Tag Info

Hot answers tagged

31

Dropdown lists are an HTML/UI construct. There isn't any such concept in HTTP, which is how the client and the server ultimately talk to one another. So, while yes, a client could alter the page, that isn't absolutely required, because there doesn't actually need to be a page. In the end a client simply sends an HTTP request back to the server and it ...


30

Yes, it is important to include anti-forgery tokens for login pages. Why? Because of the potential for "login CSRF" attacks. In a login CSRF attack, the attacker logs the victim into the target site with the attacker's account. Consider, for instance, an attack on Alice, who is a user of Paypal, by an evil attacker Evelyn. If Paypal didn't protect its ...


15

The basics First, I assume you understand the most basic session ID security right: you are using an ID with sufficient entropy, and you use transport level security (HTTPS). Any approach to session ID (URL, cookies, whatever) that does not get those right is vulnerable, your question is specifically about ID in URL, so I will not discuss that further. ...


15

For any reason, your database may be compromised and its data may be obtained by someone else. If the passwords are in what we call plain text, you will have leaked a piece of sensitive information that your users have trusted you with: their password (which is very likely to be a password shared in multiple services). This is a very serious issue. Instead ...


15

Yes, it's normal for a pen tester to ask for credentials (but not so much an ISP). The application as a whole can't really be tested without access to credentials. Someone without credentials should only be able to interact with one interface - the login screen. Given test credentials, however, every form, every upload, every data entry point in the ...


13

The purpose of ASP.NET ViewState is to persist control state between post-backs (See http://msdn.microsoft.com/en-us/library/ms972976.aspx), it does not implicitly enable security that would prevent CSRF. Also note that encrypted ViewState in unpatched older versions of ASP.NET are susceptible to an encryption vulnerability see ...


11

You can use app.config to force it; the format is (in the <system.web> section) <httpCookies domain="String" httpOnlyCookies="true|false" requireSSL="true|false" /> so you really want, at a minimum <httpCookies requireSSL='true'/> But preferably you'll also turn httpOnlyCookies on, unless you're doing some ...


10

The safest way to protect your site against Firesheep (and related attacks): Move to site-wide SSL protection: Move your entire site to HTTPS, and disable all HTTP access. In other words, protect your entire site with SSL. Here are some more resources on doing that: how to protect against Firesheep, pros and cons of site wide SSL, why SSL protects ...


10

ASP.NET does not provide a XSS API. I suspect you are talking about Request Validation which is a feature in ASP.NET that inspects HTTP requests and looks for potentially dangerous input. To my knowledge PHP does not offer anything like this. While request validation can be a benefit by preventing certain types of XSS attacks, it is not a replacement ...


9

You have to distinguish two kinds of attackers: SSL is used during transport to prevent a third person from reading and modifying the transmitted data. The user who sends data to the server and gets answers from the server, can obviously see and modify the data any way he or she wants. So the user can modify the hidden form field containing the view ...


9

Simply, yes it can be done. User downloads the HTML, modifies the content, and sends the from with modified content. Make absolutely sure that you are validating all form data before it hits your DB. Depending on your web framework, there is usually a way to limit options to exactly what you specify.


9

As well as via a cross-domain AJAX request with credentials, the POST in your example could also be sent by using a standard form without AJAX: <form method="post" action="http://MyApp/Page" name="hiddenFormInIframe"> <input type="hidden" name="my" value="a" /> </form> <script type="text/javascript"> ...


8

There are two main (security) reasons to do this, above and beyond just using parameterized queries: Parameter type enforcement Least privilege. The principle of Least Privilege requires you to allow any entity (user or application) access only to whatever it needs to do the defined task. If you don't restrict the webapp only to the SPs, the ...


8

The key here is that with closed source code, the onus is on protecting that code - attackers may try to steal the code, reverse engineer it, or just attack it. The internal processes should be designed to identify vulnerabilities and fix them, but the numbers are quite skewed: Attackers: many Defenders: few With open source code, there is a slightly ...


8

Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using. I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not ...


8

Actually PHP strings can contain null bytes; so can a .NET string (hence ASP.NET). At the PHP level, this byte is nothing special; the character U+0000 is just another Unicode code point. Trouble begins when the string is passed to another system, for which the null byte is a string terminator. In particular for file accesses: if the PHP code tries to open ...


8

While, as @gowenfawr has answered, it is normal for a professional pentester to ask for user-password you should ask them the following questions: What tests are you going to perform with these users? (so you know exactly what they are doing). How are you going to manage the credentials I give you? (so you can know if they are going to protect the ...


7

Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and ...


7

As a penetration tester I have found that "Request Validation" fails in a number of situations. Developers tend to believe that "Request Validation" == "magic", and it protects them completely from XSS, when in fact this false sense of security results in in very serious problems. All forms of DOM based XSS and Persistent XSS will bypass "Request ...


7

I am pretty sure that this is not Apache Synapse, it's some tool build with Ararat Synapse, this is a TCP/IP library build with Delphi . I downloaded source code from both projects, and as far I can see Apache Synapse have a configurable user-agent, and default is : Synapse-HttpComponents-NIO on the other hand Ararat Synapse have default user agent : ...


7

A more common term for this is "parameterized SQL". You are still taking user data, as you pointed out, but the security lies in the fact that the application knows what is data, and what is executable. When you build a SQL statement as a string and pass it in it's completed entirety to the database, the application simply has to trust that the SQL ...


6

I've had some interesting feedback on this question both here and on Stack Overflow. There have been lots of responses related to stack traces (a custom errors issue, not a debug issue) and performance (not [directly] a security issue). The most compelling response is that conditional compilation constants (#if DEBUG...) could cause unexpected behavior, but ...


6

As long as you have taken all the usual security precautions, this isn't anything to worry about. On a website I maintain, I have set it up so any uncaught errors are logged and emailed to me. I often open my inbox to find similar requests. The usual pattern in my experience is for the crawler to scan for all <input> tag names and set the value of ...


6

Your database could be compromised for any number of reasons, it happens all the time watch the news (even to some of the biggest web sites on the web). It's just a safety precaution to your users to hash their personal information in case your DB ever gets compromised for any reason.


6

The most basic reason why you hash a password is so that if the stored version of it is stolen it cannot be openly read. Note that I said the stored version - if the password is never stored in any form (which is unlikely) then there is no point hashing it ever. But it is unlikely (and impractical) that you will never store it, so it should be hashed. You ...


5

Barry Dorans, author of Beginning ASP.NET Security, provides some good material on the subject. I read his book and he covers a lot of ASP.NET MVC specific material. If you are looking for a check list of application security controls, be sure to also check out the OWASP ASVS project.


5

Based on this blog post, I'm using POSTs for all my JSON data. This underscores a few items in the Codevanced checklist pasted here.


5

Putting user-provided values into an eval() call is a horrible idea, because it essentially amounts to a remote code execution vulnerability. Let's say your code looks like this... var data = eval(webRequest.Parameters["p"]); Now imagine I put this into the p parameter... System.IO.File.Delete(@"c:\windows\system32\ntoskrnl.exe"); Whoops! I just ...


5

No. This will certainly not handle string concatenation that is not delimited by quotes. e.g. a numeric field. Consider sql= "select username from users where id=" + id if id is provided as 1 or 1=1 then all rows from the database can be returned. Obviously this can example could be extended to union select attacks or even entire nested queries. Just ...



Only top voted, non community-wiki answers of a minimum length are eligible