A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

learn more… | top users | synonyms (1)

3
votes
1answer
41 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
1
vote
1answer
29 views

Is it possible to use a .Net payload with metasploit?

I'm not exactly sure how metasploit works when exploiting a target machine, and it has been a while since of played with it, so forgive me. Instead of using meterpreter as a payload in metasploit, ...
0
votes
1answer
80 views

I get the feeling that Microsoft and Mac use two different forms of AES

I have an AES string being produced with this class, the AesCryptoServiceProvider Class provided by Microsoft. And I need to decode this encryption with Ruby's SSL::Cipher class . The problem is ...
1
vote
1answer
66 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
0
votes
0answers
7 views

Fragroute in Windows 7? [migrated]

Has anyone had any luck running fragroute in windows 7, or is there any other application you can recommend which does the same? I notice that the last compatible windows was 2000 which makes me think ...
0
votes
1answer
56 views

How do I identify a DES encryption key in a dump file using winhex?

I've created a C# program that encrypts and decrypts a file. The encryption method is DES. The program is exactly the same as in the following link, except that the part that removes the key from ...
1
vote
0answers
48 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
1answer
60 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
0
votes
1answer
64 views

.net System.Security.Principal.WindowsPrincipal user namespace ldap injection

A recent scan of a .net web application detected an ldap injection vulnerability for a field that was used for a username assigned to an instance of a custom class named User. After stepping through ...
1
vote
1answer
112 views

How to diagnose No Certificate alert

I have written an application (in C#) to communicate with one of our customers via a web service. Our customer requires us to use bi-directional SSL. The customer has sent us their certificate (in ...
1
vote
1answer
46 views

Does the .net mvc/iis stack support whitelists for bidirectional authentication for SSL/TLS connections?

I'd like to limit access to some of my REST api, such that only bidirectional SSL/TLS connections are accepted, where the "other side" matches a detailed, restricted, whitelist. Is this something ...
1
vote
0answers
78 views

Bouncy Castle C# API and NTRUEncrypt

I want to play around with NTRUEncrypt and I found this tweet that NTRUE is now part of bouncy castle. But I cannot find any proof of the existence in the source code of teh Bouncy Castle C# API, ...
2
votes
2answers
111 views

Keyed-hashing a password with a hash of the password + salt as the key, is it safe?

I was looking at our authentication system which hashes passwords differently than I was taught. The salt is a constant byte array and it uses the password + the salt as a key for the password hashing ...
2
votes
1answer
87 views

OAuth2 - Is it safe to return the access-token to the user?

I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range ...
4
votes
2answers
197 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
0
votes
1answer
50 views

Seeking help with implementing SCRAM in .NET

I'm late to the party and need to be caught up. I'm doing my homework looking things up. I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM. I think ...
2
votes
2answers
185 views

Security concerns with a “fiddle” site?

I recently came across a cool site for testing .NET code (http://dotnetfiddle.net/). In the FAQs they mention that they have two restrictions for security purposes: No access to File System IO No ...
1
vote
0answers
83 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
2
votes
1answer
228 views

AES key management

I am encrypting a secret in a db field. I am encrypting using AES with a 256-bit key and a random IV per encryption. They AES key is hard coded in the code. Each IV is stored in clear in another ...
3
votes
2answers
2k views

Using AesCryptoServiceProvider in C#, should using an incorrect IV mangle just the first block?

This question was also asked on StackOverflow, but with no answers, and I thought this may be a better exchange, since I have the same question. ...
0
votes
1answer
350 views

Is this password hashing + salt method the most secure way possible? [duplicate]

I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects. First I create a ...
1
vote
2answers
221 views

Authorization in offline application

I'm working on a machine which needs to store usernames and passwords for the various operators, technicians, and engineers that may be using and configuring it. It is important that some functions be ...
2
votes
1answer
327 views

Evaluate the signature of an X509 certificate in .NET

This is my scenario: A CA signs a certificate with its private key and sends it to a client via https response. From this response the client creates a X509Certificate2 class, that represents the ...
3
votes
1answer
476 views

Hashing passwords before inserting into database

For the last 2 weeks I have been reading many blogs about website security and hashing passwords. Many sites have mentioned the pro's and cons about different ways of doing this, which has left me a ...
2
votes
2answers
185 views

In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?

