Questions tagged [.net]
A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
382
questions
1
vote
0
answers
393
views
Veracode still reports OS command injection issue after I have applied the solution as recommendations from OWAPS and Roslyn Security Guard [closed]
Current code in my project is shown below and Veracode reports there is an OS command injection
filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg"
ProcessStartInfo startInfo = ...
- 111
2
votes
1
answer
5k
views
Insecure Deserialization in C# (.NET) - How to identify and test
I have been reading up on Insecure Deserialization and how it can affect Java applications.
https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization
If the captured traffic data include ...
- 787
8
votes
1
answer
5k
views
Is .NET XmlSerializer.Deserialize(TextReader) safe?
Is the .NET method XmlSerializer.Deserialize(TextReader) safe from XML vulnerabilities (XXE, XmlBomb etc..)? Will the DTD be processed during deserialization?
I can understand why XmlSerializer....
- 315
1
vote
1
answer
9k
views
Is CBC mode for AES still safe to use in 2018?
I'm using AES-256 CBC mode in C# to encrypt various amounts of texts. The key and IV are always generated properly randomly. However, would GCM mode provide any noticeable security gains over CBC?
user173331
2
votes
1
answer
193
views
Will installing WinZip 22 on a server create a security vulnerability?
I've recently requested a WinZip v22 with command line installation on a Windows POC/Dev server that we're using to pilot an application that is written in .Net.
In the application there is ...
- 123
3
votes
1
answer
281
views
What is properly way to manage and remove symmetric key in C#
If I have a symmetric key in a byte[] array in C#, how can I erase it securely?
for (int i = 0; i < array.Length; i++) {
array[i] = 0;
}
Is this good enough?
- 39
2
votes
1
answer
775
views
SSL certificate for WebAPI
We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
- 123
2
votes
1
answer
367
views
Automatic choice of the hash function for key derivation
This is a theoretical question: does this make sense and is secure?
My goal is to strengthen the passphrase. The flow is the following:
I enter a pssphrase admin1234. This passphrase is going to be ...
- 135
-1
votes
1
answer
174
views
Visual Studio anonymity
Recently me and me colleague was wondering about obfuscating / removing project info. If application is reverse engineered than what kind of information the engineer sees?
Can he see the email of the ...
- 11
1
vote
1
answer
1k
views
Potentially dangerous request loads the page
I hosted an application in ASP.NET 4.0 webforms.
When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like:
...
- 111
1
vote
0
answers
309
views
Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)
I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key.
I'm searching for the best way to store the key for every ...
- 131
0
votes
0
answers
513
views
ViewStateUserKey .NET CSRF protection
In a typical PHP web application you append a hidden CSRF Token in each form and this token is validated when the request is submitted in the server side.
I am performing a penetration test in a .NET ...
- 534
0
votes
1
answer
1k
views
How to get session info out of encrypted .NET viewstate?
I am performing a penetration testing for the first time in a .NET application that instead of providing cookies for session management uses the viewstate hidden field.
I am using the .NET Beautifier ...
- 534
3
votes
2
answers
2k
views
How to securely send a password from one app to another app?
See this question/answer first: When calling a process from another process, Is sending stdin password more secure than sending an ENV variable?
I am a Java developer that is building an app where ...
1
vote
1
answer
304
views
When calling a process from another process, Is sending stdin password more secure than sending an ENV variable?
I am a Java developer that is building an app where it needs to call a C# process from within. In my situation, the Java app is calling this C# program https://github.com/nddipiazza/...
3
votes
2
answers
271
views
How can I verify that network calls to my API come only from my C# program?
I have a desktop application build on the .Net framework.
If I obfuscate the code, even if somebody reverse-engineers the code and tries to call my API using the altered source, can I know if the API ...
- 31
1
vote
0
answers
224
views
Example of Insecure DTD Processing in XmlSchema.Read
According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack:
var src = "?...
0
votes
1
answer
1k
views
WPF Hide ConnectionString in MyApplication.exe.config file (or hide the whole file)
While building my Project I got a new file called MyApplication.exe.config.
