Disable Custom Errors Free consultation

When you install Apache with source or any other package installers like yum, it displays the version of your Apache web server installed on your server with the Operating system name of your server in Errors. It also shows the information about Apache modules installed in your server. This can be a major security threat to your web server

1

Customers

2

Case Studies

3

Affiliates

4

Philosophy

We offer cyber security penetration testing and consultancy services to a variety of customers.
Such synergies bring value in to Valency Networks which benefit the customers by having solutions to variety of their requirements.
Such synergies bring value in to Valency Networks which benefit the customers by having solutions to variety of their requirements.
Such synergies bring value in to Valency Networks which benefit the customers by having solutions to variety of their requirements.

Apache

To prevent Apache to not to display these information to the world, we need to make some changes in Apache main configuration file.

ServerSignature Off
ServerTokens Prod

IIS

A Web site's error pages are often set to show detailed error information for troubleshooting purposes. However, to prevent unauthorized users from viewing privileged information, you should make sure that detailed error pages will not be seen by remote users.

To prevent IIS7 hijacking your error pages, set existingResponse="PassThrough" in your httpErrors section in your web.config file. For example:
<configuration>
  <system.webServer>
     <httpErrors existingResponse="PassThrough" />
  </system.webServer>
</configuration>


To set the custom errors error mode to DetailedLocalOnly or Custom

  1. Click Start, click Control Panel, and then click Administrative Tools.
  2. Right-click Internet Information Services (IIS) Manager and select Run as administrator.
  3. In the Connections pane on the left, expand the computer, then expand the Sites folder.
  4. Select the Web site or application that you want to configure.
  5. In Features View, select Error Pages. In the Actions pane, select Open Feature.
  6. In the Actions pane, select Edit Feature Settings.
  7. In the Edit Error Pages Settings dialog, under Error Responses, select either Custom error pages or Detailed errors for local requests and custom error pages for remote requests.
  8. Click OK to exit the Edit Error Pages Settings dialog.


To prevent information leakage by using custom error pages, apply the following changes to your web.config file from HTTP responses.

<System.Web>
   <httpRuntime enableVersionHeader="false" />
       <customErrors mode="On" defaultRedirect="~/error/GeneralError.aspx">
           <error statusCode="403" redirect="~/error/Forbidden.aspx" />
          <error statusCode="404" redirect="~/error/PageNotFound.aspx" />
          <error statusCode="500" redirect="~/error/InternalError.aspx" />
      </customErrors>
</System.Web>

Tomcat

Using a configuration where the webapp is deployed into the Tomcat ROOT context and assuming you have a custom error 500 and 404 page already developed, you would add the following to your ROOT web applications's web.xml configuration, which is typically located in $CATALINA_HOME/webapps/ROOT/:

<error-page>
    <error-code>500</error-code>
    <location>/errors/500.html</location>
  </error-page>
  <error-page>
    <error-code>404</error-code>
    <location>/errors/404.html</location>
</error-page>