Questions tagged [.net]

A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

Filter by
Sorted by
Tagged with
56
votes
5answers
89k views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
1
vote
1answer
73 views

Is it bad practice to reuse private EC key as a shared secret for a symmetric algorithm?

The encrypted text is public, embedded in the binary of my software which is published on the internets. I know the open text but there’s large circle of third parties who might know it too, despite ...
4
votes
2answers
868 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
1
vote
1answer
85 views

Preventing CSRF with SameSite=“strict” without degrading user experience?

ASP.NET will soon begin reflecting Google's decision to default cookies to SameSite="strict" in a defense against CSRF attacks: https://devblogs.microsoft.com/aspnet/upcoming-samesite-cookie-changes-...
8
votes
3answers
2k views

Is there an equivalent of npm audit for nuget packages? [closed]

I'm working on a couple of large .NET web apps and would like to audit the packages used in them. For node projects I've use npm audit. This checks whether your npm packages or their dependencies have ...
1
vote
1answer
80 views

.Net WebClient - self signed certificate

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results. I need to ensure Encryption, data integrity, and ...
2
votes
3answers
1k views

How to prevent malicious DLL from getting used in LoadLibrary or DllImport (.NET) calls

I have a situation where malicious files are being copied to the installation directory of some software and the software will load those files when making a call to LoadLibrary or DllImport (in .NET ...
1
vote
3answers
142 views

Security risks downloading external images automatically from script

I'm a developping a program which generates images from HTML files filled with external RSS feeds data. When the RSS feed contains images, I need to check their resolution and format (for instance, if ...
1
vote
0answers
65 views

Should HTTP_COOKIE, __RequestVerificationToken, _RequestVerificationToken and .ASPXAUTH be kept secret?

Inside our ASP.NET MVC-4 web application, we have added the Elmah error logging, and I wrote a code to prevent the Elmah from exposing the user password inside the error file. But inside the Elmah ...
2
votes
3answers
1k views

How to delete a C# variable value permanently from memory?

I have created a variable in C#. Now I want to clear the variables value from the computer memory. Is there any way to do that? Below is my current attempt at deleting the value of recordLine, but I ...
0
votes
1answer
459 views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
0
votes
1answer
549 views

Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)

I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO. My initial assessment is that ...
1
vote
1answer
88 views

Using Selenium to automate data entry

We have a report that generates ~100 rows daily and our customers have to enter the data into third-party software. We hoped that the software allows some kind of data upload so that our customers don'...
2
votes
2answers
104 views

Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?

I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness. Before, I just grabbed the generated salt and put it ...
1
vote
0answers
67 views

CWE-611: Improper Restriction of XML External Entity Reference with XSL include

Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference. XslCompiledTransform transform = new XslCompiledTransform(); transform.Load(...
0
votes
0answers
15 views

Securing DB connection string and other configuration files in RCE scenario

Environment: Microsoft Windows IIS Web server MSSQL DB Let's say an application gets compromised with an RCE, what's the best scenario of protecting the database connection string file or any ...
27
votes
2answers
4k views

How to avoid using System.String with Rfc2898DeriveBytes in C#

I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
0
votes
1answer
181 views

Where to store secrets in .NET applications?

I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
0
votes
0answers
31 views

Active Directory with multi factor authentication for an existing web application

Customer is asking for LDAP / Active Directory authentication along with OTP (one time password) / multi-factor authentication for an old existing web application written in (asp.net MVC2). Is this ...
3
votes
0answers
58 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
1
vote
5answers
221 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
3
votes
2answers
85 views

Generate cryptographically safe int

How can you generate a cryptographically safe integer that falls within a range in C#? I am trying to satisfy a Veracode issue reporting CWE-331: Insufficient Entropy. Obviously the code below is not ...
0
votes
1answer
50 views

How to implement Anti-CSRF method? [closed]

I have created a ASP.NET project and I want to implement Anti-CSRF method in my project. How to do that?
0
votes
0answers
26 views

How to make connection secure in ASP.NET? [duplicate]

I have created a asp.net project when I run it in browser it shows connection insecure. How to overcome this ? How to make connection secure? https://www.sendspace.com/file/x3lnd4----Image that shows ...
1
vote
0answers
148 views

.NET Remoting Pentest [closed]

I am carrying out activities of Vulnerability Assessment and Penetration Test, specifically, I am testing an application written in .NET Remoting. Sniffing the communication (With Wireshark) of an ...
0
votes
0answers
58 views

What is the best way to secure web API calls from worker apps running on Windows

I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
0
votes
1answer
94 views

Get client ip address that is not spoofed

I am using the following source code to get a client IP address, Public Shared Function GetIPAddress() As String Dim context As System.Web.HttpContext = System.Web.HttpContext.Current Dim ...
2
votes
1answer
84 views

Will installing WinZip 22 on a server create a security vulnerability?

