ASP.NET - Steps to be taken to prevent a hacker from hacking a web appCollection of websites)

Steps to be taken to prevent a hacker from hacking a web application which is a Collection of websites)

The low hanging fruit is sql injection.  Next, keep as many of your folders in IIS set to not enable browsing.  If you have WCF or Webservices, make sure you keep their endpoints hidden if possible and make sure you do not enable the meta feature in the web.config that exposes the structure of your service.

Be aware that there are all sorts of ways to automated the submission of forms that lead to posting of content you don't want.  Using http posts to your page and pre-filling the form elements is the most common.  One could also use the WebControl browser control on  a .NET form to react to page DOM events, execute clicks, and execute JavaScript and react to it.

"make sure you do not enable the meta feature in the web.config that exposes the structure of your service" If i disable 

 <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>

then how the enduser can have wsdl  using which he/she creates a proxy on the client side that will communicate with the stub on the server side? Could you please elaborate it ?

In your production web.config, remove this endpoint.  There are some WCF security suggestions in this Silverlight article that apply to WCF services with clients other than Silverlight.

https://www.nullskull.com/a/1373/silverlight-wcf-security-and-things-you-might-not-know.aspx

Thanks Morris
Very informative article.