwarding system, which uses a custom 404 page. On the old system, we had a similar problem, so a method was written in Global.asax > Application_Error specifically to handle the '.aspx' case, and it worked fine.
On our new server, the Application_Error never gets thrown in Global.asax. Instead, I get a System.NotSupportedException - "The given path's format is not supported". This System.NotSupportedException is the exact case we handle in the Global.asax page, so it's definitely not being fired.
I've changed the registry keys indicated in several forum posts,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ASP.NET VerificationCompatibility=1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP|Parameters AllowRestrictedChars=1
I've tried changing the Handler Mappings settings for .aspx.
I've tried setting the App pool to use classic mode instead of integrated, but this causes a completely different error where static content such as images and CSS do not display at all. I've checked that static content is enabled in the windows features, and it is.
Under classic mode, the '.aspx' request throws two Bad Request errors with absolutely no information whatsoever. The code of the error page I get is literally
Bad Request<html><body>Bad Request</body></html>
UPDATE: I've changed the static file Handler Mapping to the form found in this page
http://improve.dk/blog/2006/12/11/making-url-rewriting-on-iis7-work-like-iis6
However, as the author rightly points out, this is a hack and not the correct way of doing things under IIS7. It also only fixes the static file problem in classic mode. '.aspx' pages still throw an error under classic mode.
Any thoughts or input would be greatly appreciated at this point.
IIS 7 Solution
The easy solution in IIS 7 is to add a setting in your web.config file to tell IIS to process all requests through your Global.asax events. Just add or change this section in your web.config to enable requests:
<system.webServer>
<modules runAllManagedModulesForAllRequests="true" />
</system.webServer>
In my case, I was publish my site in production and I miss copy to server App_global.asax.compiled file. For this reason was not fire the Events inside Global.asax.
Hope anyelse help this tips, I lost 8 hours seeking.

