ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.
15
votes
2answers
2k views
When the use of a AntiForgeryToken is not required /needed?
I'm running a rather large site with thousands of visits every day, and a rather large userbase.
Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
3
votes
5answers
243 views
Password reset links: random value or authenticated message?
Which is better?
Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token.
Generate a random token and store it in the ...
7
votes
3answers
3k views
Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?
If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this?
What is the extent and ...
4
votes
3answers
336 views
Create a page to experiment with SQL injection [closed]
This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
6
votes
1answer
590 views
ASP.NET HTTP Response Splitting Attack
By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect:
...
6
votes
2answers
1k views
C# Image.FromStream is that secure?
after reading the data from the request as Stream i needed to convert it to Image so i used this Method:
Stream inputStream = HttpContext.Current.Request.InputStream;
Image img = ...
6
votes
3answers
173 views
Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?
I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
4
votes
2answers
364 views
Possible arbitrary file download vulnerablity
I am auditing a possible vulnerable piece of ASP code on a Windows enviroment. The code is as follows:
If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then
Basicly it is ...
