Using extensions other than .aspx?

[Thomas]

I would like to use something like .x rather than .aspx for my asp.net
projects. One reason is, I'd rather everyone not know what
language/platform our projects are written in. (I like security AND
obscurity on our site.) Right now it is trivial to use Google to find
all pages using asp.net, with a google search for .aspx files. If an
exploit comes out for .net stuff, Google becomes a hacker's tool to
locate pages to exploit quite easily. (Witness the recent PHP/bb
exploit recently.)

Anyway, I've renamed one of my index.aspx files to index.x, I added the
..x association in IIS to load the aspnet_isapi.dll, I created a file
association for .x in my filesystem that is exactly like the one for
..aspx. I restarted IIS completely.

However, when trying to hit the .x page, it simply downloads the
contents of the page, it doesn't execute it on the server. The only
line in the .x file is:

<%@ Page language="c#" Codebehind="index.aspx.cs"
AutoEventWireup="false" Inherits="view.index" %>

(I did leave the .cs file named index.aspx.cs.)

And in VS.net 2003, it does not see the .x file as anything special,
even though the file system recognizes the file as an "ASP.NET Server
Page."

Has anyone got this to work?

Thanks!

[Patrice]

I saw a thread on the same topic where someone made a very valid remark :
the HTML code created by ASP.NET is quite recognizable. Even if you can hide
the extension, viewsource is likely to reveal you are using ASP.NET...

Patrice

--

"Thomas" <to*******@gmail.com> a écrit dans le message de
news:11**********************@o13g2000cwo.googlegr oups.com...

I would like to use something like .x rather than .aspx for my asp.net
projects. One reason is, I'd rather everyone not know what
language/platform our projects are written in. (I like security AND
obscurity on our site.) Right now it is trivial to use Google to find
all pages using asp.net, with a google search for .aspx files. If an
exploit comes out for .net stuff, Google becomes a hacker's tool to
locate pages to exploit quite easily. (Witness the recent PHP/bb
exploit recently.)

Anyway, I've renamed one of my index.aspx files to index.x, I added the
.x association in IIS to load the aspnet_isapi.dll, I created a file
association for .x in my filesystem that is exactly like the one for
.aspx. I restarted IIS completely.

However, when trying to hit the .x page, it simply downloads the
contents of the page, it doesn't execute it on the server. The only
line in the .x file is:

<%@ Page language="c#" Codebehind="index.aspx.cs"
AutoEventWireup="false" Inherits="view.index" %>

(I did leave the .cs file named index.aspx.cs.)

And in VS.net 2003, it does not see the .x file as anything special,
even though the file system recognizes the file as an "ASP.NET Server
Page."

Has anyone got this to work?

Thanks!

[Thomas]

That is good to know, however we rarely use ASP.NET HTML output, we
mostly output XML. But more importantly, we're not trying to prevent
someone from ever figuring out what we're using, we would just like to
stay out of Google results for "aspx" searches to help mitigate
exploits a bit.

[Thomas]

I have figured out half of the problem... I now have IIS executing my
..x files as ASP.NET files. However, despite a bunch of registry changes
that I've read about, I cannot get VS.NET to fully accept my .x files
as .aspx file replacements. It seems to at least recognize them as
"HTML-like" files, but when right-clicking on the file, there is no
option to "View Code." This is crucial to get working, or it will be a
real PITA to work with this code in VS.net.

So here is what I learned, for anyone else that is interested.

1. To get your .x extension to work in IIS, you not only need to add a
..x mapping to the aspnet_isapi.DLL in the home directory configuration
area, you also need to edit machine.config (located in the
c:\windows\microsoft.net\framework\<version>\confi g directory) so that
it has a "handler" reference for your .x files which matches the one it
already has for .aspx. Look for "httpHandlers" and then add this line
near .aspx (for convenenience):

<add verb="*" path="*.x" type="System.Web.UI.PageHandlerFactory"/>

Restart IIS using "iisreset /restart" and your .x files should load
just like .aspx files.

2. The following registry entries were added by me, based on
where I found aspx already in the registry, and seem to help VS.NET and
windows recognize the .x files a bit, but like I said above, it still
won't show "View Code" or similar options for .x files in VS.NET.
(Note: These changes correspond to
VS.net 2003 and .NET framework 1.1.4322. Don't blindly make these
changes. Back up your registry. Yadda yadda yadda.)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio \7.1\Languages\File
Extensions\.x]
@="{58E975A0-F8FE-11D2-A6AE-00104BCC7269}"
"unused"="HTML"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio \7.1\Editors\{8281C572-2171-45AA-A642-7D8BC1662F1C}\Extensions]

"x"=dword:00000027

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio \7.1\Editors\{57312C73-6202-49E9-B1E1-40EA1A6DC1F6}\Extensions]
"aspx"=dword:00000028
"x"=dword:00000028

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio \7.1\Projects\{CB4CE8C6-1BDB-4dc7-A4D3-65A1999772F8}\FileExtensions\.x]
"EditorFactoryNotify"="{57312C73-6202-49e9-B1E1-40EA1A6DC1F6}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio \7.1\Projects\{E6FDF86B-F3D1-11D4-8576-0002A516ECE8}\FileExtensions\.x]
"EditorFactoryNotify"="{57312C73-6202-49e9-B1E1-40EA1A6DC1F6}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio \7.1\Projects\{F184B08F-C81C-45f6-A57F-5ABD9991F28F}\FileExtensions\.x]
"EditorFactoryNotify"="{57312C73-6202-49e9-B1E1-40EA1A6DC1F6}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio \7.1\Projects\{FAE04EC0-301F-11d3-BF4B-00C04F79EFBC}\FileExtensions\.x]
"EditorFactoryNotify"="{57312C73-6202-49e9-B1E1-40EA1A6DC1F6}"

[HKEY_USERS\S-1-5-21-1496065579-1245650880-2130403006-500\Software\Microsoft\Windows\CurrentVersion\Expl orer\FileExts\.x\OpenWithProgids]
"aspxfile"=hex(0):
"VisualStudio.aspx.7.1"=hex(0):

[HKEY_CLASSES_ROOT\.x]
"PerceivedType"="text"
@="VisualStudio.aspx.7.1"

[HKEY_CLASSES_ROOT\.x\OpenWithList]

[HKEY_CLASSES_ROOT\.x\OpenWithList\devenv.exe]
@=""

[HKEY_CLASSES_ROOT\.x\OpenWithProgids]

[HKEY_CLASSES_ROOT\.x\OpenWithProgids\aspxfile]
@=""

[HKEY_CLASSES_ROOT\.x\OpenWithProgids\VisualStudio. aspx.7.1]
@=""

[HKEY_CLASSES_ROOT\.x\PersistentHandler]
@="{eec97550-47a9-11cf-b952-00aa0051fe20}"
If anyone knows what other changes are necessary to get VS.NET to
accept new asp.net file extensions, please let me know.

[Thomas]

After further investigation and after trying the VS.NET "power tools"
that claim to be able to add custom extensions to VS.NET 2003, I have
found that this is in fact not really possible. I even found some posts
from Microsofties saying that it might be possible in VS.NET 2005...

yay.