We Keep Coding

Remove ASP.NET Version Information from error screen when Host is change

During the Pen Test, we received one vulnerability. Repro Steps was Change Host (let's say google.com) to different domain and then hit URL. Then following screen shown,
Here Version Information for dot net framework is showing. I weant through various atricals on internet and they are asking to used in web.config
This tag is already present in web.config and when we hit url without chaning Host it is showing error.aspx page but when we change Host it is showing attached page.In attached image Version Information is mentioned and I want to get rid of that.
Also on out testing envrionment,the version information is not shown with resource not found message. Is there any way to remove version information apart from customErrors tag. Please help me out. We are using IIS 10.

The tag you are already using in the web.config is probably the <customErrors> tag. and that's great for errors that can be caught at the .Net level.
But for errors that don't enter the .Net pipeline you will need to configure the IIS error page for the 404 error. This can be done via the <system.webServer><httpErrors> section of the web.config. For example to return the contents of my-iis-404-page.htm which you locate in the root directory of the website, you could use this:
<system.webServer>
<httpErrors errorMode="Custom" existingResponse="Auto">
<error statusCode="404" subStatusCode="" prefixLanguageFilePath="" path="my-iis-404-page.htm" responseMode="File" />
</httpErrors>
</system.webServer>
This configuration can also be done via the IIS gui. For more information about httpErrors aspect of IIS see https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httperrors/

If you want to remove the X-Aspnet-Version HTTP header from each response from ASP.NET, add the following code to the web.config file.
<system.web>
<httpRuntime enableVersionHeader="false" />
</system.web>

Windows web app wrong start up page

I am creating a windows web app on visual studio. When launched, I need the web browser to start up with the login page but it doesnt, it starts up on a different page. Anyone know why? or how to remedy the problem?

Henks answer looks like what you want, but if you are using ASP.NET MVC? you could tag your controllers/methods with the [Authorize] attribute. This would redirect users that is not logged in to the login page (or any other page should you decide to override the defaults).

Go to your project's properties page (right-click on project, select properties).
Go to the "Web" tab
Change the "Start Action" to your login page.
I'm guessing that at the moment your setting is to open the current page.

You could modify your web.config file, in this way you could indicate the default page, something like this:
<system.webServer>
<defaultDocument>
<files>
<remove value="default.aspx"/>
<remove value="index.html"/>
<remove value="index.htm"/>
<add value="Login.aspx"/>
</files>
</defaultDocument>
</system.webServer>

ASP.NET BlogEngine.NET HTTP 403 Error (Admin Pages Only)

I recently installed the latest version of BlogEngine.NET (v3.0). The blog itself renders fine on my browser (i.e., viewing the main page, individual blog posts, etc.) However, when I log in and try to access any of the Admin pages (i.e., Settings, Users, etc.), I am getting an HTTP 403 (Forbidden) error.
This is happening on both Windows Server 2008 R2 x64 as well as Windows Server 2012 x64. When I installed a local copy on my Windows 8.1 Pro machine, it works fine.
I know the admin pages all render in MVC-style, since the URL is "/admin/#/settings", for Settings for example.
I have literally tried everything. I verified that the application pool identity has Write permissions to the entire web site folder structure.
Any thoughts/ideas? I am completely stuck and would appreciate any guidance. Thanks in advance.
* UPDATE *
Some progress- I tried creating a standalone website in IIS just for BlogEngine.NET, i.e., http://www.example.com instead of http://www.example.com/blog, and it worked flawlessly.
Therefore, something is going screwy with the permissions when I am creating an Application within the main Website (i.e., www.example.com/blog).
Thoughts?

Ancient post, but adding these <appSettings> helped for me:
<appSettings>
<add key="webpages:Version" value="3.0.0.0" />
<add key="webpages:Enabled" value="true" />
</appSettings>
Alternatively, you can start the section by getting rid of all inherited values:
<appSettings>
<clear />
<!-- Other settings here -->
</appSettings>
In my main site I explicitly had a setting <add key="webpages:Enabled" value="false" />, so that explains why it was necessary to add this.
You also need to do this for other sections, like <connectionStrings>.

Setting default at some port be some specific web service

currently I am running my web service from following path
http://localhost:16022/MachineService.asmx
and usage of some web method like
http://localhost:16022/MachineService.asmx?op=GetData1
I want to do it in following way
to run the web service from following path
http://localhost:16022/
and usage of some web method like
http://localhost:16022?op=GetData1
Is it possible to set it be the default ?
I am using VS2010.
Also possible to do so at the IIS7 itself ?

You can set the defaultDocument Element in your web.config file so you won't have to specify MachineService.asmx with each and every call.
<system.webServer>
<defaultDocument>
<files>
<clear />
<add value="MachineService.asmx" />
</files>
</defaultDocument>
</system.webServer>
Instead of manually modifying web.config you can configure the default document in Internet Information Services (IIS) Manager.

Getting "The WebResource.axd handler must be registered in the configuration to process this request." error

I'm getting this error while running my ASP.NET app on IIS7. I've tried doing what it says to do but it doesn't help.
The WebResource.axd handler must be
registered in the configuration to
process this request.
> <!-- Web.Config Configuration File -->
>
> <configuration>
> <system.web>
> <httpHandlers>
> <add path="WebResource.axd" verb="GET" type="System.Web.Handlers.AssemblyResourceLoader" validate="True" />
> </httpHandlers>
> </system.web>
> </configuration>
I'm using a little bit of AJAX which is what I think is causing the issue. Has anyone encountered this before?

I figured it out so I'm posting it here for search reasons. It is a bug in ASP.NET and it has to do with having ColdFusion installed. Microsoft hasn't yet released a fix.
There are two ways to fix this.
Change the AppPool in IIS7 to "Classic .NET AppPool". I'm not sure of any implications with this setting.
Remove all the references to ColdFusion from your applicationHost.config file in system32\inetsrv\config.

ColdFusion installs a global wildcard handler mapping which apparently overrides many of the standard .NET handlers. The solutions mentioned work just fine, but if you can't switch to Classic Mode and don't want to screw with your ColdFusion installation, you can remove the inherited handler mapping at the individual site level.
To do this, go to the site in question in IIS, double-click on "Handler Mappings" under the "IIS" section, and find the handler named something like "AboMapperCustom-XXXXXX" with "*" for the Path. Select the entry and click "Remove" in the sidebar. This will only remove the mapping for your application, so it won't break any existing CF sites on the server.

In IIS7 you need to add the <httpHandler> section to <system.webServer> instead of <system.web>. Here is an example.

I got this error after carelessly copying my app's web.config between a pair of clustered servers, which overwrote the tag:
<system.webServer>
<handlers>
<remove name="AboMapperCustom-XXXXXXXX" />
</handlers>
</system.webServer>
with
<system.webServer>
<handlers>
<remove name="AboMapperCustom-YYYYYYYY" />
</handlers>
</system.webServer>
Locating the proper ID as per Josh's response and correcting the tag fixed it, but more importantly, will presumably keep that handler mapping from sneaking back in.

The issue happened to me on new Windows 2016 server where ASP.NET 4.6 was not installed. After installation everything got fixed.
Steps
- Run Server Manager
- Manage > Add Roles and Features
- Server Roles
- Web Server (IIS) > Web Server > Application Development > ASP.NET 4.6

I had this problem and that reason was incompatibility between Coldfusion and some configurations of ASP.NET applications when IIS App pool is in integrated mode. Coldfusion must be disable .