Questions tagged [.net]
A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
382
questions
27
votes
2
answers
5k
views
How to avoid using System.String with Rfc2898DeriveBytes in C#
I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
- 30.6k
7
votes
1
answer
6k
views
Where to store secrets in .NET applications?
I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
- 48.4k
3
votes
0
answers
260
views
Is there an easy way to dissect .NET Remoting traffic for reverse engineering?
I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
- 135k
1
vote
5
answers
374
views
Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN
I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
- 1,199
3
votes
2
answers
556
views
Generate cryptographically safe int
How can you generate a cryptographically safe integer that falls within a range in C#? I am trying to satisfy a Veracode issue reporting CWE-331: Insufficient Entropy. Obviously the code below is not ...
- 143
0
votes
1
answer
197
views
How to implement Anti-CSRF method? [closed]
I have created a ASP.NET project and I want to implement Anti-CSRF method in my project. How to do that?
- 3,794
1
vote
0
answers
560
views
.NET Remoting Pentest [closed]
I am carrying out activities of Vulnerability Assessment and Penetration Test, specifically, I am testing an application written in .NET Remoting. Sniffing the communication (With Wireshark) of an ...
- 129k
0
votes
1
answer
722
views
Get client ip address that is not spoofed
I am using the following source code to get a client IP address,
Public Shared Function GetIPAddress() As String
Dim context As System.Web.HttpContext = System.Web.HttpContext.Current
Dim ...
- 16.1k
2
votes
1
answer
192
views
Will installing WinZip 22 on a server create a security vulnerability?
I've recently requested a WinZip v22 with command line installation on a Windows POC/Dev server that we're using to pilot an application that is written in .Net.
In the application there is ...
2
votes
1
answer
169
views
What security precautions should we take when letting a C# application send/receive emails?
I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
0
votes
1
answer
642
views
Bypassing URL verification [closed]
I'm dealing with a URL validation function that was made by the developer (instead of using trusted methods).
Here is a slightly modified version of the function:
public static bool IsValidURL(...
- 129k
1
vote
0
answers
244
views
Which attributes does DPAPI's "UseMachineProtection" use to identify a machine?
We're using DPAPIProtectedConfigurationProvider from the Windows Data Protection API to encrypt an application config file. The API offers a property called UseMachineProtection, so that the config ...
CommunityBot
- 1
0
votes
1
answer
2k
views
Using different host key algorithms on sftp server and client
I need to setup a sftp client the problem i am facing is that sftp client library i am using does not support the host key algorithm supported by sftp server. Basically I am talking about the public ...
CommunityBot
- 1
3
votes
0
answers
71
views
How secure is this combined sha1/md5 hash [duplicate]
Recently we outsourced some work for a website. While reviewing this code I came across the password hash function.
I am in no way a security expert besides some basic knowledge (hence outsourcing ...
- 131
1
vote
1
answer
589
views
Can I decrypt a .gpg file by using Windows CNG store/ProtectedData?
I'm creating this tool in C# that would take a .gpg file and decrypt it using Windows CNG. I get a .gpg file as my input parameter and it is encrypted with my key using WinPT. Decrypting it works with ...
0
votes
1
answer
186
views
SQL injection in Windows Services?
I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL).
There is a client application which allows a user to upload files through it to ...
- 5,130
2
votes
1
answer
5k
views
Insecure Deserialization in C# (.NET) - How to identify and test
I have been reading up on Insecure Deserialization and how it can affect Java applications.
https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization
If the captured traffic data include ...
- 15.7k
0
votes
0
answers
689
views
How to store SSN in asp.net web-based application on a short-term basis?
After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
- 246
3
votes
2
answers
1k
views
BCrypt workfactor for salt?
From what I read here: How to securely hash passwords?, you're supposed to iterate the hashing. However in the implementation of BCrypt for .Net uses the workfactor (2^wf iterations) in the '...
- 402
0
votes
2
answers
2k
views
How to hide a process in Windows?
Is there a way to make a process hidden without using any Administrator-level priviledges? I am building an antivirus which I want to protect from malware's actions, such as ending the process, or ...
- 3,260
4
votes
3
answers
3k
views
How to prevent someone guessing the token in a reset password link
Currently I have the following set-up for handling users that forgot their password.
A user types in his/her e-mail address and presses the forgot password button.
I look up the user belonging to ...
- 121
2
votes
0
answers
166
views
Is Jil vulnerable to Friday The 13th JSON attack?
Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented?
Explanation of the attack: ...
- 4,743
4
votes
2
answers
6k
views
Secure flag for ASPXAUTH Cookie in MVC
We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool.
Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's ...
CommunityBot
- 1
2
votes
1
answer
800
views
Decrypting SSL traffic using Fiddler to see requests being sent by malware written in .NET
I tried to find the GET data of some malware but it appears that this malware is encrypting traffic using SSL.
When I tried to decrypt the SSL data via Fiddler, I always get nothing — only ...
- 48.4k
2
votes
0
answers
865
views
ASP.NET SOAP Service XXE
Is it possible to do any type of XXE in a service developed using default C# SOAP service framework?
I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
- 21
3
votes
1
answer
848
views
BouncyCastle and Microsoft Cng ECDH secret key mismatch
I'm trying to refactor some client-side code from BouncyCastle to Microsoft Cng. I've figured out how to convert key format(ECC key blobs) between them, but I couldn't calculate the same secret.
