Description

The application or its underlying components expose technical details that aid an attacker in reconnaissance, such as: - Component names, versions, or configuration details, exposed through response headers, service banners, configuration files, or framework-specific markers. - Internal network information, such as internal IP addresses, exposed in responses. - Debug or diagnostic output, such as console logging or alert functions, left enabled in production code.

Impact

Gather technical information to craft more targeted attacks.

Recommendation

- Remove service banners, HTTP headers, and framework-specific markers that reveal component names or versions. - Restrict access to configuration files and internal network details such as IP addresses. - Disable or remove debug and diagnostic output, such as console logging or alert functions, in production environments; log errors through a protected logging mechanism instead.

Threat

Anonymous attacker from the Internet.

Expected Remediation Time

⏱️ 60 minutes.

Requirements

Rules

Fixes