Detailed 500 error message, ASP + IIS 7.5

IIS 7.5 , 2008rc2, classic asp, 500 error msg:
The page cannot be displayed because an internal server error has occurred.
I need to know how to configure IIS to get a more detailed error.
I've tried setting to true all of debugging options in the ASP configuration.
But that didn't work. Can anyone help me?
I have come to the same problem and fixed the same way as Alex K.
So if "Send Errors To Browser" is not working set also this:
Error Pages -> 500 -> Edit Feature Settings -> "Detailed Errors"
Also note that if the content of the error page sent back is quite short and you're using IE, IE will happily ignore the useful content sent back by the server and show you its own generic error page instead. You can turn this off in IE's options, or use a different browser.
If you're on a remote server you can configure your web.config file like so:
<configuration>
<system.webServer>
<httpErrors errorMode="Detailed" />
<asp scriptErrorSentToBrowser="true"/>
</system.webServer>
<system.web>
<customErrors mode="Off"/>
<compilation debug="true"/>
</system.web>
Double click "ASP" in the site's Home screen in IIS admin, expand "Debugging Properties", enable "Send errors to browser", and click "Apply".
Under "Error Pages" on the home screen select "500", then "Edit feature settings" and select "Detailed Errors".
Note that the same steps apply for IIS 8.0 (Windows Server 2012).
After trying Vaclav's and Alex's answer, I still had to disable "Show friendly HTTP error messages" in IE
TLDR:First determine where in the pipeline you're getting the error from (scroll looking for screenshots of something that resembles your error), make changes to get something new, repeat.
First determine what error message you are actually seeing.
If you are seeing the file located here...
%SystemDrive%\inetpub\custerr<LANGUAGE-TAG>\500.htm
...which generally looks like this:
**...then you know you are seeing the currently configured error page in IIS ** and you do NOT need to change the ASP.net customErrors setting, asp error detail setting, or "show friendly http errors" browser setting.
You may want to look at the above referenced path instead of trusting my screenshot just in case somebody changed it.
"Yes, I see the above described error..."
In this case, you are seeing the setting of <httpErrors> or in IIS Manager it's Error Pages --> Edit Feature Settings. The default for this is errorMode=DetailedLocalOnly at the server node level (as opposed to the site level) which means that while you will see this configured error page while remote, you should be able to log on locally to the server and see the full error which should look something like this:
You should have everything that you need at that point to fix the current error.
"But I don't see the detailed error even browsing on the server"
That leaves a couple of possibilities.
The browser you are using on the server is configured to use a proxy
in its connection settings so it is not being seen as "local".
You're not actually browsing to the site you think you are browsing to - this commonly happens when there's a load balancer involved. Do a ping check to see if dns gives you an IP on the server or somewhere else.
Your site's httpErrors settings is set for "Custom" only. Change it to "DetailedLocalOnly". However, if you have a configuration error, this may not work since the site level httpErrors is also a configuration item. In that case proceed to #4
The default for httpErrors for all sites is set for "Custom". In this case you need to click on the top level server node in IIS Manager (and not a particular site) and change the httpErrors settings there to DetailedLocalOnly. If this is an internal server and you're not worried about divulging sensitive information, you could also set it to "Detailed" which will allow you to see the error from clients other than the server.
You're missing a module on the server like UrlRewrite (this one bites me a lot, and it often gives the generic message regardless of the httpErrors settings).
"Logging on to the server is not an option for me"
Change your site's httpErrors to "Detailed" so you can see it remotely. But if it doesn't work your error might already be a config error, see #3 immediately above. So you might be stuck with #4 or #5 and you're going to need somebody from your server team.
"I'm not seeing the error page described above. I'm seeing something different"
If you see this...
...and you expect to see something like this...
...then you need to change "Send errors to browser" to true in IIS Manager, under Site --> IIS --> ASP --> Debugging Properties
If you see this...
or this...
...you need to disable friendly errors in your browser or use fiddler's webview to look at the actual response vs what your browser chooses to show you.
If you see this...
...then custom errors is working but you don't have a custom error page (of course at this point were talking about .net and not classic asp). You need to change your customErrors tag in your web.config to RemoteOnly to view on the server, or Off to view remotely.
If you see something that is styled like your site, then custom errors is likely On or RemoteOnly and it's displaying the custom page (Views->Shared->Error.cshtml in MVC for example). That said, it is unlikely but possible that somebody changed the pages in IIS for httpErrors so see the first section on that.
In web.config under
<system.webServer>
replace (or add) the line
<httpErrors errorMode="Detailed"></httpErrors>
with
<httpErrors existingResponse="PassThrough" errorMode="Detailed"></httpErrors>
This is because by default IIS7 intercepts HTTP status codes such as 4xx and 5xx generated by applications further up the pipeline.
Next, enable "Send Errors to Browser" under the "ASP" section, and under "Error Pages / Edit Feature Settings", select "Detailed errors".
Also, give Write permissions on the website folder to the IIS_IUSRS builtin group.
try setting the value of the "existingResponse" httpErrors attribute to "PassThrough". Mine was set at "Replace" which was causing the YSOD not to display.
<httpErrors errorMode="Detailed" existingResponse="PassThrough">
One thing nobody's mentioned is as a very quick and temporary fix, you can view the error on the localhost of that web server.
You may also verify that if you changed your main website folder (c:\inetpub\wwwroot) to another folder you must give read permission to the IIS_IUSRS group in the new folder.
Fot people who have tried EVERYTHING and just CANNOT get the error details to show, like me, it's a good idea to check the different levels of configuration. I have a config file on Website level and on Application level (inside the website) check both. Also, as it turned out, I had Detailed Errors disabled on the highest node in IIS (just underneath Start Page, it has the name that is the same as the webservers computername). Check the Error Pages there.
Found it.
http://blogs.iis.net/ksingla/archive/2009/02/16/iis-7-5-updates-to-custom-errors-and-compression.aspx
run cmd as administrator, go to your system32\inetsrv folder and execute:
appcmd.exe set config -section:system.webServer/httpErrors -allowAbsolutePathsWhenDelegated:true
Now I can see detailed asp errors .
If you run the browser in the server and test your url of the project with the local ip you have received all errors of that project without a generally error page(for example 500 error page).
In my case it was permission issue.
Open application folder properties -> Security tab -> Edit -> Add
IIS AppPool\[DefaultAppPool or any other apppool] (if use ApplicationPoolIdentity option)
IUSRS
IIS_IUSRS
Double check the encoding of the asp file you are testing.
For instance if you created a file like below on a Windows Server Core 2019 :
echo "<%# LANGUAGE=Javascript %>" > test.asp
echo "<%Response.Write("test");%>" >> test.asp
Then test.asp will be encoded in Unicode, and requesting it will produce a 500 without any details.
Do a notepad test.asp, then click on "Save As..." and choose "ANSI" encoding to fix it.

Resources