Hot answers tagged asp.net
14
Yes, it is important to include anti-forgery tokens for login pages.
Why? Because of the potential for "login CSRF" attacks. In a login CSRF attack, the attacker logs the victim into the target site with the attacker's account. Consider, for instance, an attack on Alice, who is a user of Paypal, by an evil attacker Evelyn. If Paypal didn't protect its ...
11
The purpose of ASP.NET ViewState is to persist control state between post-backs (See http://msdn.microsoft.com/en-us/library/ms972976.aspx), it does not implicitly enable security that would prevent CSRF.
Also note that encrypted ViewState in unpatched older versions of ASP.NET are susceptible to an encryption vulnerability see ...
10
The basics
First, I assume you get the most basic session ID security right:
you are using an ID with sufficient entropy, and
you use transport level security (HTTPS).
Any approach to session ID (URL, cookies, whatever) that does not get those right has is vulnerable, your question is specifically about ID in URL, so I will not discuss that further.
...
9
You can use app.config to force it; the format is (in the <system.web> section)
<httpCookies domain="String"
httpOnlyCookies="true|false"
requireSSL="true|false" />
so you really want, at a minimum
<httpCookies requireSSL='true'/>
But preferably you'll also turn httpOnlyCookies on, unless you're doing some ...
8
You have to distinguish two kinds of attackers:
SSL is used during transport to prevent a third person from reading and modifying the transmitted data.
The user who sends data to the server and gets answers from the server, can obviously see and modify the data any way he or she wants. So the user can modify the hidden form field containing the view ...
8
The key here is that with closed source code, the onus is on protecting that code - attackers may try to steal the code, reverse engineer it, or just attack it. The internal processes should be designed to identify vulnerabilities and fix them, but the numbers are quite skewed:
Attackers: many Defenders: few
With open source code, there is a slightly ...
7
The safest way to protect your site against Firesheep (and related attacks):
Move to site-wide SSL protection: Move your entire site to HTTPS, and disable all HTTP access. In other words, protect your entire site with SSL. Here are some more resources on doing that: how to protect against Firesheep, pros and cons of site wide SSL, why SSL protects ...
6
There are two main (security) reasons to do this, above and beyond just using parameterized queries:
Parameter type enforcement
Least privilege.
The principle of Least Privilege requires you to allow any entity (user or application) access only to whatever it needs to do the defined task. If you don't restrict the webapp only to the SPs, the ...
6
Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using.
I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not ...
5
If you store the information in the session, it might get outdated wrt. to the database. That is, if module ownership expires, or it can be cancelled through other means, it might still be present in someone's session. Whether that's a problem or even a feature, is up to you.
However, this is "premature optimization". Unless you can prove (prove!) that this ...
5
By allowing potential attackers potential access to source code, stack traces, etc. it certainly allows them to focus/narrow an attack to the system.
I'd also assume (though haven't tested it) that since debug=true causes the compilation error rather than the expected site customerror, you could be exposed to the .net customerror crypto bug.
...
5
How can I reliably/securely tell if the user visiting our website is coming from inside of the corporate firewall? Is verifying the IP address enough?
I think a bigger concern is "can you write this code in such a way nobody could manipulate it?" I very much doubt it, however, there are things you can do.
Edit Ok, old answer was probably being a bit ...
5
If the uploaded file is in a valid image format, .FromStream will not throw an exception, even if it contains a virus. That is, there is no virus checking in it.
On the other hand, there is also no way for the virus to activate, since the file at this point is only being handled as raw bytes.
(It is certainly possible, if not feasible, that it contains ...
5
What is it doing: probably providing access to a malicious user
What you should: wipe the system and restore from backup that was not yet affected by the virus. If a virus keeps popping up it means it's not being removed succesfully or someone keeps putting it back.
There is no other way to have 100% certainty that your system is not compromized anymore. ...
5
ASP.NET Event validation does provide a decent level of protection against some specific web security attacks, but shouldn't be considered a panacea.
There have been vulnerabilities in the implementation in the past like the ASP.NET Null Bypass and also there are cases where it may not come into play (examples here and more recently here).
From that last ...
