Questions tagged [.net]
A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
1
vote
0answers
13 views
ASP.NET SOAP Service XXE
Is it possible to do any type of XXE in a service developed using default C# SOAP service framework?
I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
2
votes
1answer
30 views
BouncyCastle and Microsoft Cng ECDH secret key mismatch
I'm trying to refactor some client-side code from BouncyCastle to Microsoft Cng. I've figured out how to convert key format(ECC key blobs) between them, but I couldn't calculate the same secret.
...
1
vote
0answers
14 views
How to check if a SSH Private Key has a passphrase programmitically with C# on Windows 10 [migrated]
I already know there are a couple of similar questions but there is a pattern in the replies that the answers assume that this check is being done on a Linux or similar system. This means they refer ...
0
votes
2answers
45 views
Security risks downloading external images automatically from script
I'm a developping a program which generates images from HTML files filled with external RSS feeds data.
When the RSS feed contains images, I need to check their resolution and format (for instance, if ...
0
votes
1answer
39 views
Can you fake the Host attribute of a C# URI?
I was wondering if you can fake the Uri.Host value of a string. For example, given the following code:
new Uri(url.ToLower()).Host == "example.com"
Is there anyway to have this boolean comparison be ...
1
vote
1answer
85 views
How to pass a localhost check for an incoming request?
I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost:
public void Request(HttpListenerContext context) {
...
0
votes
0answers
86 views
Using RSA private key as AES key for encryption
Example application need:
An application pulls down data from a web service and needs to encrypt and persist this data locally to disk. Only this application should be able to decrypt the data stored ...
1
vote
1answer
53 views
How to prevent expired cookies from maintaining accesss?
My company has a website that was recently the target of a security audit. They found that if a hacker had obtained the browser cookies used by our .NET website for authorization, that those cookies ...
0
votes
1answer
49 views
What is a secure way to use PHP tokens in a C# application
I have a C# app that is sending post requests to and from a php script. I have token based authentication setup on the php, and I have my C# app sending the tokens, however, even with obfuscation, if ...
2
votes
1answer
61 views
Risks of letting the browser open local/network file system listing
Browsers do not generally allow web pages to interact with client-side file system as a security measure. I would like to know what can go wrong with the following scenario:
Clicking a special ...
2
votes
0answers
55 views
What security precautions should we take when letting a C# application send/receive emails?
I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
3
votes
1answer
117 views
What do you search for in Open Source code to be sure there isn't malicious code?
I realize the answers will be language specific, but I am curious what terms you would look for when checking something out on Github? I was looking for a remote administration tool that I could use ...
1
vote
2answers
53 views
Make application use encrypted credentials from a file [duplicate]
I am new to cyber security but I am working on a project where I need to use it and I don't know where to start.
The application I am working on connects to Jira to retrieve data and generate ...
1
vote
2answers
133 views
How to obfuscate a assemblies binary compiled with .NET framework?
How to obfuscate a binary compile with .NET framework? Tools such as Ebowla and Pecloak.py will encrypt it but the program won't run. Even UPX can't pack it. Wondering are there any ways to obfuscate ...
0
votes
0answers
68 views
Garbage collection and vulnerabilites
If I'm using vanilla PHP (v 5.x) procedural style, will there be garbage collection? As far as I understand GC, it is memory management to remove an unused object. This tells me that using PHP ...
0
votes
0answers
17 views
Replacing single quote with double single quote (SQL Injection sanitation) [duplicate]
Let's say I want to sql inject into a site, and the textbox is for my name. My name is U'ser Smith. The code is handling the single quote by replacing any instance of ' with '' on the users input only....
2
votes
0answers
75 views
HTML Form to PDF vulnerabilities
I have a form where the user inputs data.
On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
1
vote
0answers
55 views
Veracode still reports OS command injection issue after I have applied the solution as recommendations from OWAPS and Roslyn Security Guard [closed]
Current code in my project is shown below and Veracode reports there is an OS command injection
filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg"
ProcessStartInfo startInfo = ...
1
vote
0answers
387 views
Insecure Deserialization in C# (.NET) - How to identify and test
I have been reading up on Insecure Deserialization and how it can affect Java applications.
https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization
If the captured traffic data include ...
1
vote
1answer
194 views
Is .NET XmlSerializer.Deserialize(TextReader) safe?
Is the .NET method XmlSerializer.Deserialize(TextReader) safe from XML vulnerabilities (XXE, XmlBomb etc..)? Will the DTD be processed during deserialization?
I can understand why XmlSerializer....
0
votes
0answers
102 views
Session Fixation in ASP.NET
I am testing ASP.NET application, where session id (ASP.NET_SessionId) is not renewed after login. Actually it is renewed when I use browser, on the login page server sends:
Set-Cookie: ASP....
0
votes
1answer
272 views
Is CBC mode for AES still safe to use in 2018?
I'm using AES-256 CBC mode in C# to encrypt various amounts of texts. The key and IV are always generated properly randomly. However, would GCM mode provide any noticeable security gains over CBC?
2
votes
0answers
52 views
Will installing WinZip 22 on a server create a security vulnerability?
I've recently requested a WinZip v22 with command line installation on a Windows POC/Dev server that we're using to pilot an application that is written in .Net.
In the application there is ...
3
votes
1answer
179 views
What is properly way to manage and remove symmetric key in C#
If I have a symmetric key in a byte[] array in C#, how can I erase it securely?
for (int i = 0; i < array.Length; i++) {
array[i] = 0;
}
Is this good enough?
