1
vote
1answer
169 views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
2
votes
3answers
188 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
5
votes
1answer
253 views

Web Applications terminate strings on null-byte

I have just been doing some penetration testing on a site, and I have noticed (and I have noticed before but now seems like a good point to bring it up) that putting a null byte in the search string ...
15
votes
5answers
1k views

Is it possible to inject values in a drop down list?

Say a ASP.NET page, or any html page for that matter, has a drop down list with a bunch of prices. On posting the page, the code looks at the selection of the drop down list for a computation. Is it ...
4
votes
1answer
364 views

Encrypted view state vulnerable?

While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states: An attacker who successfully exploited this vulnerability could ...
3
votes
2answers
467 views

How to determine if ViewState has MAC enabled when crawling a page?

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled. I'm curious if anyone know of a ...
4
votes
4answers
434 views

“Forgot my password page” best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
-2
votes
1answer
114 views

Using Old version of mysql connector's security issue [closed]

I'm using asp.net 4.0 and MySQL. Last week my hosting firm changed security level of from full to medium. MySQL connector doesn't work correctly anymore. For this reason I'm using old version of ...
0
votes
1answer
959 views

ASP.net vs PHP security? [closed]

I have been told that generally speaking, asp.net web apps tend to be more secure than php, since asp.net has some automatic security measures, for example, by default it doesn't allow remote file ...
4
votes
3answers
840 views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
1
vote
2answers
265 views

Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company. [closed]

What professional standards and practices are recommended for guiding such an effort?
1
vote
3answers
202 views

Is a web application being built on an open-source platform less secure because it is open-source?

With the recent news that microsoft are releasing the source code for their ASP.NET Web API and web pages 1 I'm wondering, Does having access to the source code of the underlying libraries a web ...
2
votes
1answer
370 views

What threats does a stateless web application have? (as opposed to a “state-full” sessions)

I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate. Assuming that there is a webfarm of more than 1 web ...
9
votes
4answers
495 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
4
votes
3answers
1k views

Is it necessary to encrypt an ASP.NET view state hidden field when using SSL certificate?

If you have an SSL certificate for a web site, is it necessary to make the ViewState more difficult to decode. Without any extra development, it appears that ASP.NET encodes it as a base 64 string. ...
8
votes
2answers
1k views

How secure are the default ASP.NET membership and role providers for Sql Server?

I have a very basic idea of how these work. I've used them many times when I needed a user management system rather then writing my own. But should I use these for a production system? Would ...
8
votes
3answers
260 views

Verify a website user is behind corporate firewall?

We have a public ecommerce website hosted at our datacenter onsite. For people who are within the corporate firewall hitting the website I want to display profiling information about the request of ...
1
vote
2answers
405 views

AntiXSS for ASP.NET 1.1

Unfortunately, a client of mine still has an application based on ASP.NET 1.1. Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them. ...
13
votes
2answers
13k views

How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?

Firesheep has brought the issue of insecure cookie exchanges to the forefront. How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
10
votes
6answers
1k views

Is there a security risk running web apps in debug=“true”?

This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here: There are plenty of performance reasons why apps shouldn't be run in ...
3
votes
3answers
2k views

How does a website owner decrypt ASP.NET's Viewstate, and cookies

I'd like to audit my viewstate for information I don't want to be sent down to the client. What are the steps needed to decrypt this information into human readable form? How would I decrypt the ...
4
votes
2answers
998 views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
12
votes
3answers
1k views

Asp.net mvc security check list

I am planning to start a new web site on asp.net mvc 2 (3). Have anybody a full (if possible) check list of actions, approaches I should reach to avoid almost problems with security.