...
- 151
1
vote
1
answer
410
views
Can you fake the Host attribute of a C# URI?
I was wondering if you can fake the Uri.Host value of a string. For example, given the following code:
new Uri(url.ToLower()).Host == "example.com"
Is there anyway to have this boolean comparison be ...
- 65.6k
1
vote
1
answer
3k
views
How to pass a localhost check for an incoming request?
I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost:
public void Request(HttpListenerContext context) {
...
- 48.4k
1
vote
1
answer
1k
views
How to prevent expired cookies from maintaining accesss?
My company has a website that was recently the target of a security audit. They found that if a hacker had obtained the browser cookies used by our .NET website for authorization, that those cookies ...
- 15.7k
0
votes
1
answer
136
views
What is a secure way to use PHP tokens in a C# application
I have a C# app that is sending post requests to and from a php script. I have token based authentication setup on the php, and I have my C# app sending the tokens, however, even with obfuscation, if ...
- 48.4k
2
votes
1
answer
2k
views
Risks of letting the browser open local/network file system listing
Browsers do not generally allow web pages to interact with client-side file system as a security measure. I would like to know what can go wrong with the following scenario:
Clicking a special ...
- 163
7
votes
3
answers
6k
views
Reference implementation of C# password hashing and verification
Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java?
Ideally,I'd like to see something that includes a "...
CommunityBot
- 1
4
votes
1
answer
3k
views
What do you search for in Open Source code to be sure there isn't malicious code?
I realize the answers will be language specific, but I am curious what terms you would look for when checking something out on Github? I was looking for a remote administration tool that I could use ...
- 58.9k
1
vote
2
answers
348
views
Make application use encrypted credentials from a file [duplicate]
I am new to cyber security but I am working on a project where I need to use it and I don't know where to start.
The application I am working on connects to Jira to retrieve data and generate ...
- 578
1
vote
2
answers
695
views
How to obfuscate a assemblies binary compiled with .NET framework?
How to obfuscate a binary compile with .NET framework? Tools such as Ebowla and Pecloak.py will encrypt it but the program won't run. Even UPX can't pack it. Wondering are there any ways to obfuscate ...
- 1,844
2
votes
0
answers
248
views
HTML Form to PDF vulnerabilities
I have a form where the user inputs data.
On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
- 7,858
1
vote
0
answers
392
views
Veracode still reports OS command injection issue after I have applied the solution as recommendations from OWAPS and Roslyn Security Guard [closed]
Current code in my project is shown below and Veracode reports there is an OS command injection
filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg"
ProcessStartInfo startInfo = ...
- 111
8
votes
1
answer
5k
views
Is .NET XmlSerializer.Deserialize(TextReader) safe?
Is the .NET method XmlSerializer.Deserialize(TextReader) safe from XML vulnerabilities (XXE, XmlBomb etc..)? Will the DTD be processed during deserialization?
I can understand why XmlSerializer....
- 315
1
vote
1
answer
9k
views
Is CBC mode for AES still safe to use in 2018?
I'm using AES-256 CBC mode in C# to encrypt various amounts of texts. The key and IV are always generated properly randomly. However, would GCM mode provide any noticeable security gains over CBC?
- 1,092
3
votes
1
answer
280
views
What is properly way to manage and remove symmetric key in C#
If I have a symmetric key in a byte[] array in C#, how can I erase it securely?
for (int i = 0; i < array.Length; i++) {
array[i] = 0;
}
Is this good enough?
- 4,743
1
vote
1
answer
5k
views
Why isn't sophisticated malware written with .NET? [closed]
I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my more than seven years experience in .NET, I feel ...
- 66.7k
2
votes
1
answer
774
views
SSL certificate for WebAPI
We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
- 206
2
votes
1
answer
367
views
Automatic choice of the hash function for key derivation
This is a theoretical question: does this make sense and is secure?
My goal is to strengthen the passphrase. The flow is the following:
I enter a pssphrase admin1234. This passphrase is going to be ...
- 66.7k
-1
votes
1
answer
174
views
Visual Studio anonymity
Recently me and me colleague was wondering about obfuscating / removing project info. If application is reverse engineered than what kind of information the engineer sees?
Can he see the email of the ...
- 590
1
vote
1
answer
454
views
User Credentials for Accessing Network Resources
I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
- 129
1
vote
0
answers
307
views
Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)
I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key.
I'm searching for the best way to store the key for every ...
- 131
3
votes
1
answer
2k
views
Are .NET WebServices vulnerable to CSRF?
While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF.
There isn't ...
- 65.6k
1
vote
1
answer
908
views
Is OWASP ESAPI .NET Edition really used? Is this project still alive?
I have just seen that the last release has been pushed out in 2009 and that raised my doubts.
- 65.6k
0
votes
0
answers
512
views
ViewStateUserKey .NET CSRF protection
In a typical PHP web application you append a hidden CSRF Token in each form and this token is validated when the request is submitted in the server side.
I am performing a penetration test in a .NET ...
- 1,514
0
votes
1
answer
1k
views
How to get session info out of encrypted .NET viewstate?
I am performing a penetration testing for the first time in a .NET application that instead of providing cookies for session management uses the viewstate hidden field.
I am using the .NET Beautifier ...
- 1,059