Questions tagged [.net]

A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

Windows directory that is only accessible by SYSTEM user

I am developing a .NET Windows Service using C# that needs to download an executable file and run it. I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...
0
votes
0answers
6 views

Encrypt RSA PRIVATE KEY as OpenSSL using C# [migrated]

I want to encrypt the RSA PRIVATE KEY given by the piece of code: var privateKey = cert.GetRSAPrivateKey().ExportRSAPrivateKey() This is giving the RSA PRIVATE KEY after decrypting using openssl with ...
1
vote
1answer
65 views

Is this string comparison code resistant to timing attacks?

I have to create an API that authenticates a request by checking if the token in the request is equal to the valid token stored in our database. Initially I used the == operator to compare the two ...
0
votes
2answers
56 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
0
votes
2answers
49 views

Is Output Neutralization required when logging C# exception messages to log files?

CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
1
vote
1answer
48 views

IV generation with RNGCryptoServiceProvider

I'm using RNGCryptoServiceProvider.GetBytes(new byte[16]) to generate IV's to use in AES (256 bits) encryption. For every record I encrypt, I generate a new IV. I'm also prepending each of these IV's ...
0
votes
0answers
48 views

How should I store a password used by a service written in .NET

I have a Windows service that accesses a database connection. Since users rarely use Windows authentication, I encrypt the connection string. For development I have the password hard-coded, but I know ...
2
votes
4answers
261 views

.Net dll encryption

By nature, .NET assemblies are extremely easy to reverse engineer. Say I want to hide some code by embedding an encrypted .dll into another .dll that is to be decrypted and loaded at runtime: compile ...
2
votes
1answer
100 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
2
votes
1answer
261 views

How good/bad is this implementation to secure password?

I've just started new project and decide to try something new, so I'am not using anymore EnityFramework and Identity framework. I Decide to try MongoDB, so i wanted to design from scratch storing ...
0
votes
0answers
160 views

How to disable the use of verb tunneling using such headers or query parameters in .NET?

I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
0
votes
1answer
26 views

When using public/private keys to secure app licensing info, couldn't someone simply replace your public key to defeat it?

We have a simple C#9/WPF app that we're releasing on .NET 5 Core on which we need to introduce licensing. From what I'm reading, one of the most common patterns to do so is asymmetric encryption, aka ...
3
votes
0answers
71 views

What are these requests that appear to be phoning home?

I have a .NET 5 application running on AWS which has these requests constantly attempting to run: GET http://app-10-irules.com/ GET http://www.simpleexample.com/ GET http://ssl-app-default-backend.com/...
2
votes
2answers
52 views

Check Expired Token (after a visit)

I'm implementing a model which I'll have to reupdate the users, so I want to deliver a unique link to the users and after confirmed the update, I expire that link, so I prevent reusing that link. How ...
1
vote
0answers
66 views

HTTP: Headers vulnerability still showing after being added

A web vulnerability assessment was done on our web app by a third company that specializes in security, and we added common headers that we missing, and to check my headers internally before the third ...
3
votes
2answers
192 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
1
vote
3answers
109 views

Process.Start() Command Injection

How to exploit a program that has this line: Process.Start(user_input + "calc.exe") It's a .NET function and nothing has worked so far ("mal.exe &&", "mal.exe;", ...
0
votes
1answer
96 views

Skip date check in Server certificate in Chrome

We have a web application on https port with server certificate valid from 01/01/2021 and valid to 31/12/2021. Due to some constraints the clients which are going to use web application are behind ...
0
votes
2answers
83 views

Protect a software in offline envirement

These days I intensively read maybe all posts and topics based on software security, but I couldn't find any solution that would be acceptable for me (if there are any of them matching my requirements)...
0
votes
1answer
82 views

Is Array.Clear() in C# suitable for zeroing sensitive byte arrays?

Is it worth calling Array.Clear() to clear sensitive byte arrays such as those containing encryption keys? It's not clear whether this is worth doing since the language has a garbage collector.
0
votes
1answer
97 views

Developer requests dev systems don't have .Net patches applied

Looking for some guidance on an internal discussion we're having. We have a .Net developer that is requesting all development systems with Visual Studio installed don't have .Net updates installed. ...
0
votes
0answers
176 views

Why Recursive Grep + Pitchfork payload doesn't work as expected in Burp Suite?

SCENARIO: I'm playing around with a .NET application. In particular I'm testing the login page. The source code contains __VIEWSTATE, __EVENTAVALIDATION, __VIEWSTATEGENERATOR. I want to try a ...
0
votes
1answer
43 views

Secure an intranet Winform application

Is there a need to secure winform application in an intranet environment? Clearly, there is no external threat and only authorized personnel have access to the intranet environment, so I am not sure ...
2
votes
1answer
88 views

Can a client application volunteer to send a certificate?

