Questions tagged [.net]

A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

53 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
330 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
3
votes
0answers
112 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
2
votes
0answers
49 views

Process.Start() Command Injection

How to exploit a program that has this line: Process.Start(user_input + "calc.exe") It's a .NET function and nothing has worked so far ("mal.exe &&", "mal.exe;", ...
2
votes
1answer
299 views

Why does Wireshark not recognize WCF traffic as TLS encrypted?

In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them. The class defines an attribute named Security, ...
2
votes
0answers
92 views

Is Jil vulnerable to Friday The 13th JSON attack?

Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented? Explanation of the attack: ...
2
votes
0answers
498 views

ASP.NET SOAP Service XXE

Is it possible to do any type of XXE in a service developed using default C# SOAP service framework? I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
2
votes
0answers
164 views

HTML Form to PDF vulnerabilities

I have a form where the user inputs data. On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
2
votes
0answers
500 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
0answers
355 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
2
votes
0answers
554 views

How to use IIS ssl certificate(CNG) for data encryption

I want to use RSA to encrypt/decrypt some data using IIS's ssl ceritifcate, from within a web service(WCF). I've managed so far to do this by using .NET security classes(RSACryptoServiceProvider/...
2
votes
1answer
106 views

What security precautions should we take when letting a C# application send/receive emails?

I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
2
votes
1answer
278 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason I'...
1
vote
0answers
43 views

Visual Studio Issues in shellcode delivery

I am learning shellcode development and payload delivery. I have been trying to do some exercises from a lab whereby unmanaged memory is injected with Shellcode using .NET, below is the code: try { ...
1
vote
2answers
87 views

How to devise cryptographic system with sharing ability

I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
1
vote
0answers
48 views

How to securely open a folder using .NET without user input?

I would like to open a folder using .NET and it seems like as if Process.Start is the way to go: Open a folder using Process.Start. I already read How to securely use Process.Start? but it deals with ...
1
vote
0answers
64 views

Store passwords local with plain text access on WinPE

I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time. The OS is WinPE, so he cannot map the ...
1
vote
0answers
91 views

CWE-611: Improper Restriction of XML External Entity Reference with XSL include

Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference. XslCompiledTransform transform = new XslCompiledTransform(); transform.Load(...
1
vote
1answer
165 views

.Net WebClient - self signed certificate

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results. I need to ensure Encryption, data integrity, and ...
1
vote
0answers
82 views

Which attributes does DPAPI's “UseMachineProtection” use to identify a machine?

We're using DPAPIProtectedConfigurationProvider from the Windows Data Protection API to encrypt an application config file. The API offers a property called UseMachineProtection, so that the config ...
1
vote
3answers
225 views

Security risks downloading external images automatically from script

I'm a developping a program which generates images from HTML files filled with external RSS feeds data. When the RSS feed contains images, I need to check their resolution and format (for instance, if ...
1
vote
0answers
176 views

Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)

I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key. I'm searching for the best way to store the key for every ...
1
vote
0answers
118 views

Example of Insecure DTD Processing in XmlSchema.Read

According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack: var src = "?...
1
vote
0answers
264 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
0answers
18 views

Does Thinktecture V2 Require Round Trips on Requests

I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications ...
1
vote
0answers
90 views

Java & .Net Secure Passwords in Console applications

Background I know that we should not store passwords in String variables in Java/.Net (Should be stored in mutable objects such as char arrays). And When it comes to the UI aspects we do have ...
1
vote
0answers
481 views

Sharing an access token from an external provider among apps

I have a running web app that uses an external OAuth provider (Reddit) to log in with. I want to integrate this app with someone else's mobile app and I want to make it as easy as possible for ...
1
vote
0answers
147 views

How to view the signing certificate of outlook before sending email using C# addin

using the ribbon xml addin one can send signed email by enabling sign button using schema name as string PR_SECURITY_FLAGS = "http://schemas.microsoft.com/mapi/proptag/0x6E010003"; Here before ...
1
vote
0answers
238 views

Logout from IdP, where should user end up?

When a user clicks Logoff on my website, it executes the following .NET code: public ActionResult SLOService() { // Receive the single logout request or response. // If a request is received ...
1
vote
0answers
1k views

Is comparing the thumbprint of a SSL certificate secure enough?

I was wondering if comparing the X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not. Of course this would only work for specific ...
1
vote
0answers
382 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
0answers
567 views

How to acquire the RSACryptoServiceProvider from the existing key container?

The Key containers of "Microsoft Base Smart Card Crypto Provider" are enumerated by setting PP_ENUMCONTAINERS flag for the function CryptGetProvParam(). The enumerated key containers are set to the ...
1
vote
0answers
50 views

IX509Extension XCN encoding?

I understand from reading MSDN that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject ...
1
vote
0answers
198 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
0answers
143 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
1
vote
0answers
103 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : 'v2....
1
vote
0answers
41 views

Securing customer assets in .NET

We are rethinking our security and came on an interesting issue. How can me make a generic security implementation for customer owned assets. Does every asset need a direct-indirect relation to a ...
1
vote
0answers
154 views

Why do we need salt and RFC in generating AES encrypted message

I'm not very familiar with encryption and new to this, I'm just learning it right now by code review of one of the class we have in an application to encrypt a password using AES. Would anyone explain ...
1
vote
0answers
119 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
1
vote
0answers
450 views

Login Authentication with SSL and HMAC

My question is pretty similar to : https://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
1
vote
0answers
256 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); store.Open(OpenFlags....
0
votes
1answer
65 views

Is Array.Clear() in C# suitable for zeroing sensitive byte arrays?

Is it worth calling Array.Clear() to clear sensitive byte arrays such as those containing encryption keys? It's not clear whether this is worth doing since the language has a garbage collector.
0
votes
1answer
76 views

Developer requests dev systems don't have .Net patches applied

Looking for some guidance on an internal discussion we're having. We have a .Net developer that is requesting all development systems with Visual Studio installed don't have .Net updates installed. ...
0
votes
0answers
55 views

Why Recursive Grep + Pitchfork payload doesn't work as expected in Burp Suite?

SCENARIO: I'm playing around with a .NET application. In particular I'm testing the login page. The source code contains __VIEWSTATE, __EVENTAVALIDATION, __VIEWSTATEGENERATOR. I want to try a ...
0
votes
0answers
47 views

Using Noise Framework KK as alternative to DTLS?

I am trying to create a secure UDP connection in NET Core. Due to DTLS not being supported and it being quite the headache and existing libraries (DTLS.Net) are limited and inactive. Noise Framework ...
0
votes
0answers
91 views

How to determine if particular .NET/ASP.NET build has known vulnerabilities?

I'm trying to find a list to help find out if particular ASP.NET version has known vulnerabilities by version-build number. Googling doesn't help. Is there a list by Microsoft that can help me, ...
0
votes
0answers
61 views

Which Algorithm should PFX file use to sign PDF document?

I exported localhost certificate in .PFX format with private key. I have to use this PFX file to sign PDF document. C# program was used to sign document and below error encountered when hitting this ...
0
votes
1answer
545 views

How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below. @Html.TextBoxFor(m => m....
0
votes
0answers
318 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
0
votes
1answer
591 views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
0
votes
0answers
343 views

ViewStateUserKey .NET CSRF protection

In a typical PHP web application you append a hidden CSRF Token in each form and this token is validated when the request is submitted in the server side. I am performing a penetration test in a .NET ...