Questions tagged [.net]

A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

46 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
307 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
3
votes
0answers
58 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
2
votes
0answers
76 views

Is Jil vulnerable to Friday The 13th JSON attack?

Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented? Explanation of the attack: ...
2
votes
0answers
392 views

ASP.NET SOAP Service XXE

Is it possible to do any type of XXE in a service developed using default C# SOAP service framework? I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
2
votes
0answers
153 views

HTML Form to PDF vulnerabilities

I have a form where the user inputs data. On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
2
votes
0answers
486 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
0answers
349 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
2
votes
0answers
523 views

How to use IIS ssl certificate(CNG) for data encryption

I want to use RSA to encrypt/decrypt some data using IIS's ssl ceritifcate, from within a web service(WCF). I've managed so far to do this by using .NET security classes(RSACryptoServiceProvider/...
2
votes
1answer
103 views

What security precautions should we take when letting a C# application send/receive emails?

I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
2
votes
1answer
262 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason I'...
1
vote
0answers
55 views

Should HTTP_COOKIE, __RequestVerificationToken, _RequestVerificationToken and .ASPXAUTH be kept secret?

Inside our ASP.NET MVC-4 web application, we have added the Elmah error logging, and I wrote a code to prevent the Elmah from exposing the user password inside the error file. But inside the Elmah ...
1
vote
0answers
66 views

CWE-611: Improper Restriction of XML External Entity Reference with XSL include

Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference. XslCompiledTransform transform = new XslCompiledTransform(); transform.Load(...
1
vote
1answer
80 views

.Net WebClient - self signed certificate

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results. I need to ensure Encryption, data integrity, and ...
1
vote
0answers
54 views

Which attributes does DPAPI's “UseMachineProtection” use to identify a machine?

We're using DPAPIProtectedConfigurationProvider from the Windows Data Protection API to encrypt an application config file. The API offers a property called UseMachineProtection, so that the config ...
1
vote
3answers
142 views

Security risks downloading external images automatically from script

I'm a developping a program which generates images from HTML files filled with external RSS feeds data. When the RSS feed contains images, I need to check their resolution and format (for instance, if ...
1
vote
0answers
142 views

Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)

I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key. I'm searching for the best way to store the key for every ...
1
vote
0answers
91 views

Example of Insecure DTD Processing in XmlSchema.Read

According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack: var src = "?...
1
vote
0answers
191 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
1
vote
0answers
17 views

Does Thinktecture V2 Require Round Trips on Requests

I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications ...
1
vote
0answers
88 views

Java & .Net Secure Passwords in Console applications

Background I know that we should not store passwords in String variables in Java/.Net (Should be stored in mutable objects such as char arrays). And When it comes to the UI aspects we do have ...
1
vote
0answers
428 views

Sharing an access token from an external provider among apps

I have a running web app that uses an external OAuth provider (Reddit) to log in with. I want to integrate this app with someone else's mobile app and I want to make it as easy as possible for ...
1
vote
0answers
142 views

How to view the signing certificate of outlook before sending email using C# addin

using the ribbon xml addin one can send signed email by enabling sign button using schema name as string PR_SECURITY_FLAGS = "http://schemas.microsoft.com/mapi/proptag/0x6E010003"; Here before ...
1
vote
0answers
227 views

Logout from IdP, where should user end up?

When a user clicks Logoff on my website, it executes the following .NET code: public ActionResult SLOService() { // Receive the single logout request or response. // If a request is received ...
1
vote
0answers
796 views

Is comparing the thumbprint of a SSL certificate secure enough?

I was wondering if comparing the X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not. Of course this would only work for specific ...
1
vote
0answers
363 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
0answers
514 views

How to acquire the RSACryptoServiceProvider from the existing key container?

The Key containers of "Microsoft Base Smart Card Crypto Provider" are enumerated by setting PP_ENUMCONTAINERS flag for the function CryptGetProvParam(). The enumerated key containers are set to the ...
1
vote
0answers
47 views

IX509Extension XCN encoding?

I understand from reading MSDN that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject ...
1
vote
0answers
189 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
0answers
141 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
1
vote
0answers
99 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : 'v2....
1
vote
0answers
41 views

Securing customer assets in .NET

We are rethinking our security and came on an interesting issue. How can me make a generic security implementation for customer owned assets. Does every asset need a direct-indirect relation to a ...
1
vote
0answers
152 views

Why do we need salt and RFC in generating AES encrypted message

I'm not very familiar with encryption and new to this, I'm just learning it right now by code review of one of the class we have in an application to encrypt a password using AES. Would anyone explain ...
1
vote
0answers
114 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
1
vote
0answers
416 views

Login Authentication with SSL and HMAC

My question is pretty similar to : https://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
1
vote
0answers
829 views

Bouncy Castle C# API and NTRUEncrypt

I want to play around with NTRUEncrypt and I found this tweet that NTRUE is now part of bouncy castle. But I cannot find any proof of the existence in the source code of teh Bouncy Castle C# API, ...
1
vote
0answers
246 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); store.Open(OpenFlags....
0
votes
0answers
15 views

Securing DB connection string and other configuration files in RCE scenario

Environment: Microsoft Windows IIS Web server MSSQL DB Let's say an application gets compromised with an RCE, what's the best scenario of protecting the database connection string file or any ...
0
votes
0answers
31 views

Active Directory with multi factor authentication for an existing web application

Customer is asking for LDAP / Active Directory authentication along with OTP (one time password) / multi-factor authentication for an old existing web application written in (asp.net MVC2). Is this ...
0
votes
0answers
58 views

What is the best way to secure web API calls from worker apps running on Windows

I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
0
votes
0answers
170 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
0
votes
1answer
458 views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
0
votes
0answers
304 views

ViewStateUserKey .NET CSRF protection

In a typical PHP web application you append a hidden CSRF Token in each form and this token is validated when the request is submitted in the server side. I am performing a penetration test in a .NET ...
0
votes
0answers
122 views

How should Vormetric be configured to secure .NET access to encrypted data

We're using Vormetric to encrypt data at rest, and have a .NET application (running behind IIS 7 on Windows Server 2008 R2 SP1) we'd like to configure so The application has access to Vormetric ...
0
votes
1answer
545 views

Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)

I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO. My initial assessment is that ...
0
votes
0answers
297 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
-2
votes
1answer
87 views

Visual Studio anonymity

Recently me and me colleague was wondering about obfuscating / removing project info. If application is reverse engineered than what kind of information the engineer sees? Can he see the email of the ...