Questions tagged [.net]
A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
350
questions
0
votes
0answers
39 views
Finding certificate and chain of certificate from cer files
I have 3 certificates,
1) A.cer
a) Subject CN = A Gateway
b) Issuer CN = B CA
2) B.cer
a) Subject CN = B CA
b) Issuer CN = TCA
3) TCA.cer
a) Subject CN = TCA
b) Issuer CN = TCA
All .cer files ...
1
vote
0answers
11 views
How to erase encryption keys from memory in C#? [migrated]
I was browsing through the Cure53 audits and found a mention of 'Secure key deletion ineffective (Medium)' on pg. 3 here. The Cure53 team was saying that there's no real way to erase sensitive data in ...
0
votes
1answer
47 views
Is Array.Clear() in C# suitable for zeroing sensitive byte arrays?
Is it worth calling Array.Clear() to clear sensitive byte arrays such as those containing encryption keys? It's not clear whether this is worth doing since the language has a garbage collector.
0
votes
1answer
75 views
Developer requests dev systems don't have .Net patches applied
Looking for some guidance on an internal discussion we're having.
We have a .Net developer that is requesting all development systems with Visual Studio installed don't have .Net updates installed. ...
1
vote
0answers
18 views
Do __VIEWSTATEGENERATOR, __EVENTVALIDATION prevent CSRF? [duplicate]
I've seen __VIEWSTATEGENERATOR, __EVENTVALIDATION in every .NET website. Theirs value change, for example, at every login request. Do these fields prevent CSRF? If yes/no, why?
0
votes
0answers
42 views
Why Recursive Grep + Pitchfork payload doesn't work as expected in Burp Suite?
SCENARIO:
I'm playing around with a .NET application. In particular I'm testing the login page.
The source code contains __VIEWSTATE, __EVENTAVALIDATION, __VIEWSTATEGENERATOR.
I want to try a ...
0
votes
1answer
42 views
Secure an intranet Winform application
Is there a need to secure winform application in an intranet environment? Clearly, there is no external threat and only authorized personnel have access to the intranet environment, so I am not sure ...
2
votes
1answer
72 views
Can a client application volunteer to send a certificate?
When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send.
Network traffic with a service where our application is known to ...
1
vote
0answers
41 views
Visual Studio Issues in shellcode delivery
I am learning shellcode development and payload delivery.
I have been trying to do some exercises from a lab whereby unmanaged memory is injected with Shellcode using .NET, below is the code:
try
{
...
0
votes
1answer
89 views
DLL hijack privileges
DLL hijacking means that malicious software gets admin rights from default or it means you need to elevate your privileges first?
Because I tried to change a DLL in Windows/System32 folder, but I can'...
1
vote
2answers
85 views
How to devise cryptographic system with sharing ability
I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
1
vote
2answers
76 views
Can a symmetric key be safely embedded anywhere in a .NET desktop client program
Is there a native way, that is, one not requiring the purchase of an expensive third-party obfuscator, that a .NET desktop client program, deployed to the users' Windows desktops from a LAN server ...
3
votes
3answers
156 views
Is Telnet safe for receiving text or does it compromise my whole network?
I have a telnet port open to my PC using the TCPClient in latest version of .net, it is only used for receiving text then parsing it and adding it into an SQL Database, my telnet server does not reply ...
0
votes
0answers
40 views
Using Noise Framework KK as alternative to DTLS?
I am trying to create a secure UDP connection in NET Core. Due to DTLS not being supported and it being quite the headache and existing libraries (DTLS.Net) are limited and inactive. Noise Framework ...
0
votes
0answers
88 views
How to determine if particular .NET/ASP.NET build has known vulnerabilities?
I'm trying to find a list to help find out if particular ASP.NET version has known vulnerabilities by version-build number. Googling doesn't help. Is there a list by Microsoft that can help me, ...
2
votes
1answer
242 views
Why does Wireshark not recognize WCF traffic as TLS encrypted?
In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them.
The class defines an attribute named Security, ...
0
votes
1answer
48 views
Is using SecureString in combination with Xor considered secure enough for standalone Windows app?
The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string.
License.Import(string name, string email, ...
0
votes
0answers
53 views
Which Algorithm should PFX file use to sign PDF document?
I exported localhost certificate in .PFX format with private key. I have to use this PFX file to sign PDF document. C# program was used to sign document and below error encountered when hitting this ...
1
vote
1answer
114 views
Cracking .NET random
I know .NET has two PRNGs, one secure and one insecure. What is the approach to cracking the insecure one (I want to use it to test an .aspx site)? I searched all over but I only found references to ...
0
votes
1answer
74 views
Algorithm to implement symmetric encryption in VB.Net for Windows and in Swift for iOS
I need to implement symmetric encryption to enable secure communication between one program running on a Windows machine (to be written in VB.Net) and an app running on an iOS device (to be written in ...
-2
votes
1answer
588 views
How to embedded exe file into png file such that when png file open then exe file also open with png? [closed]
No code yet. I have used binary and base64 to embedded exe and png file into png. But none of these methods works for me. Because when I run png file exe is not run. I don't know why. I need help in ...
