Questions tagged [.net]
A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
342
questions
0
votes
0answers
24 views
Using Noise Framework KK as alternative to DTLS?
I am trying to create a secure UDP connection in NET Core. Due to DTLS not being supported and it being quite the headache and existing libraries (DTLS.Net) are limited and inactive. Noise Framework ...
0
votes
0answers
56 views
How to determine if particular .NET/ASP.NET build has known vulnerabilities?
I'm trying to find a list to help find out if particular ASP.NET version has known vulnerabilities by version-build number. Googling doesn't help. Is there a list by Microsoft that can help me, ...
0
votes
1answer
70 views
Why does Wireshark not recognize WCF traffic as TLS encrypted?
In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them.
The class defines an attribute named Security, ...
0
votes
1answer
36 views
Is using SecureString in combination with Xor considered secure enough for standalone Windows app?
The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string.
License.Import(string name, string email, ...
0
votes
0answers
32 views
Which Algorithm should PFX file use to sign PDF document?
I exported localhost certificate in .PFX format with private key. I have to use this PFX file to sign PDF document. C# program was used to sign document and below error encountered when hitting this ...
1
vote
1answer
108 views
Cracking .NET random
I know .NET has two PRNGs, one secure and one insecure. What is the approach to cracking the insecure one (I want to use it to test an .aspx site)? I searched all over but I only found references to ...
0
votes
1answer
66 views
Algorithm to implement symmetric encryption in VB.Net for Windows and in Swift for iOS
I need to implement symmetric encryption to enable secure communication between one program running on a Windows machine (to be written in VB.Net) and an app running on an iOS device (to be written in ...
-2
votes
1answer
144 views
How to embedded exe file into png file such that when png file open then exe file also open with png? [closed]
No code yet. I have used binary and base64 to embedded exe and png file into png. But none of these methods works for me. Because when I run png file exe is not run. I don't know why. I need help in ...
0
votes
1answer
70 views
Why ASP.Net Identity sends sensitive information to clients?
As far as I understand, Identity sends to the user an encrypted token with some user information like the user name and expiration date. Then, when a new request arrives to the server, it decrypts it ...
1
vote
0answers
45 views
How to securely open a folder using .NET without user input?
I would like to open a folder using .NET and it seems like as if Process.Start is the way to go: Open a folder using Process.Start.
I already read How to securely use Process.Start? but it deals with ...
0
votes
1answer
200 views
How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?
I have a web application with a log in page.
In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.
@Html.TextBoxFor(m => m....
1
vote
0answers
57 views
Store passwords local with plain text access on WinPE
I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time.
The OS is WinPE, so he cannot map the ...
0
votes
1answer
77 views
.NET application protection technique against cracking
I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market.
Info about the software:
Built using .NET C# (Framework 4.5.2)
...
0
votes
1answer
34 views
Securely store tokens in WinPE
We have a tool running on WinPE (Windows PreInstallation Environment) which talks to a web service. A user enters his login credentials and the web service authenticates the user and returns an ...
1
vote
1answer
80 views
Is it bad practice to reuse private EC key as a shared secret for a symmetric algorithm?
The encrypted text is public, embedded in the binary of my software which is published on the internets. I know the open text but there’s large circle of third parties who might know it too, despite ...
1
vote
1answer
355 views
Preventing CSRF with SameSite=“strict” without degrading user experience?
ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks:
https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
1
vote
0answers
278 views
Should HTTP_COOKIE, __RequestVerificationToken, _RequestVerificationToken and .ASPXAUTH be kept secret?
Inside our ASP.NET MVC-4 web application, we have added the Elmah error logging, and I wrote a code to prevent the Elmah from exposing the user password inside the error file. But inside the Elmah ...
1
vote
1answer
255 views
Using Selenium to automate data entry
We have a report that generates ~100 rows daily and our customers have to enter the data into third-party software. We hoped that the software allows some kind of data upload so that our customers don'...
2
votes
2answers
114 views
Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?
I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness.
Before, I just grabbed the generated salt and put it ...
0
votes
0answers
18 views
Securing DB connection string and other configuration files in RCE scenario
Environment:
Microsoft Windows
IIS Web server
MSSQL DB
Let's say an application gets compromised with an RCE, what's the best scenario of protecting the database connection string file or any ...
1
vote
0answers
75 views
CWE-611: Improper Restriction of XML External Entity Reference with XSL include
Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference.
XslCompiledTransform transform = new XslCompiledTransform();
transform.Load(...
0
votes
1answer
530 views
Where to store secrets in .NET applications?
I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
0
votes
0answers
37 views
Active Directory with multi factor authentication for an existing web application
Customer is asking for LDAP / Active Directory authentication along with OTP (one time password) / multi-factor authentication for an old existing web application written in (asp.net MVC2). Is this ...
