Classic ASP - HTTP Header Insertion Protection

Question

I am trying to protect a classic ASP web application from HTTP Header Injected XSS attacks and am having trouble finding a solution that stops the scripts found in the user agent string.

Here is an example HTTP request for a web application:

HTTP Request
GET /WebApp/Login.aspx HTTP / 1.1
Host: WebServer.Webapp.Com
User ‐ Agent: Mozilla / 5.0 (X11; Linux x86_64; rv: 41.0) Gecko / 20100101 Firefox / 41.0 ** alert (1) **
Accept: text / html, application / xhtml + xml, application / xml; q = 0.9, * / *; q = 0.8
Accept ‐ Language: en ‐ US, en; q = 0.5
Accept ‐ Encoding: gzip, deflate
Cookie: ASP.NET_SessionId = foobarID
Connection: keep ‐ alive

Basically what we are trying to do is save this warning script in the User Agent String when it is loaded. I did a lot of research and could not find too much help for this old application. We have validateRequest and EnableHeaderChecking that are set to true, but this script is still running. Any help is really appreciated.

Answer 1

The problem is with the user agent string (with a malicious script) displayed on the page below for debugging purposes. If you have this problem, make sure that you are not showing the object with a bad script on the page.

, HTML-, .

thelot Lankymart .