Questions tagged [.net]

A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

52 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
381 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
user avatar
  • 91
3 votes
0 answers
193 views

Is there an easy way to dissect .NET Remoting traffic for reverse engineering?

I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its ...
user avatar
  • 132k
2 votes
1 answer
274 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
user avatar
2 votes
0 answers
113 views

What are these requests that appear to be phoning home?

I have a .NET 5 application running on AWS which has these requests constantly attempting to run: GET http://app-10-irules.com/ GET http://www.simpleexample.com/ GET http://ssl-app-default-backend.com/...
user avatar
2 votes
2 answers
190 views

How to devise cryptographic system with sharing ability

I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
user avatar
2 votes
0 answers
135 views

Is Jil vulnerable to Friday The 13th JSON attack?

Is the .NET JSON (de-)serializer Jil vulnerable to Friday The 13th JSON attack when deserializing untrusted input? If this attack is applicable, how can it be prevented? Explanation of the attack: ...
user avatar
  • 131
2 votes
0 answers
684 views

ASP.NET SOAP Service XXE

Is it possible to do any type of XXE in a service developed using default C# SOAP service framework? I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
user avatar
  • 21
2 votes
0 answers
217 views

HTML Form to PDF vulnerabilities

I have a form where the user inputs data. On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
user avatar
  • 21
2 votes
2 answers
511 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason I'm ...
user avatar
2 votes
0 answers
536 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
user avatar
2 votes
0 answers
397 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
user avatar
2 votes
0 answers
614 views

How to use IIS ssl certificate(CNG) for data encryption

I want to use RSA to encrypt/decrypt some data using IIS's ssl ceritifcate, from within a web service(WCF). I've managed so far to do this by using .NET security classes(RSACryptoServiceProvider/...
user avatar
2 votes
1 answer
145 views

What security precautions should we take when letting a C# application send/receive emails?

I'm writing a web application which will be able to send signed and encrypted emails to someone else outside my trust boundary. It will also retrieve S/MIME encrypted (and maybe also signed) emails ...
user avatar
  • 529
1 vote
0 answers
56 views

RCE through specifying .NET type or namespace?

I'm testing an application that allows the user to provide an XML file that will be processed. (I've already tried typical XML attacks, such as XXE.) One of the elements of the XML file allows the ...
user avatar
  • 79
1 vote
0 answers
112 views

HTTP: Headers vulnerability still showing after being added

A web vulnerability assessment was done on our web app by a third company that specializes in security, and we added common headers that we missing, and to check my headers internally before the third ...
user avatar
1 vote
2 answers
398 views

Is Array.Clear() in C# suitable for zeroing sensitive byte arrays?

Is it worth calling Array.Clear() to clear sensitive byte arrays such as those containing encryption keys? It's not clear whether this is worth doing since the language has a garbage collector.
user avatar
1 vote
0 answers
88 views

How to securely open a folder using .NET without user input?

I would like to open a folder using .NET and it seems like as if Process.Start is the way to go: Open a folder using Process.Start. I already read How to securely use Process.Start? but it deals with ...
user avatar
1 vote
0 answers
120 views

Store passwords local with plain text access on WinPE

I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time. The OS is WinPE, so he cannot map the ...
user avatar
1 vote
0 answers
165 views

CWE-611: Improper Restriction of XML External Entity Reference with XSL include

Veracode reports that the below code is susceptible to CWE-611: Improper Restriction of XML External Entity Reference. XslCompiledTransform transform = new XslCompiledTransform(); transform.Load(...
user avatar
  • 143
1 vote
0 answers
153 views

Which attributes does DPAPI's "UseMachineProtection" use to identify a machine?

We're using DPAPIProtectedConfigurationProvider from the Windows Data Protection API to encrypt an application config file. The API offers a property called UseMachineProtection, so that the config ...
user avatar
1 vote
0 answers
215 views

Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)

I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key. I'm searching for the best way to store the key for every ...
user avatar
  • 131
1 vote
0 answers
182 views

Example of Insecure DTD Processing in XmlSchema.Read

According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack: var src = "?...
user avatar
1 vote
0 answers
367 views

Security risks introduced when moving from a three tier to a two tier architecture

I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone. I have been asked to host a two tier .net web application where the web ...
user avatar
  • 153
1 vote
0 answers
58 views

Does Thinktecture V2 Require Round Trips on Requests

I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications ...
user avatar
  • 153
1 vote
0 answers
128 views