5
Putting user-provided values into an eval() call is a horrible idea, because it essentially amounts to a remote code execution vulnerability. Let's say your code looks like this...
var data = eval(webRequest.Parameters["p"]);
Now imagine I put this into the p parameter...
System.IO.File.Delete(@"c:\windows\system32\ntoskrnl.exe");
Whoops! I just ...
5
As far as I understand, this CVE is a dud. The strong name is basically a signature on the DLL, and the public key is identified by the "public key token", which is a SHA-1 hash of the key truncated to 64 bits. The core functionality of the "strong name" is to avoid clashes when several developers, who do not know each other, publish different DLL with the ...
4
I would add additional authentication to the mix--perhaps an additional header added by an intermediate proxy or something. Even a header isn't very strong because it can be spoofed, but IP address alone seems a bit weak.
While spoofing TCP traffic (and seeing responses) is not trivial, you should look for another layer to add if possible. If you're in ...
4
Based on this blog post, I'm using POSTs for all my JSON data. This underscores a few items in the Codevanced checklist pasted here.
4
Barry Dorans, author of Beginning ASP.NET Security, provides some good material on the subject. I read his book and he covers a lot of ASP.NET MVC specific material.
If you are looking for a check list of application security controls, be sure to also check out the OWASP ASVS project.
4
It is difficult to execute a successfull CSRF attack on an application using viewstate but not impossible. One way to do a succcessful CSRF attack on an application with _viewstate is
Attacker is able to login to the application ( using own or aquired credentials)
Visit the page (with most common or most useful variable states) against which she wants to ...
4
I'm not able to break it
Just because you are not able to break it, does not guarantee that no one else cannot break it. I've seen SQL injection attacks reported in the SANS diary that I can't even begin to understand (mostly because I don't have the time to figure out what they are doing).
http://isc.sans.edu/diary.html?storyid=9397
...
4
If you want a guaranteed safety from injection attacks, use bound parameters.
Your method may in practice actually be safe for a particular RDBMS, but you have no guarantee of this -- all you can do is check against the types of code-injection attacks that you can think to check against (while bound parameters simply
do not allow code to be injected).
...
4
No. This will certainly not handle string concatenation that is not delimited by quotes. e.g. a numeric field.
Consider
sql= "select username from users where id=" + id
if id is provided as 1 or 1=1 then all rows from the database can be returned. Obviously this can example could be extended to union select attacks or even entire nested queries.
Just ...
4
Hacking is creativity. Applications are complex and when an attacker can look at the entire application he can see interesting ways of abusing it. In the light of a few sentences explaining some vague application I would consider the following:
1)The OWASP top 10
2)Make sure you verify the SSL certificate when connecting to the APIs you need.
3)Avoid ...
4
https://www.pentesterlab.com/from_sqli_to_shell.html - this will walk you through manual exploitation of sql injection, download the vm and follow the step by step pdf.
there is a difference in understanding and doing. this will help :)
4
ASP.NET will be more secure than PHP if the developer masters ASP.NET more than PHP. And vice versa.
There are many claims that a lot of features of PHP seem to have been designed by a lemur who had taken acid, leading to a rather tortuous set of features and thus potentially making the task of developing securely rather harder than what it could have ...
3
The biggest thing to keep in mind when debug=true is that the symbols are there. The application can be precompiled with debug=true, but this is part of the deployment process. E.g. you get it built by the build server or on your local machine and transfer the assemblies over. (everyone is precompiling their applications before production deployment ...
3
This is going to be an annoyingly trivial answer, BUT...
The only way to perform a Response Splitting attack on an updated ASP.NET (or MVC) server, is if the application itself is writing back raw HTTP responses.
Yes, of course no programmer in their right mind would do that... but in the case of the 60% of programmers that are not in their right mind, it ...
3
Here's a video series on how to hack proof your asp.net sites, it is two videos of about 50min where he also includes an introduction to the topic, he also includes examples, I havn't seen all of it yet, but I think it will cover some of your questions, or atleast give you som inspiration.
http://vimeo.com/28284123
Only top voted, non community-wiki answers of a minimum length are eligible
