We Keep Coding

Remove ASP.NET Version Information from error screen when Host is change

During the Pen Test, we received one vulnerability. Repro Steps was Change Host (let's say google.com) to different domain and then hit URL. Then following screen shown,
Here Version Information for dot net framework is showing. I weant through various atricals on internet and they are asking to used in web.config
This tag is already present in web.config and when we hit url without chaning Host it is showing error.aspx page but when we change Host it is showing attached page.In attached image Version Information is mentioned and I want to get rid of that.
Also on out testing envrionment,the version information is not shown with resource not found message. Is there any way to remove version information apart from customErrors tag. Please help me out. We are using IIS 10.

The tag you are already using in the web.config is probably the <customErrors> tag. and that's great for errors that can be caught at the .Net level.
But for errors that don't enter the .Net pipeline you will need to configure the IIS error page for the 404 error. This can be done via the <system.webServer><httpErrors> section of the web.config. For example to return the contents of my-iis-404-page.htm which you locate in the root directory of the website, you could use this:
<system.webServer>
<httpErrors errorMode="Custom" existingResponse="Auto">
<error statusCode="404" subStatusCode="" prefixLanguageFilePath="" path="my-iis-404-page.htm" responseMode="File" />
</httpErrors>
</system.webServer>
This configuration can also be done via the IIS gui. For more information about httpErrors aspect of IIS see https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httperrors/

If you want to remove the X-Aspnet-Version HTTP header from each response from ASP.NET, add the following code to the web.config file.
<system.web>
<httpRuntime enableVersionHeader="false" />
</system.web>

How do I fix the custom errors?

I keep getting this error when trying to run my system
<system.web>
<customErrors mode="Off"/>
</system.web>
<system.web>
<customErrors mode="RemoteOnly" defaultRedirect="mycustompage.html"/>
</system.web>

First of all, enable the details of this specific error message by putting the "customErrors" tag in your "web.config" file like this:
<configuration>
<system.web>
<customErrors mode="Off"/>
</system.web>
</configuration>
Now you will get the exact error in your code and you can fix that specific error.
For security reasons, your code will not be shown in the browser for end user until you have not enabled CustomError mode="Off" in web.config file.

For security reasons .NET-Websites shows complete exceptions only, if you call them locally. To see the error message you have to choices:
Call the website through a browser on the Server (of course not possible, if you deploy to a Azure WebApp, but e.g. in a VM)
Add the first of your snippets (customErrors mode="Off") to your web.config. Then you'll see the complete exception even remotly over the network. My advice would be to set it back to the default setting after you've seen and fixed the error.

Remove custom error in my mvc app?

Hey i have an mvc app that i have published in my azure server. I get an error when i try it in the server. In localhost in works fine. But in the server i get an error that looks like this
So my question is how can i remove that custom error. I want to see the error message that explains what the error is about?
i want the error message to be like this one

check if you have this line this line in your web config system.web area
<customErrors mode="Off" />
if you do change it to off and if not add it in

You can use web.config transform file (such as Web.Debug.config or Web.Release.config) and include the following section:
<system.web>
<customErrors mode="Off" xdt:Transform="Insert" />
</system.web>
The Web.config file will be transformed when you deploy to Azure. The transform does not occur locally.

Publishing ASP.NET MVC to Azure -- works locally but not on Azure

I've been investigating this thing for hours but couldn't understand what's the problem causing this behavior.
I have built a simple ASP.NET MVC app to upload and delete photos from a predefined container on the Azure Storage Server.
It works perfectly when I run the application on my machine, locally.
Also, it works perfectly when I run this on my machine but the Data service is located on Azure.
But, when Publishing the application to Azure, surfing to this website runs to this uninformative error:
Server Error in '/' Application.
Runtime Error
Description: An application error occurred on the server. The current
custom error settings for this application prevent the details of the
application error from being viewed remotely (for security reasons).
It could, however, be viewed by browsers running on the local server
machine.
Details: To enable the details of this specific error message to be
viewable on remote machines, please create a tag within
a "web.config" configuration file located in the root directory of the
current web application. This tag should then have its
"mode" attribute set to "Off".
<!-- Web.Config Configuration File -->
<configuration>
<system.web>
<customErrors mode="Off"/>
</system.web>
</configuration>
Notes: The current error page you are seeing can be replaced by a
custom error page by modifying the "defaultRedirect" attribute of the
application's configuration tag to point to a custom
error page URL.
<!-- Web.Config Configuration File -->
<configuration>
<system.web>
<customErrors mode="RemoteOnly" defaultRedirect="mycustompage.htm"/>
</system.web>
</configuration>
This doesn't tell me anything, also - nothing like this happens when running on my machine with Visual Studio.
If you have any idea what's going on here I'd really appreciate your help, thanks.

How can I get a custom error page for trace.axd in MVC3?

My MVC3 application displays custom error pages for 403, 404, and 500 status codes, but browsing to trace.axd displays the following YSOD:
Server Error in '/' Application.
Trace Error
Description: Trace.axd is not enabled in the configuration file for this application. Note: Trace is never enabled when <deployment retail=true />
Details: To enable trace.axd, please create a <trace> tag within the configuration file located in the root directory of the current web application. This <trace> tag should then have its "enabled" attribute set to "true".
<configuration>
<system.web>
<trace enabled="true"/>
</system.web>
</configuration>
So I have trace disabled, which is good, but why is the 500 page not being displayed, since this it's a 403 being returned from the server? I'd be happy enough with a 404, 403, or 500 really - just as long as it's not an ugly yellow screen!
Edit: I was getting a 500 along with the YSOD when running on localhost, but it's actually a 403 on the server which is closer to what I was expecting - but still no custom error page. It's also a slightly different standard error page on the server:
Server Error in '/' Application.
Trace Error
Description: The current trace settings prevent trace.axd from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine.
Details: To enable trace.axd to be viewable on remote machines, please create a <trace> tag within the configuration file located in the root directory of the current web application. This <trace> tag should then have its "localOnly" attribute set to "false".
<configuration>
<system.web>
<trace localOnly="false"/>
</system.web>
</configuration>

Removing the IgnoreRoute as suggested by #Cosmologinaut didn't work for me and as he says feels wrong. I found a better solution which is to remove the tracing HTTP handler in the Web.config file:
<system.webServer>
<!-- remove TraceHandler-Integrated - Remove the tracing handlers so that navigating to /trace.axd gives us a
404 Not Found instead of 500 Internal Server Error. -->
<handlers>
<remove name="TraceHandler-Integrated" />
<remove name="TraceHandler-Integrated-4.0" />
</handlers>
</system.webServer>
Navigating to /trace.axd now gives us a 404 Not Found instead of 500 Internal Server Error.

Since there were no responses I asked #shanselman on Twitter, who suggested <deployment retail = "true" /> might solve it, but it still returned the same YSOD.
In the end I solved it by removing routes.IgnoreRoute("{resource}.axd/{*pathInfo}"); from the routing config. Doesn't quite seem right, but it works.