Hot answers tagged

89

If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS. IIS has a very simple checkbox to enable Windows Integrated Authentication. IE, on Windows 7, will by default send your credentials to any web server in the local intranet. (This is not your password, don't worry, but it is ...


52

Yes, it is important to include anti-forgery tokens for login pages. Why? Because of the potential for "login CSRF" attacks. In a login CSRF attack, the attacker logs the victim into the target site with the attacker's account. Consider, for instance, an attack on Alice, who is a user of Paypal, by an evil attacker Evelyn. If Paypal didn't protect its ...


32

That's incredible simple, and a really old trick. Create a different survey for each department, even if the surveys have the same questions. Everyone that answers to Survey X is from Department A. Everyone that answers to Survey Y is from Department B. Then, you just need to mash up the results and you're done! That alone is enough to do a lot of ...


31

Dropdown lists are an HTML/UI construct. There isn't any such concept in HTTP, which is how the client and the server ultimately talk to one another. So, while yes, a client could alter the page, that isn't absolutely required, because there doesn't actually need to be a page. In the end a client simply sends an HTTP request back to the server and it ...


21

For any reason, your database may be compromised and its data may be obtained by someone else. If the passwords are in what we call plain text, you will have leaked a piece of sensitive information that your users have trusted you with: their password (which is very likely to be a password shared in multiple services). This is a very serious issue. Instead ...


19

The basics First, I assume you understand the most basic session ID security right: you are using an ID with sufficient entropy, and you use transport level security (HTTPS). Any approach to session ID (URL, cookies, whatever) that does not get those right is vulnerable, your question is specifically about ID in URL, so I will not discuss that further. ...


16

You can use app.config to force it; the format is (in the <system.web> section) <httpCookies domain="String" httpOnlyCookies="true|false" requireSSL="true|false" /> so you really want, at a minimum <httpCookies requireSSL='true'/> But preferably you'll also turn httpOnlyCookies on, unless you're doing some ...


16

Yes, it's normal for a pen tester to ask for credentials (but not so much an ISP). The application as a whole can't really be tested without access to credentials. Someone without credentials should only be able to interact with one interface - the login screen. Given test credentials, however, every form, every upload, every data entry point in the ...


15

The purpose of ASP.NET ViewState is to persist control state between post-backs (see MDSN explanation), it does not implicitly enable security that would prevent CSRF. Also note that encrypted ViewState in unpatched older versions of ASP.NET are susceptible to an encryption vulnerability. To enable this type of protection you could: Use ViewStateUserKey (...


14

The safest way to protect your site against Firesheep (and related attacks): Move to site-wide SSL protection: Move your entire site to HTTPS, and disable all HTTP access. In other words, protect your entire site with SSL. Here are some more resources on doing that: how to protect against Firesheep, pros and cons of site wide SSL, why SSL protects ...


14

As well as via a cross-domain AJAX request with credentials, the POST in your example could also be sent by using a standard form without AJAX: <form method="post" action="http://MyApp/Page" name="hiddenFormInIframe"> <input type="hidden" name="my" value="a" /> </form> <script type="text/javascript"> document.hiddenFormInIframe....


14

The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...


13

As a penetration tester I have found that "Request Validation" fails in a number of situations. Developers tend to believe that "Request Validation" == "magic", and it protects them completely from XSS, when in fact this false sense of security results in in very serious problems. All forms of DOM based XSS and Persistent XSS will bypass "Request ...


12

De-identification from surveys is a big issue in statistics, as what people think of as anonymous data usually isn't when aggregated. Even if you have a completely secure way of anonymously inputing data, and someone can't access the logs of who entered what, the responses in the survey are often enough to identify you. Consider this example survey: ...


10

You have to distinguish two kinds of attackers: SSL is used during transport to prevent a third person from reading and modifying the transmitted data. The user who sends data to the server and gets answers from the server, can obviously see and modify the data any way he or she wants. So the user can modify the hidden form field containing the view state....


10

ASP.NET does not provide a XSS API. I suspect you are talking about Request Validation which is a feature in ASP.NET that inspects HTTP requests and looks for potentially dangerous input. To my knowledge PHP does not offer anything like this. While request validation can be a benefit by preventing certain types of XSS attacks, it is not a replacement ...


9

I've had some interesting feedback on this question both here and on Stack Overflow. There have been lots of responses related to stack traces (a custom errors issue, not a debug issue) and performance (not [directly] a security issue). The most compelling response is that conditional compilation constants (#if DEBUG...) could cause unexpected behavior, but ...


9

There are two main (security) reasons to do this, above and beyond just using parameterized queries: Parameter type enforcement Least privilege. The principle of Least Privilege requires you to allow any entity (user or application) access only to whatever it needs to do the defined task. If you don't restrict the webapp only to the SPs, the ...


9

Simply, yes it can be done. User downloads the HTML, modifies the content, and sends the from with modified content. Make absolutely sure that you are validating all form data before it hits your DB. Depending on your web framework, there is usually a way to limit options to exactly what you specify.


9

Actually PHP strings can contain null bytes; so can a .NET string (hence ASP.NET). At the PHP level, this byte is nothing special; the character U+0000 is just another Unicode code point. Trouble begins when the string is passed to another system, for which the null byte is a string terminator. In particular for file accesses: if the PHP code tries to open ...


9

You are correct that this is not possible without mis-configuration or security vulnerabilities that allow it. Generally, the most likely culprits when it comes to coughing up application code are commented out code, backup files that have extensions allowing them to be delivered directly to clients without processing, and probably more likely that all ...


8

The key here is that with closed source code, the onus is on protecting that code - attackers may try to steal the code, reverse engineer it, or just attack it. The internal processes should be designed to identify vulnerabilities and fix them, but the numbers are quite skewed: Attackers: many Defenders: few With open source code, there is a slightly ...


8

I am pretty sure that this is not Apache Synapse, it's some tool built with Ararat Synapse, this is a TCP/IP library built with Delphi . I downloaded source code from both projects, and as far I can see Apache Synapse has a configurable user-agent, and default is : Synapse-HttpComponents-NIO On the other hand, Ararat Synapse has default user agent : ...


8

While, as @gowenfawr has answered, it is normal for a professional pentester to ask for user-password you should ask them the following questions: What tests are you going to perform with these users? (so you know exactly what they are doing). How are you going to manage the credentials I give you? (so you can know if they are going to protect the ...


7

It is difficult to execute a successfull CSRF attack on an application using viewstate but not impossible. One way to do a succcessful CSRF attack on an application with _viewstate is Attacker is able to login to the application ( using own or aquired credentials) Visit the page (with most common or most useful variable states) against which she wants to ...


7

This is going to be an annoyingly trivial answer, BUT... The only way to perform a Response Splitting attack on an updated ASP.NET (or MVC) server, is if the application itself is writing back raw HTTP responses. Yes, of course no programmer in their right mind would do that... but in the case of the 60% of programmers that are not in their right mind, it ...


7

Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using. I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not ...


7

As far as I understand, this CVE is a dud. The strong name is basically a signature on the DLL, and the public key is identified by the "public key token", which is a SHA-1 hash of the key truncated to 64 bits. The core functionality of the "strong name" is to avoid clashes when several developers, who do not know each other, publish different DLL with the ...


7

Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and ...


7

This condition was probably not an exploitable XSS vulnerability for most applications. This is more likely a "defense in depth" filter to prevent programmers from unintentionally causing problems. XSS is solved in an API's by setting the content-type to application/xml or application/json depending on the return data type (and text/plain is also commonly ...



Only top voted, non community-wiki answers of a minimum length are eligible