Skip to main content

How To Prevent BREACH Attack in ASP.NET MVC 5 Apps?

BREACH attack -
1.     Disabling HTTP compression
2.     Separating secrets from user input
3.     Randomizing secrets per request
4.     Masking secrets (effectively randomizing by XORing with a random secret per request)
5.     Protecting vulnerable pages with CSRF
6.     Length hiding (by adding random number of bytes to the responses)
7.     Rate-limiting the requests
This is reported by this tool - https://acunetix.com/

How To Prevent BREACH attacks in ASP.NET MVC 5 Apps? How do we implement them?
The Points will need to be Implements to Prevent the BREACH Attacks -
1.     Implement the CSRF attacks on every form.
2.     Encrypt all sensitive information within the response body.
3.     Disabling HTTP compression in IIS and the BREACH ATTACH issue was no longer raise by our security scans by acunetix.com

How To Disabling HTTP compression?

Disabling HTTP Compression - Windows 8 or Windows 8.1
The Steps Are -
1.     Go to Start => Control Panel
2.     Control Panel => Programs and Features and click on Turn Windows features on or off
3.     Expand Internet Information Services
4.     Expand World Wide Web Services
5.     Expand Performance Features
6.     Select Dynamic Content Compression and Static Content Compression
7.     Ok
8.     Close

Disabling HTTP compression - Windows Server 2012 or Windows Server 2012 R2
The Steps Are -
1.     GO to Server Manager
2.     Click the Manage menu
3.     Click Add Roles and Features
4.     Add Roles and Features wizard
5.     Click to Next button
6.     Select the installation type
7.     Click to Next button
8.     Select the destination server
9.     Click to Next button
10.  Server Roles
11.  Expand Web Server (IIS)
12.  Expand Web Server
13.  Expand Performance
14.  Select Static Content Compression and Dynamic Content Compression
15.  Click to Next button
16.  Select features
17.  Click Next button
18.  Confirm installation selections
19.  Click to Install
20.  Close

How To Enable or Disable Static and Dynamic Compression for a site or application?
The steps to enable or disable static and dynamic compression for a site -
1.     Open Internet Information Services (IIS) Manager
2.     Go to IIS application directory and select the site for enable or disable compression
3.     Go to Home
4.     Go to Compression and double click
5.     Check the check-boxes to enable static and dynamic compression or remove the compression.
6.     Once you have completed the above steps, click Apply in the actions pane.
References -  
https://docs.microsoft.com/en-us/iis/configuration/system.webServer/httpCompression/

I hope you are enjoying with this post! Please share with you friends. Thank you!

Labels

Labels:
By Anil Singh | Rating of this article (*****)

Popular posts from this blog

List of Countries, Nationalities and their Code In Excel File

Download JSON file for this List - Click on JSON file    Countries List, Nationalities and Code Excel ID Country Country Code Nationality Person 1 UNITED KINGDOM GB British a Briton 2 ARGENTINA AR Argentinian an Argentinian 3 AUSTRALIA AU Australian an Australian 4 BAHAMAS BS Bahamian a Bahamian 5 BELGIUM BE Belgian a Belgian 6 BRAZIL BR Brazilian a Brazilian 7 CANADA CA Canadian a Canadian 8 CHINA CN Chinese a Chinese 9 COLOMBIA CO Colombian a Colombian 10 CUBA CU Cuban a Cuban 11 DOMINICAN REPUBLIC DO Dominican a Dominican 12 ECUADOR EC Ecuadorean an Ecuadorean 13 EL SALVA...
Read more

nullinjectorerror no provider for httpclient angular 17

In Angular 17 where the standalone true option is set by default, the app.config.ts file is generated in src/app/ and provideHttpClient(). We can be added to the list of providers in app.config.ts Step 1:   To provide HttpClient in a standalone app we could do this in the app.config.ts file, app.config.ts: import { ApplicationConfig } from '@angular/core'; import { provideRouter } from '@angular/router'; import { routes } from './app.routes'; import { provideClientHydration } from '@angular/platform-browser'; //This (provideHttpClient) will help us to resolve the issue  import {provideHttpClient} from '@angular/common/http'; export const appConfig: ApplicationConfig = {   providers: [ provideRouter(routes),  provideClientHydration(), provideHttpClient ()      ] }; The appConfig const is used in the main.ts file, see the code, main.ts : import { bootstrapApplication } from '@angular/platform-browser'; import { appConfig } from ...
Read more

Encryption and Decryption Data/Password in Angular

You can use crypto.js to encrypt data. We have used 'crypto-js'.   Follow the below steps, Steps 1 –  Install CryptoJS using below NPM commands in your project directory npm install crypto-js --save npm install @types/crypto-js –save After installing both above commands it looks like  – NPM Command  1 ->   npm install crypto-js --save NPM Command  2 ->   npm install @types/crypto-js --save Steps 2  - Add the script path in “ angular.json ” file. "scripts" : [                "../node_modules/crypto-js/crypto-js.js"               ] Steps 3 –  Create a service class “ EncrDecrService ” for  encrypts and decrypts get/set methods . Import “ CryptoJS ” in the service for using  encrypt and decrypt get/set methods . import  {  Injectable  }  from ...
Read more

How To convert JSON Object to String?

To convert JSON Object to String - To convert JSON Object to String in JavaScript using “JSON.stringify()”. Example – let myObject =[ 'A' , 'B' , 'C' , 'D' ] JSON . stringify ( myObject ); ü   Stayed Informed –   Object Oriented JavaScript Interview Questions I hope you are enjoying with this post! Please share with you friends!! Thank you!!!
Read more

Cache Busting with Angular and Angular CLI

Cache Busting -  Run the below command in your project directory - ng build -- prod The above command is used to enable cache busting by default with Angular CLI. This command can take a few minutes based on your project size. Stayed Informed – Angular 4 and Angular 5 Documents Steps for Cache busting with Angular and Angular CLI - ·          C:\Users\Viaindia>d: ·          D:\>cd Angular ·          D:\Angular>cd PipeApps ·          D:\Angular\PipeApps>ng serve --open ** NG Live Development Server is listening on localhost:4200, open your browser on http://localhost:4200/ **  10% building modules 8/10 modules 2 active ...e}!D:\Angular\PipeApps\src\styles.csswebpack: wait until bundle finished: /            ...
Read more