Skip to main content

Questions tagged [.net]

A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

Filter by
Sorted by
Tagged with
2 votes
1 answer
533 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
2 votes
0 answers
65 views

Issue with Single Sign-On (SSO) Implementation for WPF application with ADFS/MSAL

I'm encountering an issue with the implementation of Single Sign-On (SSO) in our WPF application, and I'd appreciate some guidance or insights from the community. Here's a breakdown of our setup: We ...
2 votes
2 answers
658 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason I'm ...
1 vote
2 answers
721 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
1 vote
2 answers
286 views

How to devise cryptographic system with sharing ability

I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
0 votes
1 answer
213 views

Best practises regarding authentication in SPA/API solutions with SSO

There is really not that great information on what the best practices are for auth in SPA/API solutions. Most of them just say use JWTs and auth code flow in the SPA. There is a ton of information ...
1 vote
1 answer
2k views

How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below. @Html.TextBoxFor(m => m....
0 votes
0 answers
69 views

Trouble understanding hash_extension tool examples for hash length extension attack (C#)

I am trying to follow the example of how a hash length extension attack works using the article here: https://www.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks ...
0 votes
0 answers
118 views

Looking for a very basic encrypt/decrypt with a shared key for .net web application

Building a .Net 6 web app and storing data in On-Prem database. I collect some sensitive data that needs to be stored in the database in a format that is not easily readable. I also need to retrieve ...
4 votes
4 answers
36k views

How to delete a C# variable value permanently from memory?

I have created a variable in C#. Now I want to clear the variables value from the computer memory. Is there any way to do that? Below is my current attempt at deleting the value of recordLine, but I ...
0 votes
0 answers
303 views

XSS Payload That Can Bypass Special Character Check

I developed the following C# algorithm to prevent XSS attacks: private bool Is_There_XSS_Payload(string arg) { Regex regex = new Regex(@"^[a-zA-Z0-9]+$"); bool result = ...
1 vote
0 answers
969 views

Uploading webshell in ASP.net application using directory-traversal and file-upload vulnerability

On my target site, I found two vulnerabilities, unrestricted file upload(to any directory) and directory traversal. I have two end points : 1- site.com/fileUp : uploads file { ----Request Parameters---...
5 votes
1 answer
6k views

Encrypting/decrypting our license key

We need to provide a license key to customers for our application. The actual license is XML but we need to encrypt it and then in our program decrypt it. I think it is the following, but am asking to ...
1 vote
1 answer
477 views

.Net WebClient - self signed certificate

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results. I need to ensure Encryption, data integrity, and ...
0 votes
1 answer
238 views

Exploit user controllable C# code in webapp

The application in question offers the option to create arbitrary C# code and execute it at any time. These could be considered macros to customize certain tasks. Say that a normal user, who would ...
3 votes
1 answer
14k views

Should I specify JWT audience and issuer if I have only one SPA client?

I have an API server (ASP.NET Core 5) and SPA client (ASP.NET Blazor). Nothing else: no external oauth servers, identity providers and whatnot To secure access, the server issues and validates access ...
3 votes
2 answers
10k views

Evaluate the signature of an X509 certificate in .NET

This is my scenario: A CA signs a certificate with its private key and sends it to a client via https response. From this response the client creates a X509Certificate2 class, that represents the ...
7 votes
2 answers
9k views

Is PBKDF2 only SHA1 in C#?

I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography. It seems to be just SHA1. Am I missing ...
0 votes
1 answer
150 views

Storing a key in a reasonably safe way

I’m developing an application that will run on a private, on premises network. The application will be accepting requests through an API, read some encrypted data from the disk, decrypt them, do some ...
2 votes
1 answer
553 views

Is better for security to not run Nginx and Backend inside docker but use docker only for database and not external exposed services?

I'm not a Docker specialist, I know how to install, configure and do only basic Docker hardening based on Docker official documentation. I know nothing about AppArmor,SELinux and GRSEC. But i need to ...
1 vote
2 answers
1k views

Is Array.Clear() in C# suitable for zeroing sensitive byte arrays?

Is it worth calling Array.Clear() to clear sensitive byte arrays such as those containing encryption keys? It's not clear whether this is worth doing since the language has a garbage collector.
6 votes
3 answers
4k views

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

My organization has a group policy that is applied to servers enforcing FIPS compliance (Windows AD policy). In .NET, HMACSHA1 is one of the encryption/hash algorithms that is FIPS compliant. I don't ...
5 votes
2 answers
11k views

How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?

In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended. ...
4 votes
1 answer
4k views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
1 vote
1 answer
1k views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
3 votes
2 answers
855 views

Are .NET project GUID's visible when compiling?

I know if a person has a GUID from a machine that person can figure out if other guid belongs to that machine. In a .NET project (csproj and the visual studions solution file) GUIDs are generated. If ...
16 votes
5 answers
13k views

Is it safe to binary-deserialize user-provided data?