When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send. Network traffic with a service where our application is known to ...
1
vote
0answers
57 views

Visual Studio Issues in shellcode delivery

I am learning shellcode development and payload delivery. I have been trying to do some exercises from a lab whereby unmanaged memory is injected with Shellcode using .NET, below is the code: try { ...
0
votes
1answer
122 views

DLL hijack privileges

DLL hijacking means that malicious software gets admin rights from default or it means you need to elevate your privileges first? Because I tried to change a DLL in Windows/System32 folder, but I can'...
1
vote
2answers
99 views

How to devise cryptographic system with sharing ability

I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
1
vote
2answers
90 views

Can a symmetric key be safely embedded anywhere in a .NET desktop client program

Is there a native way, that is, one not requiring the purchase of an expensive third-party obfuscator, that a .NET desktop client program, deployed to the users' Windows desktops from a LAN server ...
3
votes
3answers
184 views

Is Telnet safe for receiving text or does it compromise my whole network?

I have a telnet port open to my PC using the TCPClient in latest version of .net, it is only used for receiving text then parsing it and adding it into an SQL Database, my telnet server does not reply ...
2
votes
1answer
427 views

Why does Wireshark not recognize WCF traffic as TLS encrypted?

In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them. The class defines an attribute named Security, ...
0
votes
1answer
64 views

Is using SecureString in combination with Xor considered secure enough for standalone Windows app?

The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string. License.Import(string name, string email, ...
1
vote
1answer
118 views

Cracking .NET random

I know .NET has two PRNGs, one secure and one insecure. What is the approach to cracking the insecure one (I want to use it to test an .aspx site)? I searched all over but I only found references to ...
0
votes
1answer
90 views

Algorithm to implement symmetric encryption in VB.Net for Windows and in Swift for iOS

I need to implement symmetric encryption to enable secure communication between one program running on a Windows machine (to be written in VB.Net) and an app running on an iOS device (to be written in ...
-2
votes
1answer
1k views

How to embedded exe file into png file such that when png file open then exe file also open with png? [closed]

No code yet. I have used binary and base64 to embedded exe and png file into png. But none of these methods works for me. Because when I run png file exe is not run. I don't know why. I need help in ...
0
votes
1answer
100 views

Why ASP.Net Identity sends sensitive information to clients?

As far as I understand, Identity sends to the user an encrypted token with some user information like the user name and expiration date. Then, when a new request arrives to the server, it decrypts it ...
1
vote
0answers
48 views

How to securely open a folder using .NET without user input?

I would like to open a folder using .NET and it seems like as if Process.Start is the way to go: Open a folder using Process.Start. I already read How to securely use Process.Start? but it deals with ...
0
votes
1answer
782 views

How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below. @Html.TextBoxFor(m => m....
1
vote
0answers
68 views

Store passwords local with plain text access on WinPE

I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time. The OS is WinPE, so he cannot map the ...
0
votes
1answer
211 views

.NET application protection technique against cracking

I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market. Info about the software: Built using .NET C# (Framework 4.5.2) ...
1
vote
1answer
82 views

Securely store tokens in WinPE

We have a tool running on WinPE (Windows PreInstallation Environment) which talks to a web service. A user enters his login credentials and the web service authenticates the user and returns an ...
1
vote
1answer
94 views

Is it bad practice to reuse private EC key as a shared secret for a symmetric algorithm?

The encrypted text is public, embedded in the binary of my software which is published on the internets. I know the open text but there’s large circle of third parties who might know it too, despite ...
1
vote
1answer
763 views

Preventing CSRF with SameSite=“strict” without degrading user experience?

ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks: https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
1
vote
1answer
695 views

Using Selenium to automate data entry

We have a report that generates ~100 rows daily and our customers have to enter the data into third-party software. We hoped that the software allows some kind of data upload so that our customers don'...
2
votes
2answers
143 views

Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?

I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness. Before, I just grabbed the generated salt and put it ...
1
vote
0answers
101 views

CWE-611: Improper Restriction of XML External Entity Reference with XSL include

Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference. XslCompiledTransform transform = new XslCompiledTransform(); transform.Load(...
5
votes
1answer
2k views

Where to store secrets in .NET applications?

I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
27
votes
2answers
5k views

How to avoid using System.String with Rfc2898DeriveBytes in C#

I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
3
votes
0answers
139 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
3
votes
2answers
243 views

Generate cryptographically safe int

How can you generate a cryptographically safe integer that falls within a range in C#? I am trying to satisfy a Veracode issue reporting CWE-331: Insufficient Entropy. Obviously the code below is not ...
1
vote
5answers
237 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...

1
2 3 4 5
8