A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

learn more… | top users | synonyms (1)

1
vote
1answer
28 views

Developer Security Training .NET / JAVA [on hold]

Hello my team is tasked to perform security focused training for developers (.NET and JAVA). I have used WebGoat to demonstrate OWASP Top 10 type security vulnerabilities and am looking for a similar ...
1
vote
1answer
40 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
0
votes
0answers
51 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
3
votes
3answers
147 views

What are the (practical) dangers of writing your own login method?

I have always been told that writing your own login method (e.g. validate user given the username and password) is bad practice, and that one should reuse existing libraries for that. I have always ...
1
vote
0answers
32 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
1
vote
1answer
45 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
0
votes
1answer
107 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
0
votes
1answer
64 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
0
votes
0answers
22 views

RSA, SSLStream - KeyExchange

I'm using sslstream to communicate a client and a server, and i need to use RSA encryption, i have made some tests with a brute keyexchange, using sslStream.write(modulusPublicKey). And receiving like ...
3
votes
2answers
46 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
0
votes
2answers
110 views

Programming languages for security? [duplicate]

I am a computer science student interested in the field of security and just had a few questions. What are the pros and cons for using C# for security purposes, I had assumed applications programmed ...
2
votes
2answers
475 views

Ways to inject malicious DLLs to exe file and run it

I'm trying to find all vulnerabilities in my given system. Assume a malicious user has the executable (.exe file) of my .NET application (C#), and a malicious DLL he or she created. Can the DLL be ...
1
vote
2answers
155 views

How to securely use Process.Start?

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The ...
0
votes
2answers
38 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
2
votes
1answer
120 views

Challenge Response Login Authentication with Password Salt

I want to implement a challenge-response login authentication for my web application. My understanding is that the server has to send back the password salt for the user so that the user can ...
1
vote
3answers
126 views

How can I add a layer of security to cleartext passwords and SSL?

I'm creating a web API in .Net for a web application. I'm wondering what the industry standard for login authentication is. I know that most people believe that sending cleartext username/passwords ...
0
votes
2answers
150 views

Encrypting files in .NET?

I am in a situation where I would like to encrypt audio and text files for an application I am working on. I did some looking around and from what I have seen the Rijndal encryption algorithm would ...
1
vote
0answers
99 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
-4
votes
3answers
3k views

How do I hack this login page by using SQL injection? [closed]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
3
votes
1answer
132 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
1
vote
1answer
72 views

Is it possible to use a .Net payload with metasploit?

I'm not exactly sure how metasploit works when exploiting a target machine, and it has been a while since of played with it, so forgive me. Instead of using meterpreter as a payload in metasploit, ...
0
votes
1answer
103 views

I get the feeling that Microsoft and Mac use two different forms of AES

I have an AES string being produced with this class, the AesCryptoServiceProvider Class provided by Microsoft. And I need to decode this encryption with Ruby's SSL::Cipher class . The problem is ...
1
vote
1answer
146 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
0
votes
1answer
118 views

How do I identify a DES encryption key in a dump file using winhex?

I've created a C# program that encrypts and decrypts a file. The encryption method is DES. The program is exactly the same as in the following link, except that the part that removes the key from ...
2
votes
1answer
144 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
1answer
115 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
0
votes
1answer
177 views

.net System.Security.Principal.WindowsPrincipal user namespace ldap injection

A recent scan of a .net web application detected an ldap injection vulnerability for a field that was used for a username assigned to an instance of a custom class named User. After stepping through ...
1
vote
1answer
327 views

How to diagnose No Certificate alert

I have written an application (in C#) to communicate with one of our customers via a web service. Our customer requires us to use bi-directional SSL. The customer has sent us their certificate (in ...
2
votes
2answers
128 views

Does the .net mvc/iis stack support whitelists for bidirectional authentication for SSL/TLS connections?

I'd like to limit access to some of my REST api, such that only bidirectional SSL/TLS connections are accepted, where the "other side" matches a detailed, restricted, whitelist. Is this something ...
1
vote
0answers
150 views

Bouncy Castle C# API and NTRUEncrypt

I want to play around with NTRUEncrypt and I found this tweet that NTRUE is now part of bouncy castle. But I cannot find any proof of the existence in the source code of teh Bouncy Castle C# API, ...
2
votes
2answers
136 views

Keyed-hashing a password with a hash of the password + salt as the key, is it safe?

I was looking at our authentication system which hashes passwords differently than I was taught. The salt is a constant byte array and it uses the password + the salt as a key for the password hashing ...
2
votes
1answer
149 views

OAuth2 - Is it safe to return the access-token to the user?

I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range ...
4
votes
2answers
530 views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
0
votes
1answer
62 views

Seeking help with implementing SCRAM in .NET

I'm late to the party and need to be caught up. I'm doing my homework looking things up. I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM. I think ...
2
votes
2answers
195 views

Security concerns with a “fiddle” site?

I recently came across a cool site for testing .NET code (http://dotnetfiddle.net/). In the FAQs they mention that they have two restrictions for security purposes: No access to File System IO No ...
1
vote
0answers
97 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); ...
2
votes
1answer
375 views

AES key management

I am encrypting a secret in a db field. I am encrypting using AES with a 256-bit key and a random IV per encryption. They AES key is hard coded in the code. Each IV is stored in clear in another ...
3
votes
2answers
3k views

Using AesCryptoServiceProvider in C#, should using an incorrect IV mangle just the first block?

This question was also asked on StackOverflow, but with no answers, and I thought this may be a better exchange, since I have the same question. ...
0
votes
1answer
470 views

Is this password hashing + salt method the most secure way possible? [duplicate]

I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects. First I create a ...
1
vote
2answers
240 views

Authorization in offline application

I'm working on a machine which needs to store usernames and passwords for the various operators, technicians, and engineers that may be using and configuring it. It is important that some functions be ...
2
votes
1answer
691 views

Evaluate the signature of an X509 certificate in .NET

This is my scenario: A CA signs a certificate with its private key and sends it to a client via https response. From this response the client creates a X509Certificate2 class, that represents the ...
3
votes
1answer
728 views

Hashing passwords before inserting into database

For the last 2 weeks I have been reading many blogs about website security and hashing passwords. Many sites have mentioned the pro's and cons about different ways of doing this, which has left me a ...
2
votes
2answers
280 views

In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?

I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
-1
votes
1answer
139 views

How easily can the key of a .NET assembly be cracked?

If I sign a .NET assembly and do not give out my private key, how much effort would it take for somebody to crack the private key?
4
votes
2answers
89 views

Code-signing application from different locations

In our company, one of the software group is using a certificate from a trusted provider to sign their drivers manually on their local machine. My group wants to start to sign our installers and some ...
0
votes
1answer
726 views

Why aren't sophisticated Malware written with .NET [closed]

I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my 7+ years in .NET, I feel that I could write a ...
0
votes
1answer
322 views

How to encrypt files without giving the user access? [duplicate]

I don't know if I should ask this question on security.SE or stackoverflow, so please move my post if necessary. I want to store my (C#) application data in a way that the user cannot read or modify ...
2
votes
1answer
217 views

How to Verify the Identity of the Caller of a Web Service

I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself. Now, my question is, how do I ...
-6
votes
1answer
4k views

Asymmetric encryption algorithms [closed]

What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
7
votes
1answer
705 views

A practical .NET Remoting Architecture exploit

If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose? I've read J. Forshaw's white paper on Breaking .NET Through Serialization ...