I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
-1
votes
1answer
123 views

How easily can the key of a .NET assembly be cracked?

If I sign a .NET assembly and do not give out my private key, how much effort would it take for somebody to crack the private key?
4
votes
2answers
80 views

Code-signing application from different locations

In our company, one of the software group is using a certificate from a trusted provider to sign their drivers manually on their local machine. My group wants to start to sign our installers and some ...
0
votes
1answer
520 views

Why aren't sophisticated Malware written with .NET [closed]

I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my 7+ years in .NET, I feel that I could write a ...
0
votes
1answer
286 views

How to encrypt files without giving the user access? [duplicate]

I don't know if I should ask this question on security.SE or stackoverflow, so please move my post if necessary. I want to store my (C#) application data in a way that the user cannot read or modify ...
2
votes
1answer
166 views

How to Verify the Identity of the Caller of a Web Service

I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself. Now, my question is, how do I ...
-5
votes
1answer
3k views

Asymmetric encryption algorithms [closed]

What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
7
votes
1answer
585 views

A practical .NET Remoting Architecture exploit

If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose? I've read J. Forshaw's white paper on Breaking .NET Through Serialization ...
2
votes
1answer
87 views

How does a function certificate work?

Say that we have a client / server solution (written in .NET). If we want to use a certificate for the TCP communication, is it enough to use one function/service certificate to encrypt communication ...
1
vote
0answers
260 views

OTR and/or SecureIM library for C# .NET [closed]

I'm looking for implementations (or even wrappers) for OTR or SecureIM encrypted chat protocols usable from C#. Currently I found none, and considering porting Java OTR library and/or wrapping ...
1
vote
2answers
870 views

Questions to hybrid encryption. RSA with AES

I want to use a hybrid encryption in my application, so after reading a lot of lines I ended with this implemantation, please critizie it ;) (I want to stick to .Net) byte[] aesKey = ...
5
votes
3answers
406 views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
1
vote
2answers
85 views

How do I sanitize and check large numbers that will be sent to an unmanaged BigNum library like GMP?

I need to process data that is sent by users in a LargeNumber format. My current choices are BigInteger (.Net Managed Code) IntX (Managed Code, faster for some operations) GMP / MPIR (Unmanaged ...
1
vote
2answers
184 views

How to check whether the cookie is set securely

I found solution for setting asp.net_sessionid cookie as secure. The solution is to make changes in web.config file as given below. <\system.web> I want to know if this change is setting the ...
4
votes
2answers
404 views

How to correctly implement AES in a backup application

I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is ...
1
vote
2answers
502 views

UNION SQL Injection

I'm trying to demo SQL Injection with a UNION query but I'm not getting results. This is the C# code and the database is SQL Server 2008 R2: string cString = "server=.\\sqlexpress; ...
1
vote
1answer
375 views

Setting up ASP.NET web application on internet for first time; Are these security measures enough?

I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities). This application ...
6
votes
1answer
713 views

Secure query string parameters

I have an application which use the Thick box jQuery component to open a popup page . And I pass my parameters in query string like this : <a id="btnShowPopup6" runat="server" class="thickbox" ...
5
votes
4answers
959 views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
2
votes
1answer
478 views

Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?

Question Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start") ...
9
votes
3answers
1k views

How can I encrypt a file with .NET and have the same file size of the original file?

I'm using .NET and I've written an awesome routine (xD) that encrypts and decrypts a file using AES256 CBC. It works perfectly, but now they told me that the encrypted file must be of the same size of ...
5
votes
1answer
764 views

“Hello World” example of a Buffer Overflow attack in many programming languages

I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used Ideally (and if ...
1
vote
4answers
2k views

What Are The Best Practices (Application Security Policy) For Modifying Rijndael Salt, IV, Pass Phrase

(Note: originally posted in SO - advised to post on SSE) With regards to Rijndael encryption, what (if any) are the best practices (and consequences) regarding the periodic modification of one or ...
7
votes
2answers
1k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
3
votes
1answer
2k views

Is PBKDF2 only SHA1 in C#?

I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography. It seems to be just SHA1. Am I missing ...
6
votes
2answers
787 views

Production ready bcrypt implementation for .NET

Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments? I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...