ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.

learn more… | top users | synonyms

60
votes
2answers
21k views

When the use of a AntiForgeryToken is not required /needed?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
57
votes
6answers
9k views

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None ...
19
votes
8answers
3k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
19
votes
3answers
35k views

How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?

Firesheep has brought the issue of insecure cookie exchanges to the forefront. How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
17
votes
3answers
6k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
16
votes
5answers
3k views

Is it possible to inject values in a drop down list?

Say a ASP.NET page, or any html page for that matter, has a drop down list with a bunch of prices. On posting the page, the code looks at the selection of the drop down list for a computation. Is it ...
13
votes
3answers
3k views

ASP.NET MVC security check list

I am planning to start a new web site on ASP.NET MVC 2 (3). Does anybody a full (if possible) check list of actions, approaches I should reach to avoid almost problems with security?
12
votes
6answers
7k views

Is this a ViewState attack?

I recently found this request in the event log: Client IP: 193.203.XX.XX Port: 53080 User-Agent: Mozilla/4.0 (compatible; Synapse) ViewState: -1' Referer: Now, the ViewState: -1' part combined ...
12
votes
6answers
4k views

Is there a security risk running web apps in debug=“true”?

This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here: There are plenty of performance reasons why apps shouldn't be run in ...
11
votes
2answers
11k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
11
votes
2answers
2k views

How reliable is ASP.NET's Request Validation feature?

ASP.NET offers an extra layer to protect your application from XSS attacks and injection in general which is called Request validation. On their official topic, they mention that: Even if you're ...
9
votes
4answers
853 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
8
votes
2answers
626 views

Are userid and password needed in order to pentest a website?

We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
8
votes
3answers
452 views

Verify a website user is behind corporate firewall?

We have a public ecommerce website hosted at our datacenter onsite. For people who are within the corporate firewall hitting the website I want to display profiling information about the request of ...
8
votes
1answer
2k views

ASP.NET HTTP Response Splitting Attack

By default ASP.NET checks for HTTP Response Splitting attack when you do Response.Redirect: ...
8
votes
1answer
346 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
8
votes
2answers
2k views

How secure are the default ASP.NET membership and role providers for Sql Server?

I have a very basic idea of how these work. I've used them many times when I needed a user management system rather then writing my own. But should I use these for a production system? Would ...
7
votes
2answers
3k views

C# Image.FromStream is that secure?

after reading the data from the request as Stream i needed to convert it to Image so i used this Method: Stream inputStream = HttpContext.Current.Request.InputStream; Image img = ...
7
votes
3answers
1k views

How to encrypt all existing customer passwords [closed]

I work for an online shop and since I worked here we have stored customer passwords in plaintext. I joined the company as a data inputter and when I discovered that we did this I flagged it up with ...
7
votes
2answers
8k views

ASP.NET vulnerability CVE-2008-5100 (assembly signing bypass): is there a fix?

The short version of this question is:  Is there a fix or mitigation for the ASP.NET vulnerability CVE-2008-5100, which allows attackers to bypass assembly digital signature checking? I'll ...
6
votes
1answer
1k views

Web Applications terminate strings on null-byte

I have just been doing some penetration testing on a site, and I have noticed (and I have noticed before but now seems like a good point to bring it up) that putting a null byte in the search string ...
6
votes
1answer
1k views

Secure query string parameters

I have an application which use the Thick box jQuery component to open a popup page . And I pass my parameters in query string like this : <a id="btnShowPopup6" runat="server" class="thickbox" ...
6
votes
1answer
295 views

Is it unwise to use Redis to store PII, private keys, and other secrets?

I'm reviewing a system that is using Redis to store all client secrets, private keys, and other things. The problem is that Redis loads the entire DB into RAM Since SSL's heartbleed, Rowhammer, and ...
6
votes
1answer
5k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a ...
6
votes
1answer
2k views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
5
votes
5answers
6k views

Password reset links: random value or authenticated message?

Which is better? Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token. Generate a random token and store it in the ...
5
votes
3answers
3k views

Is it necessary to encrypt an ASP.NET view state hidden field when using SSL certificate?

If you have an SSL certificate for a web site, is it necessary to make the ViewState more difficult to decode. Without any extra development, it appears that ASP.NET encodes it as a base 64 string. ...
5
votes
1answer
3k views

Pen Testing ASP.NET application with Backtrack

We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and ...
5
votes
4answers
2k views

“Forgot my password page” best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
4
votes
4answers
7k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
4
votes
2answers
460 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...
4
votes
3answers
197 views

Does PHP have a XSS API?

ASP.NET has a cross site scripting API by default, however does PHP have a cross site scripting prevention API?
4
votes
4answers
4k views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
4
votes
3answers
2k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
4
votes
1answer
3k views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to ...
4
votes
3answers
333 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
4
votes
1answer
1k views

Encrypted view state vulnerable?

While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states: An attacker who successfully exploited this vulnerability could ...
4
votes
1answer
2k views

Is ASP.NET Event Validation completely secure?

I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism. Is there some way to bypass it? How much assurance is there that it cannot be ...
4
votes
1answer
111 views

How did the Code Red worm work?

So I've been reading a bit about the Code Red worm, and I get the gist but the overflow string doesn't make sense to me. From this site, it says that the overflow string the worm used was ...
4
votes
1answer
862 views

Should we bother with cell-level encryption for an ASP.NET/SQL Server web application?

(Cross-posting this here on the advice of a user at stackoverflow...) Got a philosophical security question for everyone. I'm sketching out an ASP.NET web application design where sensitive data for ...
4
votes
3answers
480 views

Understanding JVM zero day in relationship with other runtimes

I am a .net and php developer and since java has been in the news recently thanks to the string of zero days, I decided to brush up on security. In regards to the java zero days, this question has ...
4
votes
3answers
487 views

Possible holes in this ASP.NET security design?

So I plan on updating some data via an ASMX web service on a web server via .NET programs running elsewhere. The primary security concern is that this web service needs to spawn a process to handle ...
4
votes
1answer
143 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
4
votes
1answer
3k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
4
votes
2answers
1k views

Possible arbitrary file download vulnerability

I am auditing a possible vulnerable piece of ASP code on a Windows environment. The code is as follows: If InStr(strPath, "\Only\Download\From\Here\", CompareMethod.Text) = 0 Then Basicly it is ...
4
votes
1answer
1k views

Encrypt Medicare card numer in C# in ASP.NET

I am giving a free consultation for a non profit organisation that wants a simple system to manage multiple groups with a schedule component, etc. and also manage the medical informations of the kids. ...
4
votes
1answer
88 views

Are recent versions of ASP.NET implementing proper authenticated encryption?

There has been uncovered before that ASP.Net does not use the authenticated encryption right (e.g. here), they used Mac-then-encrypt that lead to some practical attacks. So I am wondering if I use ...
4
votes
2answers
91 views

When I turn off request validation in asp.net, am I vulnerable?

So I have request validation off in my web application. You can add /foo?=<script>and my web application won't catch it -it doesn't filter it- Does this make me vulnerable to attacks; should I ...
4
votes
1answer
470 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
4
votes
2answers
1k views

Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...