ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.

learn more… | top users | synonyms

3
votes
1answer
2k views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to ...
2
votes
1answer
635 views

What method for CSRF token generation should I use in my scenario?

I'm working on a RESTful API to work with my AngularJS application. Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using ...
3
votes
4answers
552 views

Shared hosting vs VPS

I have an Asp.net site. Which hosting system do I need to secure it adequately* against anyone reading private information that's on the server? This is assuming I'm not worried about the sysadmins ...
3
votes
3answers
287 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
3
votes
4answers
4k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
1
vote
1answer
337 views

IIS 7.5 WebDav Security Issues with Students

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
-6
votes
3answers
186 views

How to be secure your page from Zeus Trojan?

How can I prevent from an attack like this? http://www.youtube.com/watch?v=bgt98VajOv4 Edit: Sorry guys, I think I can't explain my question well. I don't want to secure myself from that trojan. I ...
6
votes
1answer
782 views

Web Applications terminate strings on null-byte

I have just been doing some penetration testing on a site, and I have noticed (and I have noticed before but now seems like a good point to bring it up) that putting a null byte in the search string ...
2
votes
1answer
2k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
16
votes
5answers
2k views

Is it possible to inject values in a drop down list?

Say a ASP.NET page, or any html page for that matter, has a drop down list with a bunch of prices. On posting the page, the code looks at the selection of the drop down list for a computation. Is it ...
1
vote
2answers
470 views

Web Services and WSDL Documentation Protocol

Let us assume that I have a web service in an ASP.NET project. If I turn off the WSDL documentation protocol, will other users be able to: add a service reference to the web service? discover the ...
4
votes
1answer
1k views

Encrypted view state vulnerable?

While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states: An attacker who successfully exploited this vulnerability could ...
3
votes
2answers
2k views

How to determine if ViewState has MAC enabled when crawling a page?

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled. I'm curious if anyone know of a ...
5
votes
4answers
1k views

“Forgot my password page” best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
9
votes
2answers
1k views

How reliable is ASP.NET's Request Validation feature?

ASP.NET offers an extra layer to protect your application from XSS attacks and injection in general which is called Request validation. On their official topic, they mention that: Even if you're ...
-2
votes
1answer
186 views

Using Old version of mysql connector's security issue [closed]

I'm using asp.net 4.0 and MySQL. Last week my hosting firm changed security level of from full to medium. MySQL connector doesn't work correctly anymore. For this reason I'm using old version of ...
14
votes
7answers
2k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
4
votes
3answers
440 views

Understanding JVM zero day in relationship with other runtimes

I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security. In regards to the java zero days, this question has ...
5
votes
1answer
2k views

Pen Testing ASP.NET application with Backtrack

We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and ...
1
vote
1answer
82 views

Password Verification Server

I posted a question here... Protecting Password Hashes with Store Procedures? ...where I asked about denying a website's database user CRUD access to the tables that store password hashes except ...
3
votes
2answers
712 views

IIS 7.5 impersonation threat?

I am using IIS 7.5 and I want to impersonate users for my different applications in an intranet environnement. To do so, I am considering using the asp.net mechanism with the user/password in the ...
1
vote
1answer
3k views

ASP.net vs PHP security? [closed]

I have been told that generally speaking, asp.net web apps tend to be more secure than php, since asp.net has some automatic security measures, for example, by default it doesn't allow remote file ...
5
votes
2answers
6k views

ASP.NET vulnerability CVE-2008-5100 (assembly signing bypass): is there a fix?

The short version of this question is:  Is there a fix or mitigation for the ASP.NET vulnerability CVE-2008-5100, which allows attackers to bypass assembly digital signature checking? I'll ...
3
votes
2answers
562 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
1
vote
2answers
367 views

What is a better practice - RSA Encryption vs Windows authentication

I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I ...
3
votes
5answers
4k views

Password reset links: random value or authenticated message?

Which is better? Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token. Generate a random token and store it in the ...
1
vote
1answer
605 views

Setting up ASP.NET web application on internet for first time; Are these security measures enough?

