Tag Info

Hot answers tagged

31

Dropdown lists are an HTML/UI construct. There isn't any such concept in HTTP, which is how the client and the server ultimately talk to one another. So, while yes, a client could alter the page, that isn't absolutely required, because there doesn't actually need to be a page. In the end a client simply sends an HTTP request back to the server and it ...


21

Yes, it is important to include anti-forgery tokens for login pages. Why? Because of the potential for "login CSRF" attacks. In a login CSRF attack, the attacker logs the victim into the target site with the attacker's account. Consider, for instance, an attack on Alice, who is a user of Paypal, by an evil attacker Evelyn. If Paypal didn't protect its ...


15

For any reason, your database may be compromised and its data may be obtained by someone else. If the passwords are in what we call plain text, you will have leaked a piece of sensitive information that your users have trusted you with: their password (which is very likely to be a password shared in multiple services). This is a very serious issue. Instead ...


15

Yes, it's normal for a pen tester to ask for credentials (but not so much an ISP). The application as a whole can't really be tested without access to credentials. Someone without credentials should only be able to interact with one interface - the login screen. Given test credentials, however, every form, every upload, every data entry point in the ...


13

The basics First, I assume you understand the most basic session ID security right: you are using an ID with sufficient entropy, and you use transport level security (HTTPS). Any approach to session ID (URL, cookies, whatever) that does not get those right is vulnerable, your question is specifically about ID in URL, so I will not discuss that further. ...


12

The purpose of ASP.NET ViewState is to persist control state between post-backs (See http://msdn.microsoft.com/en-us/library/ms972976.aspx), it does not implicitly enable security that would prevent CSRF. Also note that encrypted ViewState in unpatched older versions of ASP.NET are susceptible to an encryption vulnerability see ...


10

You can use app.config to force it; the format is (in the <system.web> section) <httpCookies domain="String" httpOnlyCookies="true|false" requireSSL="true|false" /> so you really want, at a minimum <httpCookies requireSSL='true'/> But preferably you'll also turn httpOnlyCookies on, unless you're doing some ...


9

The safest way to protect your site against Firesheep (and related attacks): Move to site-wide SSL protection: Move your entire site to HTTPS, and disable all HTTP access. In other words, protect your entire site with SSL. Here are some more resources on doing that: how to protect against Firesheep, pros and cons of site wide SSL, why SSL protects ...


8

You have to distinguish two kinds of attackers: SSL is used during transport to prevent a third person from reading and modifying the transmitted data. The user who sends data to the server and gets answers from the server, can obviously see and modify the data any way he or she wants. So the user can modify the hidden form field containing the view ...


8

There are two main (security) reasons to do this, above and beyond just using parameterized queries: Parameter type enforcement Least privilege. The principle of Least Privilege requires you to allow any entity (user or application) access only to whatever it needs to do the defined task. If you don't restrict the webapp only to the SPs, the ...


8

The key here is that with closed source code, the onus is on protecting that code - attackers may try to steal the code, reverse engineer it, or just attack it. The internal processes should be designed to identify vulnerabilities and fix them, but the numbers are quite skewed: Attackers: many Defenders: few With open source code, there is a slightly ...


8

Simply, yes it can be done. User downloads the HTML, modifies the content, and sends the from with modified content. Make absolutely sure that you are validating all form data before it hits your DB. Depending on your web framework, there is usually a way to limit options to exactly what you specify.


8

While, as @gowenfawr has answered, it is normal for a professional pentester to ask for user-password you should ask them the following questions: What tests are you going to perform with these users? (so you know exactly what they are doing). How are you going to manage the credentials I give you? (so you can know if they are going to protect the ...


7

Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using. I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not ...


7

Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and ...


7

Actually PHP strings can contain null bytes; so can a .NET string (hence ASP.NET). At the PHP level, this byte is nothing special; the character U+0000 is just another Unicode code point. Trouble begins when the string is passed to another system, for which the null byte is a string terminator. In particular for file accesses: if the PHP code tries to open ...


6

I've had some interesting feedback on this question both here and on Stack Overflow. There have been lots of responses related to stack traces (a custom errors issue, not a debug issue) and performance (not [directly] a security issue). The most compelling response is that conditional compilation constants (#if DEBUG...) could cause unexpected behavior, but ...


6

The most basic reason why you hash a password is so that if the stored version of it is stolen it cannot be openly read. Note that I said the stored version - if the password is never stored in any form (which is unlikely) then there is no point hashing it ever. But it is unlikely (and impractical) that you will never store it, so it should be hashed. You ...


6

As a penetration tester I have found that "Request Validation" fails in a number of situations. Developers tend to believe that "Request Validation" == "magic", and it protects them completely from XSS, when in fact this false sense of security results in in very serious problems. All forms of DOM based XSS and Persistent XSS will bypass "Request ...


6

ASP.NET does not provide a XSS API. I suspect you are talking about Request Validation which is a feature in ASP.NET that inspects HTTP requests and looks for potentially dangerous input. To my knowledge PHP does not offer anything like this. While request validation can be a benefit by preventing certain types of XSS attacks, it is not a replacement ...


5

By allowing potential attackers potential access to source code, stack traces, etc. it certainly allows them to focus/narrow an attack to the system. I'd also assume (though haven't tested it) that since debug=true causes the compilation error rather than the expected site customerror, you could be exposed to the .net customerror crypto bug. ...


5

Barry Dorans, author of Beginning ASP.NET Security, provides some good material on the subject. I read his book and he covers a lot of ASP.NET MVC specific material. If you are looking for a check list of application security controls, be sure to also check out the OWASP ASVS project.


5

This is going to be an annoyingly trivial answer, BUT... The only way to perform a Response Splitting attack on an updated ASP.NET (or MVC) server, is if the application itself is writing back raw HTTP responses. Yes, of course no programmer in their right mind would do that... but in the case of the 60% of programmers that are not in their right mind, it ...


5

If the uploaded file is in a valid image format, .FromStream will not throw an exception, even if it contains a virus. That is, there is no virus checking in it. On the other hand, there is also no way for the virus to activate, since the file at this point is only being handled as raw bytes. (It is certainly possible, if not feasible, that it contains ...


5

No. This will certainly not handle string concatenation that is not delimited by quotes. e.g. a numeric field. Consider sql= "select username from users where id=" + id if id is provided as 1 or 1=1 then all rows from the database can be returned. Obviously this can example could be extended to union select attacks or even entire nested queries. Just ...


5

If you store the information in the session, it might get outdated wrt. to the database. That is, if module ownership expires, or it can be cancelled through other means, it might still be present in someone's session. Whether that's a problem or even a feature, is up to you. However, this is "premature optimization". Unless you can prove (prove!) that this ...


5

As long as you have taken all the usual security precautions, this isn't anything to worry about. On a website I maintain, I have set it up so any uncaught errors are logged and emailed to me. I often open my inbox to find similar requests. The usual pattern in my experience is for the crawler to scan for all <input> tag names and set the value of ...


5

What is it doing: probably providing access to a malicious user What you should: wipe the system and restore from backup that was not yet affected by the virus. If a virus keeps popping up it means it's not being removed succesfully or someone keeps putting it back. There is no other way to have 100% certainty that your system is not compromized anymore. ...


5

ASP.NET Event validation does provide a decent level of protection against some specific web security attacks, but shouldn't be considered a panacea. There have been vulnerabilities in the implementation in the past like the ASP.NET Null Bypass and also there are cases where it may not come into play (examples here and more recently here). From that last ...



Only top voted, non community-wiki answers of a minimum length are eligible