This is the Content of App.config (I guess) where I also included the Connection to a DataBase in <ConnectionString>.
...
- 3
2
votes
3
answers
140
views
Is it feasible to leverage DOS by triggering large numbers of application exceptions?
One key aspect of a DOS or DDOS seems to be to leverage the required computational power on the attackers side to maximize the impact on the target side. This wiki article lists many examples of such ...
- 123
0
votes
1
answer
1k
views
Encrypt and decrypt large files with RSA, is it possible? [closed]
Encrypt and decrypt large files with RSA, is it possible?
I need to encrypt / decrypt files and save the private key named file encoder
I've seen it's not acceptable to work on large files with RSA
Is ...
- 19
2
votes
1
answer
1k
views
Could Meltdown/Spectre be exploited from C#/.Net (or other managed languages or the Midori OS)?
First off yes the correct answer is patch your OS/system. That aside:
Does the memory managed features of a language like C# prevent it from being used to exploit the Meltdown security bug?
What ...
- 23
-4
votes
1
answer
227
views
Why isn't ASP.NET source code compiled before it is published?
Why doesn't Visual Studio compile the source code (.cs) automatically before publishing, since they know perfectly well that the end-product website is going public? (Unless you're just building the ...
2
votes
1
answer
150
views
Can I secure a server on which I'm deliberately allowing code execution?
Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface.
Obviously,...
- 169
1
vote
0
answers
215
views
Is there any tool for static analysis of Windows Workflow Foundation XAML files? [closed]
The title says it all.
First, is there any dedicated tool that is capable of analysis of Workflow Foundation files?
If not, is there a process that can analyse them, eg. compile the WF into IL, then ...
- 121
2
votes
2
answers
430
views
How secure is this communication chat?
I have created a chat between two parties (using c#), and I am wondering what kind of weaknesses have I overlooked.
Description of its functionality:
There are two individual applications: Client (2 ...
1
vote
2
answers
3k
views
Secure way to save connectionString in .NET?
I'm developing a application which is not static for me. This means that creating a WebService for my connectionString will not work I guess.
Because my application works a bit like Wordpress. First ...
- 11
16
votes
2
answers
3k
views
Secure big, old ecommerce website from XSS?
I'm working for an ecommerce website written in C#.net (no CMS used, quite a lot of code) where security hasn't been a priority for a long time. My mission right now is to find and fix any XSS ...
- 315
4
votes
2
answers
6k
views
Secure flag for ASPXAUTH Cookie in MVC
We have an Application which is developed using ASP.NET MVC3. Penetration-test done by an IBM AppScan tool.
Issue has been reported and it was ASPXAUTH is not secure. When I checked on the browser's ...
- 193
-5
votes
2
answers
158
views
What is the most crypto-resistive algorithm to safely send information? [closed]
What algorithm is the best to use for storing, sending passwords, account data, and other information between desktop apps over the network.
Looking for the best crypto-resistive algorithm to use in ...
0
votes
1
answer
121
views
Can the device on the other end of a socket change without me knowing?
I have a server application written in C#. I am currently authenticating the client whenever a socket is opened, before sending any other Data. After the client is authenticated I assume it's always ...
2
votes
3
answers
4k
views
Is it valid to defend an CSRF token against replay (e.g. with a timestamp)?
I have an MVC app that is using the AntiForgeryToken capability of ASP.NET MVC. AFAICT this uses an encrypted synchronizer token variation where it validates the payload of the tokens.
A customer has ...
- 127
0
votes
1
answer
182
views
Prevent external processes from changing .NET variable values
I was reading this writeup of how CylancePROTECT can be exploited. It has a Windows service which is implemented using .NET.
It seems that for code written in .NET, it is trivial to locate important ...
- 169
4
votes
1
answer
2k
views
Securing a multi-tenant API with SSO and different roles per tenant
I am working on developing a REST API that will be used by first party clients that we develop, and third party clients in the future. The first party clients include a SPA client side application, ...
