Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [.net]

A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

Filter by
Sorted by
Tagged with
2 votes
0 answers
57 views

Issue with Single Sign-On (SSO) Implementation for WPF application with ADFS/MSAL

I'm encountering an issue with the implementation of Single Sign-On (SSO) in our WPF application, and I'd appreciate some guidance or insights from the community. Here's a breakdown of our setup: We ...
Barry Allen's user avatar
0 votes
1 answer
177 views

Best practises regarding authentication in SPA/API solutions with SSO

There is really not that great information on what the best practices are for auth in SPA/API solutions. Most of them just say use JWTs and auth code flow in the SPA. There is a ton of information ...
ryansan's user avatar
  • 113
0 votes
0 answers
63 views

Trouble understanding hash_extension tool examples for hash length extension attack (C#)

I am trying to follow the example of how a hash length extension attack works using the article here: https://www.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks ...
arvedellis's user avatar
0 votes
0 answers
103 views

Looking for a very basic encrypt/decrypt with a shared key for .net web application

Building a .Net 6 web app and storing data in On-Prem database. I collect some sensitive data that needs to be stored in the database in a format that is not easily readable. I also need to retrieve ...
BattleFrog's user avatar
0 votes
0 answers
296 views

XSS Payload That Can Bypass Special Character Check

I developed the following C# algorithm to prevent XSS attacks: private bool Is_There_XSS_Payload(string arg) { Regex regex = new Regex(@"^[a-zA-Z0-9]+$"); bool result = ...
KosD's user avatar
  • 1
1 vote
0 answers
940 views

Uploading webshell in ASP.net application using directory-traversal and file-upload vulnerability

On my target site, I found two vulnerabilities, unrestricted file upload(to any directory) and directory traversal. I have two end points : 1- site.com/fileUp : uploads file { ----Request Parameters---...
Abu Bakar's user avatar
0 votes
1 answer
234 views

Exploit user controllable C# code in webapp

The application in question offers the option to create arbitrary C# code and execute it at any time. These could be considered macros to customize certain tasks. Say that a normal user, who would ...
drazse's user avatar
  • 3
0 votes
1 answer
147 views

Storing a key in a reasonably safe way

I’m developing an application that will run on a private, on premises network. The application will be accepting requests through an API, read some encrypted data from the disk, decrypt them, do some ...
Q-bertsuit's user avatar
2 votes
1 answer
516 views

Is better for security to not run Nginx and Backend inside docker but use docker only for database and not external exposed services?

I'm not a Docker specialist, I know how to install, configure and do only basic Docker hardening based on Docker official documentation. I know nothing about AppArmor,SELinux and GRSEC. But i need to ...
Awill Moto's user avatar
-3 votes
1 answer
292 views

Decode Encrypted Password help me [duplicate]

Help me to decode belove password 68H++v5FX/kUty5/itzflw== Above is password store in sql table
Nikunj Chovatiya's user avatar
0 votes
1 answer
766 views

How to preserve key in TPM 2.0

I've been looking into TPM 2.0 with .NET (TSS.MST), and I don't understand how to preserve key upon application rerun. TSS.MST provides a binary simulating the TPM2.0 device and the app is connecting ...
Kostas Moisidis's user avatar
4 votes
1 answer
4k views

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

We are using IIS on Windows 2012-R2 server to host dotnet apps. From the app, when we try connecting to an external 3rd party api we see TLS handshake failure. On running ssllabs test on that api, I ...
dhanush shetty's user avatar
0 votes
1 answer
230 views

Are .NET runtime really not signed?

I'm doing a manual install on Linux of the .NET runtime which can be downloaded from dotnet.microsoft.com. MS do provide a SHA512 checksum of the file on the site, but that can't be use to verify the ...
MrCalvin's user avatar
0 votes
1 answer
590 views

How to protect private key for client cert in machine store? Is it acceptable for it to be exportable?

Is it acceptable to store a client cert's private key as exportable in the computer's certificate store? I have a .NET desktop app that installs client certificates in local machine\personal. The ...
Peter Dongan's user avatar
0 votes
0 answers
2k views

Best way to handle Path Manipulation vulnerabilities with retrieving files from .appconfig?

I'm currently working on a task where I am trying to suppress some Path Manipulation warnings that have been raised from running an analysis with Fortify on my team's source code. The issues are being ...
lawgik's user avatar
  • 1
1 vote
0 answers
173 views

RCE through specifying .NET type or namespace?

