Skip to main content

How To Prevent BREACH Attack in ASP.NET MVC 5 Apps?

BREACH attack -
1.     Disabling HTTP compression
2.     Separating secrets from user input
3.     Randomizing secrets per request
4.     Masking secrets (effectively randomizing by XORing with a random secret per request)
5.     Protecting vulnerable pages with CSRF
6.     Length hiding (by adding random number of bytes to the responses)
7.     Rate-limiting the requests
This is reported by this tool - https://acunetix.com/

How To Prevent BREACH attacks in ASP.NET MVC 5 Apps? How do we implement them?
The Points will need to be Implements to Prevent the BREACH Attacks -
1.     Implement the CSRF attacks on every form.
2.     Encrypt all sensitive information within the response body.
3.     Disabling HTTP compression in IIS and the BREACH ATTACH issue was no longer raise by our security scans by acunetix.com

How To Disabling HTTP compression?

Disabling HTTP Compression - Windows 8 or Windows 8.1
The Steps Are -
1.     Go to Start => Control Panel
2.     Control Panel => Programs and Features and click on Turn Windows features on or off
3.     Expand Internet Information Services
4.     Expand World Wide Web Services
5.     Expand Performance Features
6.     Select Dynamic Content Compression and Static Content Compression
7.     Ok
8.     Close

Disabling HTTP compression - Windows Server 2012 or Windows Server 2012 R2
The Steps Are -
1.     GO to Server Manager
2.     Click the Manage menu
3.     Click Add Roles and Features
4.     Add Roles and Features wizard
5.     Click to Next button
6.     Select the installation type
7.     Click to Next button
8.     Select the destination server
9.     Click to Next button
10.  Server Roles
11.  Expand Web Server (IIS)
12.  Expand Web Server
13.  Expand Performance
14.  Select Static Content Compression and Dynamic Content Compression
15.  Click to Next button
16.  Select features
17.  Click Next button
18.  Confirm installation selections
19.  Click to Install
20.  Close

How To Enable or Disable Static and Dynamic Compression for a site or application?
The steps to enable or disable static and dynamic compression for a site -
1.     Open Internet Information Services (IIS) Manager
2.     Go to IIS application directory and select the site for enable or disable compression
3.     Go to Home
4.     Go to Compression and double click
5.     Check the check-boxes to enable static and dynamic compression or remove the compression.
6.     Once you have completed the above steps, click Apply in the actions pane.
References -  
https://docs.microsoft.com/en-us/iis/configuration/system.webServer/httpCompression/

I hope you are enjoying with this post! Please share with you friends. Thank you!

Labels

Labels:
By Anil Singh | Rating of this article (*****)

Popular posts from this blog

39 Best Object Oriented JavaScript Interview Questions and Answers

Most Popular 37 Key Questions for JavaScript Interviews. What is Object in JavaScript? What is the Prototype object in JavaScript and how it is used? What is "this"? What is its value? Explain why "self" is needed instead of "this". What is a Closure and why are they so useful to us? Explain how to write class methods vs. instance methods. Can you explain the difference between == and ===? Can you explain the difference between call and apply? Explain why Asynchronous code is important in JavaScript? Can you please tell me a story about JavaScript performance problems? Tell me your JavaScript Naming Convention? How do you define a class and its constructor? What is Hoisted in JavaScript? What is function overloadin
Read more

List of Countries, Nationalities and their Code In Excel File

Download JSON file for this List - Click on JSON file    Countries List, Nationalities and Code Excel ID Country Country Code Nationality Person 1 UNITED KINGDOM GB British a Briton 2 ARGENTINA AR Argentinian an Argentinian 3 AUSTRALIA AU Australian an Australian 4 BAHAMAS BS Bahamian a Bahamian 5 BELGIUM BE Belgian a Belgian 6 BRAZIL BR Brazilian a Brazilian 7 CANADA CA Canadian a Canadian 8 CHINA CN Chinese a Chinese 9 COLOMBIA CO Colombian a Colombian 10 CUBA CU Cuban a Cuban 11 DOMINICAN REPUBLIC DO Dominican a Dominican 12 ECUADOR EC Ecuadorean an Ecuadorean 13 EL SALVADOR
Read more

25 Best Vue.js 2 Interview Questions and Answers

What Is Vue.js? The Vue.js is a progressive JavaScript framework and used to building the interactive user interfaces and also it’s focused on the view layer only (front end). The Vue.js is easy to integrate with other libraries and others existing projects. Vue.js is very popular for Single Page Applications developments. The Vue.js is lighter, smaller in size and so faster. It also supports the MVVM ( Model-View-ViewModel ) pattern. The Vue.js is supporting to multiple Components and libraries like - ü   Tables and data grids ü   Notifications ü   Loader ü   Calendar ü   Display time, date and age ü   Progress Bar ü   Tooltip ü   Overlay ü   Icons ü   Menu ü   Charts ü   Map ü   Pdf viewer ü   And so on The Vue.js was developed by “ Evan You ”, an Ex Google software engineer. The latest version is Vue.js 2. The Vue.js 2 is very similar to Angular because Evan You was inspired by Angular and the Vue.js 2 components looks like -
Read more

React | Encryption and Decryption Data/Text using CryptoJs

To encrypt and decrypt data, simply use encrypt () and decrypt () function from an instance of crypto-js. Node.js (Install) Requirements: 1.       Node.js 2.       npm (Node.js package manager) 3.       npm install crypto-js npm   install   crypto - js Usage - Step 1 - Import var   CryptoJS  =  require ( "crypto-js" ); Step 2 - Encrypt    // Encrypt    var   ciphertext  =  CryptoJS . AES . encrypt ( JSON . stringify ( data ),  'my-secret-key@123' ). toString (); Step 3 -Decrypt    // Decrypt    var   bytes  =  CryptoJS . AES . decrypt ( ciphertext ,  'my-secret-key@123' );    var   decryptedData  =  JSON . parse ( bytes . toString ( CryptoJS . enc . Utf8 )); As an Example,   import   React   from   'react' ; import   './App.css' ; //Including all libraries, for access to extra methods. var   CryptoJS  =  require ( "crypto-js" ); function   App () {    var   data
Read more

.NET Core MVC Interview Questions and Answers

» OOPs Interview Questions Object Oriented Programming (OOP) is a technique to think a real-world in terms of objects. This is essentially a design philosophy that uses a different set of programming languages such as C#... Posted In .NET » .Net Constructor Interview Questions A class constructor is a special member function of a class that is executed whenever we create new objects of that class. When a class or struct is created, its constructor is called. A constructor has exactly the same name as that of class and it does not have any return type… Posted In .NET » .NET Delegates Interview Questions Delegates are used to define callback methods and implement event handling, and they are declared using the "delegate" keyword. A delegate in C# is similar to function pointers of C++, but C# delegates are type safe… Posted In .NET » ASP.Net C# Interview Questions C# was developed by Microsoft and is used in essentially all of their products. It is mainly used for
Read more