We Keep Coding

Remove ASP.NET Version Information from error screen when Host is change

During the Pen Test, we received one vulnerability. Repro Steps was Change Host (let's say google.com) to different domain and then hit URL. Then following screen shown,
Here Version Information for dot net framework is showing. I weant through various atricals on internet and they are asking to used in web.config
This tag is already present in web.config and when we hit url without chaning Host it is showing error.aspx page but when we change Host it is showing attached page.In attached image Version Information is mentioned and I want to get rid of that.
Also on out testing envrionment,the version information is not shown with resource not found message. Is there any way to remove version information apart from customErrors tag. Please help me out. We are using IIS 10.

The tag you are already using in the web.config is probably the <customErrors> tag. and that's great for errors that can be caught at the .Net level.
But for errors that don't enter the .Net pipeline you will need to configure the IIS error page for the 404 error. This can be done via the <system.webServer><httpErrors> section of the web.config. For example to return the contents of my-iis-404-page.htm which you locate in the root directory of the website, you could use this:
<system.webServer>
<httpErrors errorMode="Custom" existingResponse="Auto">
<error statusCode="404" subStatusCode="" prefixLanguageFilePath="" path="my-iis-404-page.htm" responseMode="File" />
</httpErrors>
</system.webServer>
This configuration can also be done via the IIS gui. For more information about httpErrors aspect of IIS see https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httperrors/

If you want to remove the X-Aspnet-Version HTTP header from each response from ASP.NET, add the following code to the web.config file.
<system.web>
<httpRuntime enableVersionHeader="false" />
</system.web>

IIS Changing Error Page Responses

I have an MVC application that is running on IIS. I have created a custom exception filter handler that returns a custom JSON object. When I run it locally everything works correctly.
However, when I deploy it to IIS the correct HTTP Status Code is returned, but instead of getting my custom JSON object, I am getting a plain text response that says "Bad Request" or "The resource you are looking for has been removed, had its name changed, or is temporarily unavailable."
In my web config, I have added:
<customErrors mode="Off" />
and
<httpErrors>
<clear />
</httpErrors>
Any suggestions would be greatly appreciated.
Thanks!

I found the solution. I needed to add errorMode = "Detailed to my httpErrors tag.
<httpErrors errorMode="Detailed">
<clear />
</httpErrors>

Different Http 404 - Returning from Controller

I have a MVC ASP.NET website in which I have the following on the web.config
<customErrors mode="On" defaultRedirect="~/Views/Shared/Error.cshtml">
<error statusCode="404" redirect="~/redir/Home/Http404" />
</customErrors>
So when I try to navigate to an address that does not exist I get my Http404 view located under Home which is correct.
Now I have a special situation in which I want to manually return the same Http 404 and I am seeing the IIS 8 error instead of my Http404 view.
Controller :
return new HttpNotFoundResult();
How to avoid this IIS8 error page, and still make my view the error provider?
EDIT*
I found out that if instead of HttpNotFoundResult() I use the old throw new HttpException(404, "HTTP/1.1 404 Not Found"); it works.
Why this difference ?
Thanks

The <customErrors> section is aimed to control the behavior when an Application Error occurs. That's also why it's defined under the <system.web> section.
When you explicitly throw an HttpException (or when any other internal exception occurs) the <customErrors> settings will be used as it's considered (rightfully) an application error.
On the other hand, when you simply return HttpNotFoundResult(), no application error is being thrown (internally, it just sets the HTTP response status code and message to 404) and the MvcHandler will hand over the request to the next handler in the pipeline. So you eventually end up with a regular Server Error that is handled by IIS just like any other '404 not found' request, and the <customErrors> section does not affect its behavior.
So, you need to control IIS behavior when regular server error occurs. To do this, use the <system.webServer/httpErrors> section as follows:
<system.webServer>
<httpErrors errorMode="Custom">
<remove statusCode="404"/>
<error statusCode="404" path="/redir/Home/Http404" responseMode="ExecuteURL" />
</httpErrors>
</system.webServer>
See Documentation

IIS Error for custom messages

Please find attached the error I am getting while trying to display a custom error message. My application ASP.Net 4 and uses IIS 7.5. HEre is my code in web.config.
</httpErrors>

You should have your this under system.web
<system.web>
<customErrors mode="On" redirectMode="ResponseRewrite" defaultRedirect="~/ErrorPages/WebError.aspx"/>
And this under system.webServer (one of a few options)
<system.webServer>
<httpErrors existingResponse="PassThrough"/>

Detecting Server and SQL Server errors and showing an error page

in my C# code I use try/catch on all my methods, this picks up most of the errors, but some errors like 404 are not picked up.
Does anyone know how to pick up all other errors that occur on the server or if SQL server is down?
thanks

you should use ELMAH as error handler in your project...read the link for more details.

You can update your web.config file and specify the following:
<customErrors mode="On">
<error statusCode="404" redirect="~/error404.aspx" />
</customErrors>