Exposed localstart.asp page

Low Web Application Scanning Plugin ID 98088


Exposed localstart.asp page


To restrict access to specific pages on a webserver, developers can implement various methods of authentication, therefore only allowing access to clients with valid credentials. There are several forms of authentication that can be used. The simplest forms of authentication are known as 'Basic' and 'Basic Realm'. These methods of authentication have several known weaknesses such as being susceptible to brute force attacks.
Additionally, when utilising the NTLM mechanism in a windows environment, several disclosures of information exist, and any brute force attack occurs against the server's local users, or domain users if the web server is a domain member.
Cyber-criminals will attempt to locate protected pages to gain access to them and also perform brute force attacks to discover valid credentials.
Scanner discovered the following page requires NTLM based basic authentication in order to be accessed.


If the pages being protected are not required for the functionality of the web application they should be removed, otherwise, it is recommended that basic and basic realm authentication are not used to protect against pages requiring authentication.
If NTLM based basic authentication must be used, then default server and domain accounts such as `administrator` and `root` should be disabled, as these will undoubtedly be the first accounts to be targeted in any such attack.
Additionally, the webserver should not be joined to any corporate domain where usernames are readily available (such as from email addresses). If the pages are required, and it is possible to remove the basic authentication, then a stronger and more resilient form-based authentication mechanism should be implemented to protect the affected pages.

Plugin Details

Severity: Low

ID: 98088

File Name: was_localstart_asp.nasl

Type: remote

Published: 2017/03/31

Modified: 2017/10/16

Risk Information

Risk Factor: Low

Reference Information