2
votes
1answer
280 views
SSL certificate for WebAPI
We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
2
votes
1answer
117 views
Automatic choice of the hash function for key derivation
This is a theoretical question: does this make sense and is secure?
My goal is to strengthen the passphrase. The flow is the following:
I enter a pssphrase admin1234. This passphrase is going to be ...
-2
votes
1answer
73 views
Visual Studio anonymity
Recently me and me colleague was wondering about obfuscating / removing project info. If application is reverse engineered than what kind of information the engineer sees?
Can he see the email of the ...
0
votes
1answer
262 views
Potentially dangerous request loads the page
I hosted an application in ASP.NET 4.0 webforms.
When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like:
...
1
vote
0answers
75 views
Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)
I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key.
I'm searching for the best way to store the key for every ...
0
votes
0answers
125 views
ViewStateUserKey .NET CSRF protection
In a typical PHP web application you append a hidden CSRF Token in each form and this token is validated when the request is submitted in the server side.
I am performing a penetration test in a .NET ...
0
votes
1answer
294 views
How to get session info out of encrypted .NET viewstate?
I am performing a penetration testing for the first time in a .NET application that instead of providing cookies for session management uses the viewstate hidden field.
I am using the .NET Beautifier ...
1
vote
2answers
390 views
How to securely send a password from one app to another app?
See this question/answer first: When calling a process from another process, Is sending stdin password more secure than sending an ENV variable?
I am a Java developer that is building an app where ...
1
vote
1answer
77 views
When calling a process from another process, Is sending stdin password more secure than sending an ENV variable?
I am a Java developer that is building an app where it needs to call a C# process from within. In my situation, the Java app is calling this C# program https://github.com/nddipiazza/...
2
votes
2answers
115 views
How can I verify that network calls to my API come only from my C# program?
I have a desktop application build on the .Net framework.
If I obfuscate the code, even if somebody reverse-engineers the code and tries to call my API using the altered source, can I know if the API ...
1
vote
0answers
48 views
Example of Insecure DTD Processing in XmlSchema.Read
According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack:
var src = "?...
0
votes
1answer
197 views
WPF Hide ConnectionString in MyApplication.exe.config file (or hide the whole file)
While building my Project I got a new file called MyApplication.exe.config.
This is the Content of App.config (I guess) where I also included the Connection to a DataBase in <ConnectionString>.
...
2
votes
2answers
62 views
Is it feasible to leverage DOS by triggering large numbers of application exceptions?
One key aspect of a DOS or DDOS seems to be to leverage the required computational power on the attackers side to maximize the impact on the target side. This wiki article lists many examples of such ...
-1
votes
1answer
421 views
Encrypt and decrypt large files with RSA, is it possible? [closed]
Encrypt and decrypt large files with RSA, is it possible?
I need to encrypt / decrypt files and save the private key named file encoder
I've seen it's not acceptable to work on large files with RSA
Is ...
2
votes
1answer
1k views
Could Meltdown/Spectre be exploited from C#/.Net (or other managed languages or the Midori OS)?
First off yes the correct answer is patch your OS/system. That aside:
Does the memory managed features of a language like C# prevent it from being used to exploit the Meltdown security bug?
What ...
-4
votes
1answer
150 views
Why isn't ASP.NET source code compiled before it is published?
Why doesn't Visual Studio compile the source code (.cs) automatically before publishing, since they know perfectly well that the end-product website is going public? (Unless you're just building the ...
2
votes
1answer
80 views
Can I secure a server on which I'm deliberately allowing code execution?
Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface.
Obviously,...
1
vote
0answers
71 views
Is there any tool for static analysis of Windows Workflow Foundation XAML files? [closed]
The title says it all.
First, is there any dedicated tool that is capable of analysis of Workflow Foundation files?
If not, is there a process that can analyse them, eg. compile the WF into IL, then ...
2
votes
2answers
218 views
How secure is this communication chat?
I have created a chat between two parties (using c#), and I am wondering what kind of weaknesses have I overlooked.
Description of its functionality:
There are two individual applications: Client (2 ...
1
vote
2answers
516 views
Secure way to save connectionString in .NET?
I'm developing a application which is not static for me. This means that creating a WebService for my connectionString will not work I guess.
Because my application works a bit like Wordpress. First ...
16
votes
2answers
3k views
Secure big, old ecommerce website from XSS?
I'm working for an ecommerce website written in C#.net (no CMS used, quite a lot of code) where security hasn't been a priority for a long time. My mission right now is to find and fix any XSS ...
2
votes
2answers
1k views
Secure flag for ASPXAUTH Cookie in MVC
We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool.
Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's ...
-5
votes
2answers
82 views
What is the most crypto-resistive algorithm to safely send information? [closed]
What algorithm is the best to use for storing, sending passwords, account data, and other information between desktop apps over the network.
Looking for the best crypto-resistive algorithm to use in ...
0
votes
1answer
60 views
Can the device on the other end of a socket change without me knowing?
I have a server application written in C#. I am currently authenticating the client whenever a socket is opened, before sending any other Data. After the client is authenticated I assume it's always ...
1
vote
2answers
437 views
Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?
I have an MVC app that is using the AntiForgeryToken capability of ASP.NET MVC. AFAICT this uses an encrypted synchronizer token variation where it validates the payload of the tokens.
A customer has ...
0
votes
1answer
74 views
Prevent external processes from changing .NET variable values
I was reading this writeup of how CylancePROTECT can be exploited. It has a Windows service which is implemented using .NET.
It seems that for code written in .NET, it is trivial to locate important ...
