Questions tagged [asp.net]
ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.
233
questions
0
votes
2
answers
57
views
Attack possible on session id reuse after login?
I have a web application that uses a Version 4 UUID as the session id. If a user makes a request to my web application, he gets a new created session id. After a successful login, the session id does ...
- 319
1
vote
1
answer
135
views
xp_cmdshell as dbo user only able to run 'ping localhost' to verify RCE?
I am doing a pentest on a client's ASP web application and I have identified a blind SQL injection. However, after enabling xp_cmdshell, I am only able to run the ping localhost command to verify the ...
- 11
0
votes
1
answer
65
views
Why does ASP.NET enforce authorization through page rendering rather than on the server?
There is a particular class of vulnerability that I've seen on enough ASP.NET applications that I'm starting to wonder what the underlying cause it. The pattern goes as follows
The application has ...
- 141
1
vote
1
answer
100
views
Will these actions better secure my web app
I'm trying to figure out what else I should (not) do to reduce the possibility of my web app getting hacked. And like most development efforts, while it would be great to have a security expert on the ...
- 503
1
vote
0
answers
69
views
Using claims to handle programmatic logic determining what is displayed
I am writing an application to manage volunteers for political campaigns. This is a lot more complicated than any past multi-tenant app I've written and so am asking for guidance here on how to ...
- 503
1
vote
0
answers
1k
views
Uploading webshell in ASP.net application using directory-traversal and file-upload vulnerability
On my target site, I found two vulnerabilities, unrestricted file upload(to any directory) and directory traversal. I have two end points :
1- site.com/fileUp : uploads file
{
----Request Parameters---...
- 15
-1
votes
1
answer
98
views
Would a base64ed code work inside an images metadata? [closed]
my target has a server that uses aspx possibly version 4.3 and i just found out that it has an image upload part. They have an image analyzer so it has to be an image file so i wonder if i could embed ...
- 1
2
votes
2
answers
333
views
What could go wrong with this inlined javascript variable initialization in ASP?
I am currently reviewing an ASP application where this javascript initialization is used all over the place:
const someValue = "<% get_some_value() %>";
And this pattern is actually ...
0
votes
1
answer
933
views
Is the .AspNet.Application cookie vulnerable to CSRF attacks?
I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability.
The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict:
protected void ...
-1
votes
1
answer
503
views
Using certificates for authentication in a web site
Today i faced a web site related to government that showed me all of my certificates in a combobox for authentication on that web site.
What were those certificates?
How can i show them in a asp.net ...
- 101
0
votes
0
answers
444
views
Best way to encrypt client side data for SaaS inside the web
I am planning a SaaS-solution, where my clients store and save sensitive data on my servers.
Security is a big point as it makes a product more trustworthy, so my thought was that the data which I ...
3
votes
3
answers
971
views
HttpResponse Headers Information Leakage on Server Error (Verbose Headers)
In the past I have dealt with security issues related to Default Service Banners/Verbose Headers/Information Leakage via HttpResponse Headers. These issues are quite common, and usually look ...
- 171
3
votes
1
answer
16k
views
Should I specify JWT audience and issuer if I have only one SPA client?
I have an API server (ASP.NET Core 5) and SPA client (ASP.NET Blazor). Nothing else: no external oauth servers, identity providers and whatnot
To secure access, the server issues and validates access ...
- 455
0
votes
1
answer
727
views
ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?
Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
- 264
2
votes
0
answers
157
views
What are these requests that appear to be phoning home?
I have a .NET 5 application running on AWS which has these requests constantly attempting to run:
GET http://app-10-irules.com/
GET http://www.simpleexample.com/
GET http://ssl-app-default-backend.com/...
- 21
1
vote
0
answers
303
views
Can you do a code injection in asp.net with Eval()?
I am trying to understand code injection via eval in the context of different technologies.
In the case of asp.net, is it possible to be vulnerable to code injection if i am using eval?
E.g.-
<asp:...
- 11
0
votes
2
answers
549
views
Content-Type and Code Execution
I just got a message from a security guy that my application is executing remote code if they pass a Content-Type: image/asp. For now he does not disclose anything. Now my question is that if I am ...
1
vote
0
answers
265
views
Are these tests enough to check if a web app is vulnerable to Padding Oracle? How to test further?
SCENARIO:
a web application using with ASP.NET. In the home page source code there are links like:
./WebResource.axd?d=[string with 87 characters]
./ScriptResource.axd?d=[string with 172 characters]
...
- 567
0
votes
2
answers
1k
views
ASP.Net XSS - How does this vulnerability work
I have been tasked with fixing a XSS issue in an ASP.Net application, but I have never seen this kind of attack before so first it would be great if I could understand how this is working and then I ...
- 101
1
vote
1
answer
218
views
An intranet web app for decrypting values : a bad idea, and if so, why?
We have to protect a database connection string for a .NET desktop application that has an application-level database user. One option is to encrypt a section of the app.config using asp_regiis. But ...
- 341
0
votes
0
answers
2k
views
Sqlmap waf bypass
This is my first post here, sorry for my english.
Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap.
what ...
- 1
1
vote
0
answers
1k
views
Open redirection (DOM-based) on ASP.NET 4.7 Web Forms
A scan with Burp Suite has reported a possible vulnerability on all the pages of my application, which is based on ASP.NET 4.7 WebForms.
the issue is: The application may be vulnerable to DOM-based ...
- 121
2
votes
2
answers
6k
views
Qualys WAS raises "150004 Path-Based Vulnerability" on an image file
Customer is running Qualys Web Application Scan and the WAS Scan Report reported:
150004 Path-Based Vulnerability
on URL: https://www.example.com/mywebapp/Content/datepicker/images/ui-...