27
votes
2answers
4k views
How to avoid using System.String with Rfc2898DeriveBytes in C#
I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
3
votes
0answers
79 views
Is there an easy way to dissect .NET Remoting traffic for reverse engineering?
I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
3
votes
2answers
113 views
Generate cryptographically safe int
How can you generate a cryptographically safe integer that falls within a range in C#? I am trying to satisfy a Veracode issue reporting CWE-331: Insufficient Entropy. Obviously the code below is not ...
1
vote
5answers
228 views
Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN
I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
0
votes
1answer
62 views
How to implement Anti-CSRF method? [closed]
I have created a ASP.NET project and I want to implement Anti-CSRF method in my project. How to do that?
0
votes
0answers
26 views
How to make connection secure in ASP.NET? [duplicate]
I have created a asp.net project when I run it in browser it shows connection insecure. How to overcome this ? How to make connection secure?
https://www.sendspace.com/file/x3lnd4----Image that shows ...
0
votes
0answers
58 views
What is the best way to secure web API calls from worker apps running on Windows
I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
2
votes
3answers
4k views
How to delete a C# variable value permanently from memory?
I have created a variable in C#. Now I want to clear the variables value from the computer memory. Is there any way to do that?
Below is my current attempt at deleting the value of recordLine, but I ...
1
vote
0answers
182 views
.NET Remoting Pentest [closed]
I am carrying out activities of Vulnerability Assessment and Penetration Test, specifically, I am testing an application written in .NET Remoting. Sniffing the communication (With Wireshark) of an ...
0
votes
1answer
124 views
Get client ip address that is not spoofed
I am using the following source code to get a client IP address,
Public Shared Function GetIPAddress() As String
Dim context As System.Web.HttpContext = System.Web.HttpContext.Current
Dim ...
0
votes
1answer
153 views
Bypassing URL verification [closed]
I'm dealing with a URL validation function that was made by the developer (instead of using trusted methods).
Here is a slightly modified version of the function:
public static bool IsValidURL(...
1
vote
1answer
127 views
.Net WebClient - self signed certificate
I have two applications (.net) on two web-servers.
The first application will need to do a request (via WebClient) to the second and get results.
I need to ensure Encryption, data integrity, and ...
1
vote
0answers
64 views
Which attributes does DPAPI's “UseMachineProtection” use to identify a machine?
We're using DPAPIProtectedConfigurationProvider from the Windows Data Protection API to encrypt an application config file. The API offers a property called UseMachineProtection, so that the config ...
0
votes
1answer
387 views
Using different host key algorithms on sftp server and client
I need to setup a sftp client the problem i am facing is that sftp client library i am using does not support the host key algorithm supported by sftp server. Basically I am talking about the public ...
1
vote
2answers
2k views
Alternative to bcrypt in .NET Core?
I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
3
votes
0answers
70 views
How secure is this combined sha1/md5 hash [duplicate]
Recently we outsourced some work for a website. While reviewing this code I came across the password hash function.
I am in no way a security expert besides some basic knowledge (hence outsourcing ...
1
vote
1answer
298 views
Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?
I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
0
votes
1answer
78 views
SQL injection in Windows Services?
I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL).
There is a client application which allows a user to upload files through it to ...
0
votes
0answers
224 views
How to store SSN in asp.net web-based application on a short-term basis?
After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
3
votes
2answers
336 views
BCrypt workfactor for salt?
From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
0
votes
2answers
313 views
How to hide a process in Windows?
Is there a way to make a process hidden without using any Administrator-level priviledges? I am building an antivirus which I want to protect from malware's actions, such as ending the process, or ...
2
votes
0answers
89 views
Is Jil vulnerable to Friday The 13th JSON attack?
Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented?
Explanation of the attack: ...
1
vote
2answers
53 views
Revoke OAuth2 Token For Mobile App
When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
2
votes
1answer
356 views
Decrypting SSL traffic using Fiddler to see requests being sent by malware written in .NET
I tried to find the GET data of some malware but it appears that this malware is encrypting traffic using SSL.
When I tried to decrypt the SSL data via Fiddler, I always get nothing — only ...
2
votes
0answers
438 views
ASP.NET SOAP Service XXE
Is it possible to do any type of XXE in a service developed using default C# SOAP service framework?
I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
3
votes
1answer
334 views
BouncyCastle and Microsoft Cng ECDH secret key mismatch
I'm trying to refactor some client-side code from BouncyCastle to Microsoft Cng. I've figured out how to convert key format(ECC key blobs) between them, but I couldn't calculate the same secret.
...
1
vote
3answers
174 views
Security risks downloading external images automatically from script
I'm a developping a program which generates images from HTML files filled with external RSS feeds data.
When the RSS feed contains images, I need to check their resolution and format (for instance, if ...