I'm testing an application that allows the user to provide an XML file that will be processed. (I've already tried typical XML attacks, such as XXE.) One of the elements of the XML file allows the ...
Bob's user avatar
  • 99
1 vote
1 answer
195 views

Does .NET Framework have a bounty program?

The Microsoft .NET Bounty Program states that "Vulnerabilities in the .NET Framework, or any ASP.NET framework running on .NET Framework (Webforms or MVC)" is out of scope. Is .NET Framework ...
TN.'s user avatar
  • 153
0 votes
1 answer
256 views

Authorization Controls for Offline Windows C# Application

I've been looking into trying to see if there are any authorization controls that can be implemented for a local, and offline, .NET application that are tied to the Windows local authentication. The ...
msnow's user avatar
  • 1
3 votes
1 answer
13k views

Should I specify JWT audience and issuer if I have only one SPA client?

I have an API server (ASP.NET Core 5) and SPA client (ASP.NET Blazor). Nothing else: no external oauth servers, identity providers and whatnot To secure access, the server issues and validates access ...
lonix's user avatar
  • 445
1 vote
1 answer
133 views

Security for a Windows application running in a corporate network

I know security is pretty important for the web application, but what about windows applications running in a corporate environment, network, not accessible from outside. Do we need to treat security ...
Yaplex's user avatar
  • 111
0 votes
1 answer
192 views

Encrypting app settings file is secure than encrypting only the app setting contents?

I have a content as shown below I have encrypted the content by running the below command cd C:\Windows\Microsoft.NET\Framework\v4.0.30319 aspnet_regiis.exe -pef "secureAppSettings" "...
kudlatiger's user avatar
0 votes
2 answers
1k views

Windows directory that is only accessible by SYSTEM user

I am developing a .NET Windows Service using C# that needs to download an executable file and run it. I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...
Jack's user avatar
  • 3
1 vote
1 answer
876 views

Is this string comparison code resistant to timing attacks?

I have to create an API that authenticates a request by checking if the token in the request is equal to the valid token stored in our database. Initially I used the == operator to compare the two ...
Weare Mwam's user avatar
1 vote
2 answers
705 views

How do I do asymmetric/hybrid encryption in practice?

Question I would like to asymmetrically encrypt messages with a public key that I have been given in advance. How can I go about doing that? Some example code in C# would be much appreciated. What do ...
Fax's user avatar
  • 185
0 votes
2 answers
1k views

Is Output Neutralization required when logging C# exception messages to log files?

CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
scott.korin's user avatar
1 vote
1 answer
296 views

IV generation with RNGCryptoServiceProvider

I'm using RNGCryptoServiceProvider.GetBytes(new byte[16]) to generate IV's to use in AES (256 bits) encryption. For every record I encrypt, I generate a new IV. I'm also prepending each of these IV's ...
Diogo Santos's user avatar
1 vote
0 answers
418 views

How should I store a password used by a service written in .NET

I have a Windows service that accesses a database connection. Since users rarely use Windows authentication, I encrypt the connection string. For development I have the password hard-coded, but I know ...
Tim's user avatar
  • 11
2 votes
4 answers
4k views

.Net dll encryption

By nature, .NET assemblies are extremely easy to reverse engineer. Say I want to hide some code by embedding an encrypted .dll into another .dll that is to be decrypted and loaded at runtime: compile ...
CTZStef's user avatar
  • 81
2 votes
1 answer
527 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
Lincoln Bergeson's user avatar
1 vote
1 answer
849 views

How good/bad is this implementation to secure password?

I've just started new project and decide to try something new, so I'am not using anymore EnityFramework and Identity framework. I Decide to try MongoDB, so i wanted to design from scratch storing ...
Shagohad's user avatar
  • 113
0 votes
0 answers
1k views

How to disable the use of verb tunneling using such headers or query parameters in .NET?

I'm failing a security scan that is saying my .NET application is allowing verb tunneling and the recommendation is to disable this. The application needs to accept PUT and DELETE headers as well as ...
Cameron's user avatar
  • 101
0 votes
1 answer
567 views

When using public/private keys to secure app licensing info, couldn't someone simply replace your public key to defeat it?

We have a simple C#9/WPF app that we're releasing on .NET 5 Core on which we need to introduce licensing. From what I'm reading, one of the most common patterns to do so is asymmetric encryption, aka ...
Mark A. Donohoe's user avatar
2 votes
0 answers
151 views

What are these requests that appear to be phoning home?

