Session Hijacking in ASP.NET {2}

by Gerardgon Z
The article talks about how easy it is to find and exploit unsecured websites using ELMAH (Error Logging Modules and Handlers for ASP.NET). ELMAH is an error logging module for ASP.NET websites that makes it easy for web masters to view the errors their websites are giving. It is a very popular module for ASP.NET and used widely. The information it gives administrators is so informative that hackers can use the same module to exploit and hijack a website by looking at the same logs. Unsecured ELMAH logs can be used to hijack the entire website because it can provide authentication cookies and user types which the hacker can easily spoof and create their own authentication cookies. Unsecured ELMAH logs can also provide sqlstatements and passwords from the internal database making it a very big security breach. The article then talks about how to protect and secure ELMAH and some best practices to avoid this easily mitigated exploit. read more...