- 121
0
votes
1
answer
211
views
Why ASP.Net Identity sends sensitive information to clients?
As far as I understand, Identity sends to the user an encrypted token with some user information like the user name and expiration date. Then, when a new request arrives to the server, it decrypts it ...
- 123
3
votes
2
answers
4k
views
NONCE not supported in Asp.Net for CSP implementation
Is NONCE supported in Asp.Net when implementing the Content-Security-Policy header to protect from XSS ??
I read that NONCE was not supported in Asp.Net, however, I read another simple article, that ...
- 171
1
vote
1
answer
207
views
Validating JWT in server-to-auth-server scenario
The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario?
I am looking ...
- 153
1
vote
0
answers
1k
views
Active Directory authentication with a Login form ASP.NET MVC5
I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
- 11
0
votes
2
answers
2k
views
How to prevent XSS attacks in ASP web application [closed]
In my web application, while doing the penetration testing two XSS vulnerabilities identified in some text input.
that field testing using followin cheets,
<script src="http://192.168.1.122:3000/...
- 101
3
votes
1
answer
2k
views
Hardening ASP.NET against session fixation: Should I change the session ID despite the additional Auth cookie?
Situation
I am the responsible developer for an ASP.NET application that uses the "Membership" (username and password) authentication scheme. I am presented with the following report from a ...
- 4,103
-1
votes
1
answer
2k
views
XSS protection - escape symbols
Lets say we have private math/developers forum website made with asp.net. Users can post text-messages in topics. Based on OWASP articles we should escape symbols like: ' " < > / to prevent XSS ...
- 101
0
votes
1
answer
216
views
How to implement Anti-CSRF method? [closed]
I have created a ASP.NET project and I want to implement Anti-CSRF method in my project. How to do that?
- 41
0
votes
0
answers
139
views
Is it secure to prevent CSRF in API without using CSRF cookie (only CSRF token sent in header of ajax requests)?
There is a standard method of preventing a CSRF attack by comparing a value in a special cookie (that is posted automatically with each request) and some value that is coming either in form post (from ...
- 2,287
0
votes
1
answer
777
views
Get client ip address that is not spoofed
I am using the following source code to get a client IP address,
Public Shared Function GetIPAddress() As String
Dim context As System.Web.HttpContext = System.Web.HttpContext.Current
Dim ...
2
votes
1
answer
837
views
How could ASP.NET forms authentication session leak into a different site?
We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur
Steps:
Login to ...
- 1,152
3
votes
3
answers
4k
views
Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?
ASP.NET documentation says:
FormsAuthentication.SignOut()
Removes the forms-authentication ticket from the browser
Why is the cookie not invalidated at the server as well? It would be easy ...
- 1,152
0
votes
1
answer
226
views
PHP code execution attempts on an ASP website
I found multiple PHP code execution attempts on my web server, which is running on asp. What happens when one attempts to execute php code on an asp web server? Will this create an impact on the ...
- 1
0
votes
0
answers
741
views
How to store SSN in asp.net web-based application on a short-term basis?
After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
- 246
1
vote
1
answer
387
views
How to convert this .NET cryptography code to openssl command?
how to sign the message with the private key of the signer using openssl command line tool to get the same result as the code below?
using System.Security.Cryptography.Pkcs;
using System.Security....
- 111
2
votes
1
answer
667
views
Unauthorized API Access Without Key Header
In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key.
In order for me to send requests to this endpoint, I ...
- 123
2
votes
0
answers
901
views
ASP.NET SOAP Service XXE
Is it possible to do any type of XXE in a service developed using default C# SOAP service framework?
I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
- 21
-1
votes
1
answer
770
views
Local File Download(LFD) vulnerability exploit
I have found a arbitrary file download vulnerability in an asp.net application.
I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
- 1
0
votes
1
answer
301
views
I'm not sure if this Website is SQL Injectable
I think I found an SQL vulnerability; the request and response can be found below. I'm not sure because it is showing a normal error (it's in French) instead of showing an SQL error.
I also tried to ...
- 101
2
votes
0
answers
270
views
HTML Form to PDF vulnerabilities
I have a form where the user inputs data.
On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
- 21
2
votes
0
answers
138
views
Issuing Personal Access Tokens for my APIs
I have an intranet site, hosted locally within my organisation. The same site also exposes some data through various web services. It's written using ASP.NET MVC 5 and WebAPI 2.
At the moment users ...
- 121
3
votes
0
answers
276
views
String Serialization in .NET [closed]
I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory.
By default, the framework .NET ...
- 39
3
votes
1
answer
11k
views
Two solutions for CSRF on OWASP for ASP.NET WebForms
I am confused about differences between those two solutions from OWASP ASP.NET Web Froms Guidance
Solution one:
While viewstate isn't always appropriate for web development, using it
can provide ...
- 141
1
vote
1
answer
1k
views
Attack path alternatives for XXE
I've found a blind Xml External Entity (XXE) attack against a SAML infrastructure while on a client engagement but it has been giving me fits trying to exploit it earlier. I can construct a simple XXE:...
- 43
4
votes
2
answers
2k
views
How to securely store user-specific mail server credentials at the server side of a web application
I have an asp.net web app that generates emails when users perfrorm actions...these emails are generally notifications to other users that they should see/do something. The users can be internal to ...
- 43
0
votes
2
answers
2k
views
How to extract data using SQL injection on a vulnerable ASP.NET application?
I managed to find a vulnerability in a so-called friend of mines website and I want to show him that his website is vulnerable to data extraction.
When I use something like yes')-- as post I get the ...
- 9
2
votes
0
answers
8k
views
Prevention of host header injection in ASP.NET?
How can we mitigate host header injection in ASP.NET? I have already configured application binding in IIS and set static hostname but still, the vulnerability exists.
- 601