Java & .Net Secure Passwords in Console applications

Background I know that we should not store passwords in String variables in Java/.Net (Should be stored in mutable objects such as char arrays). And When it comes to the UI aspects we do have ...
user avatar
  • 1,257
1 vote
0 answers
589 views

Sharing an access token from an external provider among apps

I have a running web app that uses an external OAuth provider (Reddit) to log in with. I want to integrate this app with someone else's mobile app and I want to make it as easy as possible for ...
user avatar
1 vote
0 answers
181 views

How to view the signing certificate of outlook before sending email using C# addin

using the ribbon xml addin one can send signed email by enabling sign button using schema name as string PR_SECURITY_FLAGS = "http://schemas.microsoft.com/mapi/proptag/0x6E010003"; Here before ...
user avatar
1 vote
0 answers
286 views

Logout from IdP, where should user end up?

When a user clicks Logoff on my website, it executes the following .NET code: public ActionResult SLOService() { // Receive the single logout request or response. // If a request is received ...
user avatar
  • 111
1 vote
0 answers
1k views

Is comparing the thumbprint of a SSL certificate secure enough?

I was wondering if comparing the X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not. Of course this would only work for specific ...
user avatar
  • 111
1 vote
0 answers
445 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
user avatar
  • 111
1 vote
0 answers
637 views

How to acquire the RSACryptoServiceProvider from the existing key container?

The Key containers of "Microsoft Base Smart Card Crypto Provider" are enumerated by setting PP_ENUMCONTAINERS flag for the function CryptGetProvParam(). The enumerated key containers are set to the ...
user avatar
1 vote
0 answers
85 views

IX509Extension XCN encoding?

I understand from reading MSDN that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject ...
user avatar
  • 11
1 vote
0 answers
246 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
user avatar
1 vote
0 answers
182 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
user avatar
  • 66
1 vote
0 answers
140 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : 'v2....
user avatar
1 vote
0 answers
75 views

Securing customer assets in .NET

We are rethinking our security and came on an interesting issue. How can me make a generic security implementation for customer owned assets. Does every asset need a direct-indirect relation to a ...
user avatar
1 vote
0 answers
189 views

Why do we need salt and RFC in generating AES encrypted message

I'm not very familiar with encryption and new to this, I'm just learning it right now by code review of one of the class we have in an application to encrypt a password using AES. Would anyone explain ...
user avatar
  • 111
1 vote
0 answers
159 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
user avatar
1 vote
0 answers
500 views

Login Authentication with SSL and HMAC

My question is pretty similar to : https://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
user avatar
1 vote
0 answers
300 views

What are some good design practices for cross-platform certificate storage?

Question from the Bouncy Castle development list: At present we use the Windows certificate store as: var store = new X509Store(StoreName.My, StoreLocation.LocalMachine); store.Open(OpenFlags....
user avatar
0 votes
0 answers
419 views

Best way to handle Path Manipulation vulnerabilities with retrieving files from .appconfig?

I'm currently working on a task where I am trying to suppress some Path Manipulation warnings that have been raised from running an analysis with Fortify on my team's source code. The issues are being ...
user avatar
  • 1
0 votes
2 answers
217 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
user avatar
  • 175
0 votes
0 answers
122 views

How should I store a password used by a service written in .NET

I have a Windows service that accesses a database connection. Since users rarely use Windows authentication, I encrypt the connection string. For development I have the password hard-coded, but I know ...
user avatar
  • 1
0 votes
0 answers
555 views

How to disable the use of verb tunneling using such headers or query parameters in .NET?

I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
user avatar
  • 101
0 votes
1 answer
1k views

How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below. @Html.TextBoxFor(m => m....
user avatar
  • 111
0 votes
1 answer
288 views

.Net WebClient - self signed certificate

I have two applications (.net) on two web-servers. The first application will need to do a request (via WebClient) to the second and get results. I need to ensure Encryption, data integrity, and ...
user avatar
0 votes
0 answers
522 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
user avatar
0 votes
1 answer
814 views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
user avatar
0 votes
0 answers
423 views

ViewStateUserKey .NET CSRF protection

In a typical PHP web application you append a hidden CSRF Token in each form and this token is validated when the request is submitted in the server side. I am performing a penetration test in a .NET ...
user avatar
  • 524
0 votes
0 answers
187 views

How should Vormetric be configured to secure .NET access to encrypted data

We're using Vormetric to encrypt data at rest, and have a .NET application (running behind IIS 7 on Windows Server 2008 R2 SP1) we'd like to configure so The application has access to Vormetric ...
user avatar