- 143
2
votes
1
answer
2k
views
What does "don't roll your own security" mean?
I see this saying a lot and agree that you should leave certain things to the tried and true methods, but am unsure to what extent.
Does it just mean don't make your own crypto algorithm?
I created a ...
- 23
0
votes
1
answer
279
views
External password encryption
We have passwords to certain external system that we need to use programmatically to login to that system. We have no control over the external system, we can not hash the password and use it like ...
- 101
1
vote
2
answers
171
views
Seeking Review for Authentication and Message Encryption Approach
I have a plan for handling authentication and message encryption, and I'd like some others with more cryptography knowledge to let me know if my approach is sound, or how it should be improved.
...
- 11
8
votes
6
answers
2k
views
Protect PHP hashing algorithm (from bots)
First of all, I'm new to this whole crypto thing. Here's my scenario:
I have a client app, that sends a 20char max string to my server. The server then checks if the name is indeed matching the char ...
- 189
1
vote
0
answers
496
views
Security risks introduced when moving from a three tier to a two tier architecture
I host several .net web applications using a standard three tier architecture with web servers located in a demilitarised zone.
I have been asked to host a two tier .net web application where the web ...
- 153
0
votes
1
answer
163
views
Security considerations when opening port for a service?
I would like to host a service (written in C#) on my server and allow it to be accessed from outside the network.
I know that I need to open a port in the firewall for this to work, and I managed to ...
- 103
1
vote
1
answer
1k
views
Authorization based on OASIS ABAC/RBAC/XACML approach
Is anybody aware of any open source .NET authorization solution based on OASIS ABAC/RBAC/XACML approach?
I have found some visible amount of Java based solutions but it seems .NET is completely out ...
- 113
1
vote
1
answer
362
views
How to make a file detected by anti virus
I know this question is kind of stupid but I am testing a virus database and I would like to know any kind of code in c++ or C#/VB.net that would be detected as virus by an antivirus, without actually ...
- 11
2
votes
1
answer
2k
views
Windows .NET equivalent to Linux /dev/random
Is there a pseudo device-based random data stream/file that can be used in Windows .NET programming in the same way as /dev/random can be read and used as a source of random values on Linux based ...
- 1,844
1
vote
1
answer
455
views
User Credentials for Accessing Network Resources
I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
- 129
2
votes
2
answers
13k
views
C# malicious file upload to server
I was joking around with some file-uploads to the server, for the site I was working on. Now it seems to me that we have an enormous security-risk.
They don't block any file extensions that are ...
- 858
1
vote
0
answers
78
views
Does Thinktecture V2 Require Round Trips on Requests
I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications ...
- 153
0
votes
1
answer
186
views
With the recent denouncing of SHA-1 by Google, should SHA-1 based PBDKF2 now be avoided? [duplicate]
Google recently announced "the first practical technique for generating a collision" for SHA-1. I'm currently planning a password hashing implementation for a website, and historically we have used ...
- 204
1
vote
1
answer
557
views
Passing encryption with IV as a single array
I am fairly new to this, so I'm sure it has been asked and answered but I cannot find a clear answer. If this has already been addressed, please point me in the right direction and I will remove this ...
- 13
0
votes
1
answer
586
views
Secure compiled .NET source code applications ASP.NET and Windows Forms [closed]
Right now I'm working as a software development leader in my enterprise.
Here's the main issue of everything. A software developer that works with us. There has been some rumours about this user ...
- 559
1
vote
1
answer
170
views
How to ensure privacy on a remotely hosted server?
(Copied from Software Engineering as suggested)
If I have written a privacy tool as a .NET web application which is to be hosted on a commercial hosting site, other than hosting it in a privacy ...
2
votes
0
answers
56
views
Which is better for storing private key in .NET - Windows application secure registry or encrypted configuration? [duplicate]
We are building an integration with a third party. We have decided to share a private key with the 3rd party app. What will be the best strategy to allow access for the key? Should the key be saved in ...
- 121