A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

learn more… | top users | synonyms (1)

1
vote
0answers
26 views

Securing customer assets in .NET

We are rethinking our security and came on an interesting issue. How can me make a generic security implementation for customer owned assets. Does every asset need a direct-indirect relation to a ...
0
votes
1answer
39 views

generate certificate at runtime and validate

I have a project that require client application to register and then use the services. I would like to do the following: A client app sends a request with IP, domain name, etc. to my REST service ...
1
vote
0answers
62 views

Why do we need salt and RFC in generating AES encrypted message

I'm not very familiar with encryption and new to this, I'm just learning it right now by code review of one of the class we have in an application to encrypt a password using AES. Would anyone explain ...
0
votes
1answer
24 views

Exposing Model to POCO in MVVM Entity Framework Application

To start with, I am dangerously bad at security. I am aware of this, which is why I'm asking for help to figure this out. I have a POCO object, which is exposing an ICollection of a model object, so ...
1
vote
1answer
37 views

Is there a way to verify a signed XML in Java

.NET has this great way to sign and then verify the signature of an XML file. Is there a way in Java to verify an XML file that .NET has signed this way? thanks - dave
0
votes
2answers
76 views

Key Management/storage system

In my firm we have a couple of thousand hardware devices, installed externally, that all send back data to a central server. They send back data about every hour. Each of these hardware devices ...
-1
votes
1answer
47 views

Measures that must be taken to protect online banking website [closed]

I building an online banking service in ASP.NET and my objective is to implement all possible security measures. Currently at database level I am using RES 2048 bit encryption to encrypt database ...
3
votes
1answer
321 views

How can I detect a VPN connection (even just in some cases) to get the real location of the user

I'm creating a web site, I would like to allow people to sign-up only from their "real" physical location (not using a VPN). I was thinking maybe comparing local and server time... what else...? I ...
0
votes
2answers
342 views

Difference Between MD4 and MD5 encryption

During coding, I have used both MD4 and MD5 encryption techniques. But there hasn't been any noticeable security difference between either of them. And yet, most of them prefer MD5, in fact specify ...
3
votes
4answers
111 views

Lock a website login to a certain computer

I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate ...
1
vote
1answer
101 views

Is there any advantage in encrypting a password hash in my database?

I am hashing and storing the salt:hash of each user's password in our database. The web server is ASP.NET and the connection string to the database in web.config is encrypted using the IIS config ...
3
votes
1answer
95 views

Does encrypting a setting in web.config actually provide security?

Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, ...
-1
votes
1answer
704 views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
3
votes
1answer
217 views

Encrypting/decrypting our license key

We need to provide a license key to customers for our application. The actual license is XML but we need to encrypt it and then in our program decrypt it. I think it is the following, but am asking to ...
0
votes
1answer
79 views

How to identify hackers based on ip addresses and the pages that were accessed

I saw some suspicious errors being generated on my site based on pages that were requested. My error is logging the path that the user is trying to access. Because of these errors (and the paths that ...
1
vote
1answer
49 views

Developer Security Training .NET / JAVA [closed]

Hello my team is tasked to perform security focused training for developers (.NET and JAVA). I have used WebGoat to demonstrate OWASP Top 10 type security vulnerabilities and am looking for a similar ...
2
votes
1answer
109 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
0
votes
0answers
76 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
3
votes
3answers
161 views

What are the (practical) dangers of writing your own login method?

I have always been told that writing your own login method (e.g. validate user given the username and password) is bad practice, and that one should reuse existing libraries for that. I have always ...
1
vote
0answers
51 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
1
vote
1answer
122 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
1
vote
1answer
133 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
1
vote
1answer
71 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
0
votes
0answers
36 views

RSA, SSLStream - KeyExchange

I'm using sslstream to communicate a client and a server, and i need to use RSA encryption, i have made some tests with a brute keyexchange, using sslStream.write(modulusPublicKey). And receiving like ...
3
votes
2answers
84 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
0
votes
2answers
147 views

Programming languages for security? [duplicate]

I am a computer science student interested in the field of security and just had a few questions. What are the pros and cons for using C# for security purposes, I had assumed applications programmed ...
2
votes
2answers
1k views

Ways to inject malicious DLLs to exe file and run it

I'm trying to find all vulnerabilities in my given system. Assume a malicious user has the executable (.exe file) of my .NET application (C#), and a malicious DLL he or she created. Can the DLL be ...
1
vote
2answers
300 views

How to securely use Process.Start?

