C# (CSharp) System.Web.Configuration WebConfigurationManager.OpenMappedWebConfiguration Examples

OpenMappedWebConfiguration() public static method

public static OpenMappedWebConfiguration ( WebConfigurationFileMap fileMap, string path ) : Configuration
fileMap	WebConfigurationFileMap
path	string
return	System.Configuration.Configuration

Example #1

        private void InvestigateDotNet(ServerManager localServer)
        {
            //todo find any commercial deployments???
            //todo detect windows services???
            //todo get app type: Webforms, MVC, WebAPI
            //todo detect sizes of files and directories: app DLLs, all DLLs, all HTML/JS/CSS, whole app, logs)

            foreach (var site in _server.Sites)
            {
                foreach (var dir in site.VirtualDirectories)
                {
                    //load up web.config
                    var virtualDirectoryMapping = new VirtualDirectoryMapping(Environment.ExpandEnvironmentVariables(dir.PhysicalPath), true, "web.config");
                    var fileMap = new WebConfigurationFileMap();
                    fileMap.VirtualDirectories.Add(dir.Path, virtualDirectoryMapping);
                    var webConfig = WebConfigurationManager.OpenMappedWebConfiguration(fileMap, dir.Path, site.Name);

                    //how to work with this webConfig: https://msdn.microsoft.com/en-us/library/system.web.configuration(v=vs.110).aspx

                    var connectionStrings = webConfig.ConnectionStrings.ConnectionStrings;
                    dir.Databases = connectionStrings.Cast <ConnectionStringSettings>().Select(connectionString => new Database
                    {
                        ConnectionName   = connectionString.Name,
                        ConnectionString = connectionString.ConnectionString,
                        Provider         = connectionString.ProviderName
                    }).ToList();

                    var authSection = (AuthenticationSection)webConfig.GetSection("system.web/authentication");
                    dir.AuthenticationMode = authSection.Mode.ToString();
                    //if more auth info is needed for forms auth, start grabbing things off of the authSection.Forms...
                    //dir.Auth = authSection.Forms.

                    //digging up security issues. refer to OWASP guidelines
                    //http://www.developerfusion.com/article/6678/top-10-application-security-vulnerabilities-in-webconfig-files-part-one/
                    //https://www.troyhunt.com/owasp-top-10-for-net-developers-part-2/ <-- look at the whole series

                    var compilationSection = (CompilationSection)webConfig.GetSection("system.web/compilation");
                    dir.TargetDotNetFramework = compilationSection.TargetFramework;
                    dir.DebugEnabled          = compilationSection.Debug;

                    var customErrorsSection = (CustomErrorsSection)webConfig.GetSection("system.web/customErrors");
                    dir.RevealsStockErrorPages = customErrorsSection.Mode == CustomErrorsMode.Off;
                    dir.RevealsErrorUrls       = customErrorsSection.RedirectMode == CustomErrorsRedirectMode.ResponseRedirect;

                    var traceSection = (TraceSection)webConfig.GetSection("system.web/trace");
                    dir.TracePubliclyEnabled = traceSection.Enabled && !traceSection.LocalOnly;

                    var httpRuntimeSection = (HttpRuntimeSection)webConfig.GetSection("system.web/httpRuntime");
                    dir.RevealsAspNetVersionHeader = httpRuntimeSection.EnableVersionHeader;

                    var pagesSection = (PagesSection)webConfig.GetSection("system.web/pages");
                    dir.RequestValidationDisabled = !pagesSection.ValidateRequest;

                    var cookiesSection = (HttpCookiesSection)webConfig.GetSection("system.web/httpCookies");
                    dir.JavaScriptCanAccessCookies = !cookiesSection.HttpOnlyCookies;
                    dir.InsecureCookiesAllowed     = !cookiesSection.RequireSSL;

                    var sessionStateSection = (SessionStateSection)webConfig.GetSection("system.web/sessionState");
                    dir.CookielessSessionsAllowed = sessionStateSection.Cookieless != HttpCookieMode.UseCookies;
                }
            }
        }