I have a .NET 5 application running on AWS which has these requests constantly attempting to run: GET http://app-10-irules.com/ GET http://www.simpleexample.com/ GET http://ssl-app-default-backend.com/...
yeahtheboys's user avatar
2 votes
2 answers
172 views

Check Expired Token (after a visit)

I'm implementing a model which I'll have to reupdate the users, so I want to deliver a unique link to the users and after confirmed the update, I expire that link, so I prevent reusing that link. How ...
G. Manucci's user avatar
1 vote
0 answers
302 views

HTTP: Headers vulnerability still showing after being added

A web vulnerability assessment was done on our web app by a third company that specializes in security, and we added common headers that we missing, and to check my headers internally before the third ...
Billy Watsy's user avatar
5 votes
3 answers
4k views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
Dandré's user avatar
  • 171
1 vote
3 answers
1k views

Process.Start() Command Injection

How to exploit a program that has this line: Process.Start(user_input + "calc.exe") It's a .NET function and nothing has worked so far ("mal.exe &&", "mal.exe;", ...
Trigosin Darom's user avatar
0 votes
1 answer
1k views

Skip date check in Server certificate in Chrome

We have a web application on https port with server certificate valid from 01/01/2021 and valid to 31/12/2021. Due to some constraints the clients which are going to use web application are behind ...
SidD's user avatar
  • 101
0 votes
2 answers
953 views

Protect a software in offline envirement

These days I intensively read maybe all posts and topics based on software security, but I couldn't find any solution that would be acceptable for me (if there are any of them matching my requirements)...
NSKBpro's user avatar
  • 109
1 vote
2 answers
1k views

Is Array.Clear() in C# suitable for zeroing sensitive byte arrays?

Is it worth calling Array.Clear() to clear sensitive byte arrays such as those containing encryption keys? It's not clear whether this is worth doing since the language has a garbage collector.
Mark Guest's user avatar
0 votes
1 answer
185 views

Developer requests dev systems don't have .Net patches applied

Looking for some guidance on an internal discussion we're having. We have a .Net developer that is requesting all development systems with Visual Studio installed don't have .Net updates installed. ...
mxdd_'s user avatar
  • 1
0 votes
1 answer
120 views

Secure an intranet Winform application

Is there a need to secure winform application in an intranet environment? Clearly, there is no external threat and only authorized personnel have access to the intranet environment, so I am not sure ...
johny's user avatar
  • 1
2 votes
1 answer
267 views

Can a client application volunteer to send a certificate?

When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send. Network traffic with a service where our application is known to ...
Rene's user avatar
  • 123
0 votes
1 answer
452 views

DLL hijack privileges

DLL hijacking means that malicious software gets admin rights from default or it means you need to elevate your privileges first? Because I tried to change a DLL in Windows/System32 folder, but I can'...
Balabol's user avatar
1 vote
2 answers
282 views

How to devise cryptographic system with sharing ability

I am writing a C# .NET application. For my application the data of the users should be encrypted in the database. The users should also be able to share data with other users. To that end I want to ...
csstudent1418's user avatar
1 vote
2 answers
231 views

Can a symmetric key be safely embedded anywhere in a .NET desktop client program

Is there a native way, that is, one not requiring the purchase of an expensive third-party obfuscator, that a .NET desktop client program, deployed to the users' Windows desktops from a LAN server ...
Tim's user avatar
  • 341
3 votes
3 answers
382 views

Is Telnet safe for receiving text or does it compromise my whole network?

I have a telnet port open to my PC using the TCPClient in latest version of .net, it is only used for receiving text then parsing it and adding it into an SQL Database, my telnet server does not reply ...
DSAILE's user avatar
  • 31
2 votes
1 answer
1k views

Why does Wireshark not recognize WCF traffic as TLS encrypted?

In a .NET application, communication between client and service can be implemented using various different bindings, NetTcpBinding being one of them. The class defines an attribute named Security, ...
user avatar
0 votes
1 answer
250 views

Is using SecureString in combination with Xor considered secure enough for standalone Windows app?

The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string. License.Import(string name, string email, ...
Matas Vaitkevicius's user avatar
1 vote
1 answer
236 views

Cracking .NET random

I know .NET has two PRNGs, one secure and one insecure. What is the approach to cracking the insecure one (I want to use it to test an .aspx site)? I searched all over but I only found references to ...
Command Master's user avatar

1
2 3 4 5
8