ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.

learn more… | top users | synonyms

3
votes
1answer
89 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
8
votes
1answer
146 views

Is it unwise to use Redis to store PII, private keys, and other secrets?

I'm reviewing a system that is using Redis to store all client secrets, private keys, and other things. The problem is that Redis loads the entire DB into RAM Since SSL's heartbleed, Rowhammer, and ...
1
vote
1answer
118 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
1
vote
2answers
124 views

How do I prevent tampering with form submission data, and changing the details for any account?

Although this is something that only employees can use, I'd like to prevent the tampering anyway. I don't like insecure code, and this is hideously insecure. Here's an example link: <a href="#' + ...
1
vote
1answer
56 views

What is the best way to track the authenticated user on the server side? [closed]

For a web app, the client side is javascript in the browser. The server side is ASP.NET with a REST API. At present there is a single server but we plan to scale out with a server each in the US, UK, ...
6
votes
3answers
801 views

How to encrypt all existing customer passwords [closed]

I work for an online shop and since I worked here we have stored customer passwords in plaintext. I joined the company as a data inputter and when I discovered that we did this I flagged it up with ...
8
votes
1answer
105 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
1
vote
2answers
133 views

Is string concatenation vulnerable to null character in aspx?

I just see this line of code in VB in one file .aspx FileUpload.SaveAs(sPath & "/" & FileUpload.FileName) This line save a file that an user uploaded. It use the SaveAs method. I was ...
3
votes
2answers
300 views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
4
votes
2answers
323 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...
-1
votes
1answer
65 views

Measures that must be taken to protect online banking website [closed]

I building an online banking service in ASP.NET and my objective is to implement all possible security measures. Currently at database level I am using RES 2048 bit encryption to encrypt database ...
0
votes
1answer
500 views

Is the ASP.NET .ASPXAUTH cookie value always the same for a given user? [closed]

Is the ASP.NET .ASPXAUTH cookie value always the same for a given user?
-1
votes
1answer
150 views

Home PC has been compromised remotely and even after cleaning my PC repeatedly, the problem still comes back, help please? [closed]

I'm a regular guy running two small franchise businesses with a basic understanding of computers etc, (very basic really), but I am certain my home network has been hacked and I am finding lots of new ...
-2
votes
1answer
799 views

Hown I can test “Microsoft ASP.NET Forms Authentication Bypass” in ASP.Net 4.0.30319

I searched in google for "ASP.Net 4.0.30319 vulnerability " keyword. finally,I found "Microsoft ASP.NET Forms Authentication Bypass" in below link: ...
1
vote
2answers
953 views

1'or'1'='1 help

When I put Username:anything and Password : 1'or'1'='1 Then my database retrieves the first row in the mysql table. But I want to retrieve the row corresponding to Username:anything row. How should I ...
1
vote
2answers
88 views

Securing user supplied files in IIS

I have an Internet website running on IIS/Windows configured as follows: The website is publicly accessible for visitors to browse. A user can login and upload files. The user will be able to see ...
2
votes
1answer
98 views

How can I compute the value of the ASP.NET forms authentication cookie?

How can I compute the value of the ASP.NET forms authentication cookie?
2
votes
2answers
155 views

ASP.NET SqlDataSource injection risk

I have an internal website (going on the intranet) that is going to go through vigorous testing to make sure that it is secure, so I am battening down the hatches so to speak and I coded a .NET ...
3
votes
1answer
148 views

Does encrypting a setting in web.config actually provide security?

Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, ...
0
votes
0answers
121 views

Windows User-Level RSA Key Container permissions issue

I have a simple question and I really don't know why it's not working. I've generated new RSA Keyset for user A, grant access for user B and getting error while trying to access that key. Quick ...
0
votes
1answer
57 views

Does ASP.NET guarantee the integrity of a page's controls on a post back?

Say you have an ASP.NET page that lists the prices for certain items in labels. I know it's cringe-worthy, but say you took the price of the item from the label on the page to determine what the user ...
4
votes
1answer
845 views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
0
votes
1answer
687 views

How do I inject JavaScript into a JPG image and execute it when uploaded?

I've recently joined a security project, and received a task to demonstrate the risk related to an end-user uploading an image containing embedded (malicious) JavaScript code. I used EXIFeditor to ...
1
vote
2answers
354 views

I can upload any file to an ASP webapp/IIS server but I do not know where (which folder), is this exploitable?