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The ...
0
votes
2answers
62 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
2
votes
1answer
197 views

Challenge Response Login Authentication with Password Salt

I want to implement a challenge-response login authentication for my web application. My understanding is that the server has to send back the password salt for the user so that the user can ...
1
vote
3answers
154 views

How can I add a layer of security to cleartext passwords and SSL?

I'm creating a web API in .Net for a web application. I'm wondering what the industry standard for login authentication is. I know that most people believe that sending cleartext username/passwords ...
0
votes
2answers
164 views

Encrypting files in .NET?

I am in a situation where I would like to encrypt audio and text files for an application I am working on. I did some looking around and from what I have seen the Rijndal encryption algorithm would ...
1
vote
0answers
129 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
-4
votes
3answers
8k views

How do I hack this login page by using SQL injection? [closed]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
3
votes
1answer
190 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
1
vote
1answer
88 views

Is it possible to use a .Net payload with metasploit?

I'm not exactly sure how metasploit works when exploiting a target machine, and it has been a while since of played with it, so forgive me. Instead of using meterpreter as a payload in metasploit, ...
0
votes
1answer
131 views

I get the feeling that Microsoft and Mac use two different forms of AES

I have an AES string being produced with this class, the AesCryptoServiceProvider Class provided by Microsoft. And I need to decode this encryption with Ruby's SSL::Cipher class . The problem is ...
1
vote
1answer
218 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
0
votes
1answer
156 views

How do I identify a DES encryption key in a dump file using winhex?

I've created a C# program that encrypts and decrypts a file. The encryption method is DES. The program is exactly the same as in the following link, except that the part that removes the key from ...
3
votes
2answers
220 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
1answer
190 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
0
votes
1answer
227 views

.net System.Security.Principal.WindowsPrincipal user namespace ldap injection

A recent scan of a .net web application detected an ldap injection vulnerability for a field that was used for a username assigned to an instance of a custom class named User. After stepping through ...
1
vote
1answer
539 views

How to diagnose No Certificate alert

I have written an application (in C#) to communicate with one of our customers via a web service. Our customer requires us to use bi-directional SSL. The customer has sent us their certificate (in ...
2
votes
2answers
178 views

Does the .net mvc/iis stack support whitelists for bidirectional authentication for SSL/TLS connections?

I'd like to limit access to some of my REST api, such that only bidirectional SSL/TLS connections are accepted, where the "other side" matches a detailed, restricted, whitelist. Is this something ...
1
vote
0answers
192 views

Bouncy Castle C# API and NTRUEncrypt

I want to play around with NTRUEncrypt and I found this tweet that NTRUE is now part of bouncy castle. But I cannot find any proof of the existence in the source code of teh Bouncy Castle C# API, ...
2
votes
2answers
160 views

Keyed-hashing a password with a hash of the password + salt as the key, is it safe?

I was looking at our authentication system which hashes passwords differently than I was taught. The salt is a constant byte array and it uses the password + the salt as a key for the password hashing ...
3
votes
1answer
214 views

OAuth2 - Is it safe to return the access-token to the user?

I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range ...
4
votes
2answers
1k views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
0
votes
1answer
74 views

Seeking help with implementing SCRAM in .NET

I'm late to the party and need to be caught up. I'm doing my homework looking things up. I know that I don't want unsalted challenge-response CRAM, I want salted challenge-response SCRAM. I think ...
2
votes
2answers
210 views

Security concerns with a “fiddle” site?

I recently came across a cool site for testing .NET code (http://dotnetfiddle.net/). In the FAQs they mention that they have two restrictions for security purposes: No access to File System IO No ...