I've recently requested a WinZip v22 with command line installation on a Windows POC/Dev server that we're using to pilot an application that is written in .Net. In the application there is ...
2
votes
1answer
103 views

What security precautions should we take when letting a C# application send/receive emails?

I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
0
votes
1answer
101 views

Bypassing URL verification [closed]

I'm dealing with a URL validation function that was made by the developer (instead of using trusted methods). Here is a slightly modified version of the function: public static bool IsValidURL(...
1
vote
0answers
54 views

Which attributes does DPAPI's “UseMachineProtection” use to identify a machine?

We're using DPAPIProtectedConfigurationProvider from the Windows Data Protection API to encrypt an application config file. The API offers a property called UseMachineProtection, so that the config ...
0
votes
1answer
271 views

Using different host key algorithms on sftp server and client

I need to setup a sftp client the problem i am facing is that sftp client library i am using does not support the host key algorithm supported by sftp server. Basically I am talking about the public ...
0
votes
1answer
795 views

Alternative to bcrypt in .NET Core?

I'm porting an app from Node to ASP.NET Core, and discovered that the .NET Core framework doesn't have a bcrypt implementation. There are community supported bcrypt implementations but they are very ...
3
votes
0answers
70 views

How secure is this combined sha1/md5 hash [duplicate]

Recently we outsourced some work for a website. While reviewing this code I came across the password hash function. I am in no way a security expert besides some basic knowledge (hence outsourcing ...
1
vote
1answer
191 views

Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?

I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
0
votes
1answer
65 views

SQL injection in Windows Services?

I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL). There is a client application which allows a user to upload files through it to ...
2
votes
1answer
2k views

Insecure Deserialization in C# (.NET) - How to identify and test

I have been reading up on Insecure Deserialization and how it can affect Java applications. https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization If the captured traffic data include ...
7
votes
3answers
14k views

How to bypass .Net 4.5 request validation, for an XSS attack?

.Net has a feature called request validation which detects malicious inputs and blocks the request. By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on ...
0
votes
0answers
178 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
3
votes
2answers
252 views

BCrypt workfactor for salt?

From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
0
votes
2answers
171 views

How to hide a process in Windows?

Is there a way to make a process hidden without using any Administrator-level priviledges? I am building an antivirus which I want to protect from malware's actions, such as ending the process, or ...
0
votes
2answers
6k views

C# malicious file upload to server

I was joking around with some file-uploads to the server, for the site I was working on. Now it seems to me that we have an enormous security-risk. They don't block any file extensions that are ...
2
votes
3answers
2k views

How to prevent someone guessing the token in a reset password link

Currently I have the following set-up for handling users that forgot their password. A user types in his/her e-mail address and presses the forgot password button. I look up the user belonging to ...
2
votes
0answers
78 views

Is Jil vulnerable to Friday The 13th JSON attack?

Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented? Explanation of the attack: ...
0
votes
1answer
44 views

Revoke OAuth2 Token For Mobile App

When a user logs into my mobile app it uses OAuth to authenticate them and generates a token. The token is then checked against each subsequent request. Each user account in my application has an ...
4
votes
2answers
3k views

Secure flag for ASPXAUTH Cookie in MVC

We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool. Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's ...
2
votes
1answer
277 views

Decrypting SSL traffic using Fiddler to see requests being sent by malware written in .NET

I tried to find the GET data of some malware but it appears that this malware is encrypting traffic using SSL. When I tried to decrypt the SSL data via Fiddler, I always get nothing — only ...
2
votes
0answers
393 views

ASP.NET SOAP Service XXE

Is it possible to do any type of XXE in a service developed using default C# SOAP service framework? I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
3
votes
1answer
264 views

BouncyCastle and Microsoft Cng ECDH secret key mismatch

I'm trying to refactor some client-side code from BouncyCastle to Microsoft Cng. I've figured out how to convert key format(ECC key blobs) between them, but I couldn't calculate the same secret. ...
1
vote
1answer
76 views

Can you fake the Host attribute of a C# URI?

I was wondering if you can fake the Uri.Host value of a string. For example, given the following code: new Uri(url.ToLower()).Host == "example.com" Is there anyway to have this boolean comparison be ...