I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities). This application ...
2
votes
1answer
323 views

Accessing encrypted data with multiple users

I'm building a web based, LDAP authenticated password manager for internal use. We don't want to store the passwords in plain-text in the database, and we want multiple users to be able to access the ...
6
votes
1answer
962 views

Secure query string parameters

I have an application which use the Thick box jQuery component to open a popup page . And I pass my parameters in query string like this : <a id="btnShowPopup6" runat="server" class="thickbox" ...
0
votes
1answer
345 views

My website keeps getting infected [closed]

I recently started getting this really weird problem where a virus seems to pop up as frequently as once a week in my site. It is running on BlogEngine and basically what happens is this: A bunch of ...
0
votes
1answer
172 views

Comparison between Data Encryption Tools and Data Sanitization Tools [closed]

What are the famous Data Sanitization Tools for languages such as ASP/PHP/Html Web Sites? Which Data Sanitization tools have the best results? Difference between Data encryption and Data ...
4
votes
3answers
1k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
2
votes
3answers
2k views

Potential consequences of using “Everyone” to manage permissions?

If a web application is set to run using a specific account, could a malicious user do something they shouldn't if I use the "Everyone" account to manage permissions on a folder on the server? The ...
4
votes
1answer
1k views

Is ASP.NET Event Validation completely secure?

I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism. Is there some way to bypass it? How much assurance is there that it cannot be ...
3
votes
1answer
302 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
3
votes
1answer
587 views

Backdoor.ASP.Ace.C keeps showing up and being removed by f-secure

Backdoor.ASP.Ace.C is being found and removed from: C:\Users[username]\AppData\Local\Temp[randomstring] We have recently found some malicious aspx files on our IIS server that we have studied and ...
2
votes
2answers
4k views

How does ViewState protect against CSRF?

According to the OWASP CSRF Cheat Sheet viewStateUserKey for ASP.NET ViewState is acceptable to prevent csrf attacks, but I really don't get how. I get that this makes it hard for an attacker to ...
11
votes
6answers
6k views

Is this a ViewState attack?

I recently found this request in the event log: Client IP: 193.203.XX.XX Port: 53080 User-Agent: Mozilla/4.0 (compatible; Synapse) ViewState: -1' Referer: Now, the ViewState: -1' part combined ...
15
votes
3answers
5k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
4
votes
2answers
971 views

Possible arbitrary file download vulnerability

I am auditing a possible vulnerable piece of ASP code on a Windows environment. The code is as follows: If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then Basicly it is ...
4
votes
2answers
894 views

Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
4
votes
1answer
1k views

Encrypt Medicare card numer in C# in ASP.NET

I am giving a free consultation for a non profit organisation that wants a simple system to manage multiple groups with a schedule component, etc. and also manage the medical informations of the kids. ...
2
votes
3answers
1k views

How to do a virus scan before post attachments in asp.net application

How to do a virus scan before post attachments in asp.net application,when they find a virus on to give up post attachments,otherwise proceed to upload. I wonder if there are any APIs out there where ...
1
vote
2answers
417 views

Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company. [closed]

What professional standards and practices are recommended for guiding such an effort?
3
votes
3answers
469 views

Possible holes in this ASP.NET security design?

So I plan on updating some data via an ASMX web service on a web server via .NET programs running elsewhere. The primary security concern is that this web service needs to spawn a process to handle ...
1
vote
3answers
240 views

Is a web application being built on an open-source platform less secure because it is open-source?

With the recent news that microsoft are releasing the source code for their ASP.NET Web API and web pages 1 I'm wondering, Does having access to the source code of the underlying libraries a web ...
2
votes
2answers
740 views

How do I find .asmx files?

I have a web service (ASP.NET) running on my application server. It can be reached via http://xxxxxx/Servercomponents/servercomp.asmx Is possible to find this even if you don't know the file name ...
6
votes
2answers
3k views

C# Image.FromStream is that secure?

after reading the data from the request as Stream i needed to convert it to Image so i used this Method: Stream inputStream = HttpContext.Current.Request.InputStream; Image img = ...
7
votes
1answer
1k views

ASP.NET HTTP Response Splitting Attack

By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect: ...
3
votes
2answers
148 views

Website file being altered

I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack. The websites have very little in common other ...