ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.

learn more… | top users | synonyms

0
votes
1answer
42 views

How restrict is an Asp .Net Web App with ipSecurity enabled?

The IT department of my company refused to host an ASP .Net Web App on our intranet. For security reasons that would be the best solution. Right now I'm considering other options. One of those is to ...
4
votes
1answer
79 views

Are recent versions of ASP.NET implementing proper authenticated encryption?

There has been uncovered before that ASP.Net does not use the authenticated encryption right (e.g. here), they used Mac-then-encrypt that lead to some practical attacks. So I am wondering if I use ...
15
votes
3answers
6k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
-3
votes
1answer
3k views

Hown I can test “Microsoft ASP.NET Forms Authentication Bypass” in ASP.Net 4.0.30319

I searched in google for "ASP.Net 4.0.30319 vulnerability " keyword. finally,I found "Microsoft ASP.NET Forms Authentication Bypass" in below link: ...
3
votes
1answer
77 views

What happens when CA server is down?

Let's assume that I have a server which accepts requests over HTTPS. The server resides in a closed environment, and relies on a local CA server. I am not sure if this is relevant, but the server is ...
2
votes
2answers
4k views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
0
votes
1answer
54 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
2
votes
2answers
111 views

Is this ASP site vulnerable to XSS or not?

I took a scan of a ASP site and it said that request validation was off. It caught it by sending a URL of example.com/?foo=<script> and received a response URL of example.com/?foo=<script> ...
18
votes
8answers
3k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
11
votes
2answers
2k views

How reliable is ASP.NET's Request Validation feature?

ASP.NET offers an extra layer to protect your application from XSS attacks and injection in general which is called Request validation. On their official topic, they mention that: Even if you're ...
4
votes
3answers
2k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
2
votes
3answers
292 views

Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?

I am working on a web application that would include some custom development and got a bit concerned about code theft. So the question I wanted to ask is whether it is - generally speaking - possible ...
2
votes
1answer
155 views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Source Some will have another firewall between the application server and ...
2
votes
2answers
70 views

Can two users share the same Request.UserHostAddress?

I am working on an ASP.NET MVC-5 web application, which is available to public users (no login is required). And I need to prevent the same user from submitting more than 5 "contact us" requests ...
0
votes
1answer
2k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: ...
3
votes
1answer
2k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a ...
0
votes
1answer
34 views

Is it worth reporting a asp.net runtime error? [closed]

I found a runtime error on united.com. Is it worth submitting? The exception doesn't seem to show any identifiable information.
4
votes
2answers
63 views

When I turn off request validation in asp.net, am I vulnerable?

So I have request validation off in my web application. You can add /foo?=<script>and my web application won't catch it -it doesn't filter it- Does this make me vulnerable to attacks; should I ...
3
votes
3answers
4k views

How does a website owner decrypt ASP.NET's Viewstate, and cookies

I'd like to audit my viewstate for information I don't want to be sent down to the client. What are the steps needed to decrypt this information into human readable form? How would I decrypt the ...
13
votes
3answers
3k views

ASP.NET MVC security check list

I am planning to start a new web site on ASP.NET MVC 2 (3). Does anybody a full (if possible) check list of actions, approaches I should reach to avoid almost problems with security?
4
votes
1answer
78 views

How did the Code Red worm work?

So I've been reading a bit about the Code Red worm, and I get the gist but the overflow string doesn't make sense to me. From this site, it says that the overflow string the worm used was ...
18
votes
3answers
32k views

How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?

Firesheep has brought the issue of insecure cookie exchanges to the forefront. How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
1
vote
1answer
101 views

Is it possible to execute Server Side Scripts despite Content-Type header?

Say, there's an upload function where users are supposed to upload images only. However, it's possible to upload arbitrary files bypassing the restriction. Say, I uploaded a shell (aspx) and ...
2
votes
0answers
144 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as ...
2
votes
1answer
167 views

Use RSA Encryption With ASP.NET

My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to ...
1
vote
0answers
105 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
2
votes
0answers
150 views

Hydra - Possible to follow redirects

I'm trying to use Hydra on an ASP web application. Their login page uses the following method: site/Login: username/password If successful, I am redirect back to site/Login but with a newly set ...
1
vote
0answers
49 views

Is it secure to use HttpSessionState.Session to store Identifying Information

I am writing an ASP.NET web app. Is there anything that is insecure to store in HttpSessionState.Session? More specifically, is it ad practice to store such information as UserID, or security ...
12
votes
6answers
7k views

Is this a ViewState attack?

I recently found this request in the event log: Client IP: 193.203.XX.XX Port: 53080 User-Agent: Mozilla/4.0 (compatible; Synapse) ViewState: -1' Referer: Now, the ViewState: -1' part combined ...
1
vote
2answers
557 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
2
votes
2answers
332 views

Security of an SQL database server used in web app

At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
2
votes
2answers
125 views

Best practice for identity management methods with regards to confirming user existence

I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in. I've been ...
1
vote
1answer
102 views

Machine certificates for accessing a web app in IIS only from an specific PC client

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
1
vote
2answers
172 views

Securing user supplied files in IIS

I have an Internet website running on IIS/Windows configured as follows: The website is publicly accessible for visitors to browse. A user can login and upload files. The user will be able to see ...
0
votes
1answer
205 views

Security benefits to have IP-filter in HttpModule instead of Page-Load in asp.net pipeline?

I'm working on implementing an IP-filter which blocks all requests by machines outside our IP-range. This is for an asp.net project (written in c#). I've read on multiple forums that the safest way ...
2
votes
1answer
257 views

Client side certificates in IIS for accessing a web app only from an specific PC

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
3
votes
2answers
3k views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
3
votes
1answer
132 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
3
votes
4answers
6k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
6
votes
1answer
268 views

Is it unwise to use Redis to store PII, private keys, and other secrets?

I'm reviewing a system that is using Redis to store all client secrets, private keys, and other things. The problem is that Redis loads the entire DB into RAM Since SSL's heartbleed, Rowhammer, and ...
1
vote
1answer
187 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
1
vote
1answer
556 views

How do I prevent tampering with form submission data, and changing the details for any account?

Although this is something that only employees can use, I'd like to prevent the tampering anyway. I don't like insecure code, and this is hideously insecure. Here's an example link: <a href="#' + ...
9
votes
4answers
830 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
1
vote
1answer
103 views

What is the best way to track the authenticated user on the server side? [closed]

For a web app, the client side is javascript in the browser. The server side is ASP.NET with a REST API. At present there is a single server but we plan to scale out with a server each in the US, UK, ...
6
votes
3answers
1k views

How to encrypt all existing customer passwords [closed]

I work for an online shop and since I worked here we have stored customer passwords in plaintext. I joined the company as a data inputter and when I discovered that we did this I flagged it up with ...
8
votes
1answer
299 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
1
vote
2answers
361 views

Is string concatenation vulnerable to null character in aspx?

I just see this line of code in VB in one file .aspx FileUpload.SaveAs(sPath & "/" & FileUpload.FileName) This line save a file that an user uploaded. It use the SaveAs method. I was ...
4
votes
3answers
191 views

Does PHP have a XSS API?

ASP.NET has a cross site scripting API by default, however does PHP have a cross site scripting prevention API?
3
votes
2answers
1k views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
4
votes
2answers
435 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...