0
votes
1answer
84 views
Why ASP.Net Identity sends sensitive information to clients?
As far as I understand, Identity sends to the user an encrypted token with some user information like the user name and expiration date. Then, when a new request arrives to the server, it decrypts it ...
1
vote
0answers
47 views
How to securely open a folder using .NET without user input?
I would like to open a folder using .NET and it seems like as if Process.Start is the way to go: Open a folder using Process.Start.
I already read How to securely use Process.Start? but it deals with ...
0
votes
1answer
502 views
How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?
I have a web application with a log in page.
In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.
@Html.TextBoxFor(m => m....
1
vote
0answers
63 views
Store passwords local with plain text access on WinPE
I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time.
The OS is WinPE, so he cannot map the ...
0
votes
1answer
135 views
.NET application protection technique against cracking
I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market.
Info about the software:
Built using .NET C# (Framework 4.5.2)
...
0
votes
1answer
56 views
Securely store tokens in WinPE
We have a tool running on WinPE (Windows PreInstallation Environment) which talks to a web service. A user enters his login credentials and the web service authenticates the user and returns an ...
1
vote
1answer
85 views
Is it bad practice to reuse private EC key as a shared secret for a symmetric algorithm?
The encrypted text is public, embedded in the binary of my software which is published on the internets. I know the open text but there’s large circle of third parties who might know it too, despite ...
1
vote
1answer
563 views
Preventing CSRF with SameSite=“strict” without degrading user experience?
ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks:
https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
1
vote
1answer
488 views
Using Selenium to automate data entry
We have a report that generates ~100 rows daily and our customers have to enter the data into third-party software. We hoped that the software allows some kind of data upload so that our customers don'...
2
votes
2answers
126 views
Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?
I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness.
Before, I just grabbed the generated salt and put it ...
1
vote
0answers
87 views
CWE-611: Improper Restriction of XML External Entity Reference with XSL include
Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference.
XslCompiledTransform transform = new XslCompiledTransform();
transform.Load(...
3
votes
1answer
1k views
Where to store secrets in .NET applications?
I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
27
votes
2answers
4k views
How to avoid using System.String with Rfc2898DeriveBytes in C#
I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
3
votes
0answers
108 views
Is there an easy way to dissect .NET Remoting traffic for reverse engineering?
I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
3
votes
2answers
177 views
Generate cryptographically safe int
How can you generate a cryptographically safe integer that falls within a range in C#? I am trying to satisfy a Veracode issue reporting CWE-331: Insufficient Entropy. Obviously the code below is not ...
1
vote
5answers
233 views
Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN
I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
0
votes
1answer
63 views
How to implement Anti-CSRF method? [closed]
I have created a ASP.NET project and I want to implement Anti-CSRF method in my project. How to do that?
3
votes
3answers
10k views
How to delete a C# variable value permanently from memory?
I have created a variable in C#. Now I want to clear the variables value from the computer memory. Is there any way to do that?
Below is my current attempt at deleting the value of recordLine, but I ...
1
vote
0answers
243 views
.NET Remoting Pentest [closed]
I am carrying out activities of Vulnerability Assessment and Penetration Test, specifically, I am testing an application written in .NET Remoting. Sniffing the communication (With Wireshark) of an ...
0
votes
1answer
174 views
Get client ip address that is not spoofed
I am using the following source code to get a client IP address,
Public Shared Function GetIPAddress() As String
Dim context As System.Web.HttpContext = System.Web.HttpContext.Current
Dim ...
0
votes
1answer
244 views
Bypassing URL verification [closed]
I'm dealing with a URL validation function that was made by the developer (instead of using trusted methods).
Here is a slightly modified version of the function:
public static bool IsValidURL(...
1
vote
1answer
152 views
.Net WebClient - self signed certificate
I have two applications (.net) on two web-servers.
The first application will need to do a request (via WebClient) to the second and get results.
I need to ensure Encryption, data integrity, and ...
1
vote
0answers
80 views
Which attributes does DPAPI's “UseMachineProtection” use to identify a machine?
We're using DPAPIProtectedConfigurationProvider from the Windows Data Protection API to encrypt an application config file. The API offers a property called UseMachineProtection, so that the config ...
0
votes
1answer
508 views
Using different host key algorithms on sftp server and client
I need to setup a sftp client the problem i am facing is that sftp client library i am using does not support the host key algorithm supported by sftp server. Basically I am talking about the public ...
2
votes
2answers
3k views
Alternative to bcrypt in .NET Core?
I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
3
votes
0answers
70 views
How secure is this combined sha1/md5 hash [duplicate]
Recently we outsourced some work for a website. While reviewing this code I came across the password hash function.
I am in no way a security expert besides some basic knowledge (hence outsourcing ...
1
vote
1answer
374 views
Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?
I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
0
votes
1answer
86 views
SQL injection in Windows Services?
I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL).
There is a client application which allows a user to upload files through it to ...
0
votes
0answers
297 views
How to store SSN in asp.net web-based application on a short-term basis?
After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