I'm able to upload any file to an ASP webapp/IIS server. My first though is to upload an ASP shell but I don't know where the file has been uploaded. I have written a Python script that beggining ...
1
vote
1answer
298 views

Prevent CSRF using ViewState?

According to OWASP you can prevent CSRF in a ASP.NET application if you include the SessionID in the ViewState. From the article: Viewstate can be used as a CSRF defense, as it is difficult for ...
4
votes
1answer
322 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
3
votes
0answers
22 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
1
vote
4answers
1k views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
2
votes
2answers
2k views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
1
vote
1answer
261 views

Uploading Executable Files

Using proxy software, I was able to bypass a file upload control file-checking for an asp.net system I am pen testing. I noticed they are saving the file into the database as bytes, and it is ...
2
votes
1answer
266 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
-2
votes
1answer
443 views

How are .NET websites hacked? [closed]

I have heard many times that hacking .NET websites is different from others. What's the technique used by hackers to hack .NET websites, and how can we secure .NET websites?
4
votes
3answers
178 views

Does PHP have a XSS API?

ASP.NET has a cross site scripting API by default, however does PHP have a cross site scripting prevention API?
0
votes
3answers
147 views

Restrict request to Android and Iphone App only?

I have a ASP.NET/IIS server. I want to restrict my server to only accept request from Android and Iphone(IOS) applications. I have heard about HMAC. Can HMAC help me?
0
votes
1answer
1k views

Is ASP.net More Secure than PHP in GENERAL? [closed]

In other words, my (long version) question is: Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps? I ask this because ASP.net has many ...
2
votes
1answer
638 views

Security implications of granting IIS user group folder modify permissions

I have an Application Pool in IIS running under the standard AppPoolIdentity as part of the IIS_IUSRS group. What are the security implications of granting AppPoolIdentity modify and create ...
8
votes
2answers
428 views

Are userid and password needed in order to pentest a website?

We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
1
vote
2answers
6k views

Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck

I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie. The web ...
3
votes
1answer
623 views

Should we bother with cell-level encryption for an ASP.NET/SQL Server web application?

(Cross-posting this here on the advice of a user at stackoverflow...) Got a philosophical security question for everyone. I'm sketching out an ASP.NET web application design where sensitive data for ...
3
votes
1answer
1k views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to ...
2
votes
1answer
553 views

What method for CSRF token generation should I use in my scenario?

I'm working on a RESTful API to work with my AngularJS application. Authenticating works by generating an ASP.NET FormsAuthenticationTicket. It is stored in a cookie using ...
3
votes
4answers
436 views

Shared hosting vs VPS

I have an Asp.net site. Which hosting system do I need to secure it adequately* against anyone reading private information that's on the server? This is assuming I'm not worried about the sysadmins ...
3
votes
3answers
263 views

Can a mismatched server encoding on HTTP POST or GET result in a security issue?

It is possible for a server to parse HTTP POST and GET data with a fixed encoding or one that is dynamic with the client's response. Consider the situation where a client uses UTF7,32 or any other ...
3
votes
4answers
3k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-orgin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
1
vote
1answer
302 views

IIS 7.5 WebDav Security Issues with Students

Hello Currently I am setting up a server for college students (this includes tech-savy IT students as well) and I will be using IIS 7.5 with Webdav for the students to access their files from home. ...
-6
votes
3answers
172 views

How to be secure your page from Zeus Trojan?

How can I prevent from an attack like this? http://www.youtube.com/watch?v=bgt98VajOv4 Edit: Sorry guys, I think I can't explain my question well. I don't want to secure myself from that trojan. I ...
6
votes
1answer
653 views

Web Applications terminate strings on null-byte

I have just been doing some penetration testing on a site, and I have noticed (and I have noticed before but now seems like a good point to bring it up) that putting a null byte in the search string ...
2
votes
1answer
2k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
16
votes
5answers
2k views

Is it possible to inject values in a drop down list?

Say a ASP.NET page, or any html page for that matter, has a drop down list with a bunch of prices. On posting the page, the code looks at the selection of the drop down list for a computation. Is it ...
1
vote
2answers
421 views

Web Services and WSDL Documentation Protocol

Let us assume that I have a web service in an ASP.NET project. If I turn off the WSDL documentation protocol, will other users be able to: add a service reference to the web service? discover the ...