AppHarbor has a blog post containing sample C# code which reads data from an unsigned cookie and passes it through .Net binary serialization. Is that safe? Obviously, the data is completely ...
0 votes
1 answer
1k views

Skip date check in Server certificate in Chrome

We have a web application on https port with server certificate valid from 01/01/2021 and valid to 31/12/2021. Due to some constraints the clients which are going to use web application are behind ...
2 votes
1 answer
1k views

Tutorial for SecurityCritical SecurityTransparent and new .NET 4 feature: Level 2

I need a primer for both the legacy (Level 1) .NET 2.0 security attributes and the new .NET 4 (Level 2) ones. I'm not familiar with the implications of controlling LinkDemand, stack walks, ...
5 votes
3 answers
4k views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
0 votes
1 answer
235 views

Are .NET runtime really not signed?

I'm doing a manual install on Linux of the .NET runtime which can be downloaded from dotnet.microsoft.com. MS do provide a SHA512 checksum of the file on the site, but that can't be use to verify the ...
-3 votes
1 answer
297 views

Decode Encrypted Password help me [duplicate]

Help me to decode belove password 68H++v5FX/kUty5/itzflw== Above is password store in sql table
0 votes
1 answer
787 views

How to preserve key in TPM 2.0

I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
0 votes
1 answer
614 views

How to protect private key for client cert in machine store? Is it acceptable for it to be exportable?

Is it acceptable to store a client cert's private key as exportable in the computer's certificate store? I have a .NET desktop app that installs client certificates in local machine\personal. The ...
0 votes
0 answers
2k views

Best way to handle Path Manipulation vulnerabilities with retrieving files from .appconfig?

I'm currently working on a task where I am trying to suppress some Path Manipulation warnings that have been raised from running an analysis with Fortify on my team's source code. The issues are being ...
1 vote
0 answers
177 views

RCE through specifying .NET type or namespace?

I'm testing an application that allows the user to provide an XML file that will be processed. (I've already tried typical XML attacks, such as XXE.) One of the elements of the XML file allows the ...
1 vote
1 answer
197 views

Does .NET Framework have a bounty program?

The Microsoft .NET Bounty Program states that "Vulnerabilities in the .NET Framework, or any ASP.NET framework running on .NET Framework (Webforms or MVC)" is out of scope. Is .NET Framework ...
0 votes
1 answer
261 views

Authorization Controls for Offline Windows C# Application

I've been looking into trying to see if there are any authorization controls that can be implemented for a local, and offline, .NET application that are tied to the Windows local authentication. The ...
1 vote
1 answer
136 views

Security for a Windows application running in a corporate network

I know security is pretty important for the web application, but what about windows applications running in a corporate environment, network, not accessible from outside. Do we need to treat security ...
0 votes
1 answer
198 views

Encrypting app settings file is secure than encrypting only the app setting contents?

I have a content as shown below I have encrypted the content by running the below command cd C:\Windows\Microsoft.NET\Framework\v4.0.30319 aspnet_regiis.exe -pef "secureAppSettings" "...
0 votes
2 answers
1k views

Is Output Neutralization required when logging C# exception messages to log files?

CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
2 votes
3 answers
4k views

Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?

I have an MVC app that is using the AntiForgeryToken capability of ASP.NET MVC. AFAICT this uses an encrypted synchronizer token variation where it validates the payload of the tokens. A customer has ...
2 votes
1 answer
1k views

Why does Wireshark not recognize WCF traffic as TLS encrypted?

In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them. The class defines an attribute named Security, ...
0 votes
2 answers
2k views

Windows directory that is only accessible by SYSTEM user

I am developing a .NET Windows Service using C# that needs to download an executable file and run it. I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...
0 votes
3 answers
4k views

where should I store my application password?

I have a Windows application that does not use a database and is not on the Internet. It contains very important data (data loaded from encrypted files). The user needs a password to enter this ...
1 vote
1 answer
908 views

Is this string comparison code resistant to timing attacks?

I have to create an API that authenticates a request by checking if the token in the request is equal to the valid token stored in our database. Initially I used the == operator to compare the two ...
1 vote
0 answers
430 views

How should I store a password used by a service written in .NET

I have a Windows service that accesses a database connection. Since users rarely use Windows authentication, I encrypt the connection string. For development I have the password hard-coded, but I know ...
2 votes
2 answers
435 views

How secure is this communication chat?

I have created a chat between two parties (using c#), and I am wondering what kind of weaknesses have I overlooked. Description of its functionality: There are two individual applications: Client (2 ...
1 vote
1 answer
304 views

IV generation with RNGCryptoServiceProvider

I'm using RNGCryptoServiceProvider.GetBytes(new byte[16]) to generate IV's to use in AES (256 bits) encryption. For every record I encrypt, I generate a new IV. I'm also prepending each of these IV's ...
1 vote
3 answers
531 views

Security risks downloading external images automatically from script

I'm a developping a program which generates images from HTML files filled with external RSS feeds data. When the RSS feed contains images, I need to check their resolution and format (for instance, if ...

1
2 3 4 5
8