ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.

learn more… | top users | synonyms

1
vote
2answers
26 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
0
votes
1answer
66 views

Is it safe to send the user's encrypted password back to them in the browser? Why?

I have planned to send the encrypted password from the application back to the user. I am currently using AES to encrypt user passwords. I want to send the user's encrypted password back to them in ...
0
votes
0answers
13 views

Does CKEditor for ASP.NET do auto sanitation?

I don't see anywhere to enable a sanitizer in the CKEditor ASP.NET implementation. How are we supposed to do sanitation?
3
votes
1answer
42 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
0
votes
0answers
51 views

Framework to authenticate web API requests from legacy application

I have a legacy ASP.NET MVC application that uses pretty standard forms authentication which validates logins against an application database. The scope to change this application is limited, however ...
1
vote
1answer
45 views

Do IIS / ASP.NET / MVC version headers reveal patch presence?

Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this: Server: Microsoft-IIS/8.5 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 can be used to determine ...
1
vote
1answer
33 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
1
vote
1answer
50 views

Trying to build an open authentication controled authorization website for multiple domain users

I'm not sure that this is possible but I figure at worst, I'll be told you cannot do that. Our organization has a report server that sits in a DMZ accessible by multiple units that have their own ...
57
votes
6answers
9k views

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None ...
0
votes
0answers
120 views

C# app and ASP.NET api: validating requests/responses

So I have one C# WPF desktop app (client), which communicates with my web api to login for the user, get info, etc. The C# WPF app will communicate with a hardware device as well. However, there is a ...
0
votes
1answer
154 views

How restrict is an Asp .Net Web App with ipSecurity enabled?

The IT department of my company refused to host an ASP .Net Web App on our intranet. For security reasons that would be the best solution. Right now I'm considering other options. One of those is to ...
4
votes
1answer
90 views

Are recent versions of ASP.NET implementing proper authenticated encryption?

There has been uncovered before that ASP.Net does not use the authenticated encryption right (e.g. here), they used Mac-then-encrypt that lead to some practical attacks. So I am wondering if I use ...
3
votes
1answer
107 views

What happens when CA server is down?

Let's assume that I have a server which accepts requests over HTTPS. The server resides in a closed environment, and relies on a local CA server. I am not sure if this is relevant, but the server is ...
0
votes
1answer
99 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
2
votes
1answer
325 views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Source Some will have another firewall between the application server and ...
2
votes
2answers
111 views

Can two users share the same Request.UserHostAddress?

I am working on an ASP.NET MVC-5 web application, which is available to public users (no login is required). And I need to prevent the same user from submitting more than 5 "contact us" requests ...
3
votes
1answer
5k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-...
6
votes
1answer
6k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
1
vote
1answer
37 views

Is it worth reporting a asp.net runtime error? [closed]

I found a runtime error on united.com. Is it worth submitting? The exception doesn't seem to show any identifiable information.
2
votes
2answers
139 views

Is this ASP site vulnerable to XSS or not?

I took a scan of a ASP site and it said that request validation was off. It caught it by sending a URL of example.com/?foo=<script> and received a response URL of example.com/?foo=<script> ...
4
votes
2answers
99 views

When I turn off request validation in asp.net, am I vulnerable?

So I have request validation off in my web application. You can add /foo?=<script>and my web application won't catch it -it doesn't filter it- Does this make me vulnerable to attacks; should I ...
2
votes
3answers
375 views

Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?

I am working on a web application that would include some custom development and got a bit concerned about code theft. So the question I wanted to ask is whether it is - generally speaking - possible ...
4
votes
1answer
115 views

How did the Code Red worm work?

So I've been reading a bit about the Code Red worm, and I get the gist but the overflow string doesn't make sense to me. From this site, it says that the overflow string the worm used was /default....
1
vote
1answer
188 views

Is it possible to execute Server Side Scripts despite Content-Type header?

Say, there's an upload function where users are supposed to upload images only. However, it's possible to upload arbitrary files bypassing the restriction. Say, I uploaded a shell (aspx) and ...
2
votes
0answers
408 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
1answer
235 views

Use RSA Encryption With ASP.NET

My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to ...
2
votes
0answers
158 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
2
votes
0answers
197 views

Hydra - Possible to follow redirects

I'm trying to use Hydra on an ASP web application. Their login page uses the following method: site/Login: username/password If successful, I am redirect back to site/Login but with a newly set ...
1
vote
0answers
58 views

Is it secure to use HttpSessionState.Session to store Identifying Information

I am writing an ASP.NET web app. Is there anything that is insecure to store in HttpSessionState.Session? More specifically, is it ad practice to store such information as UserID, or security ...
1
vote
2answers
747 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
2
votes
2answers
503 views

Security of an SQL database server used in web app

At my organisation we have a website survey that one of the managers here uses for equality purposes. They designed and implemented the survey in Adobe FormsCentral which is now being retired, so I ...
2
votes
2answers
147 views

Best practice for identity management methods with regards to confirming user existence

I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in. I've been ...
1
vote
1answer
124 views

Machine certificates for accessing a web app in IIS only from an specific PC client

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
2
votes
1answer
308 views

Client side certificates in IIS for accessing a web app only from an specific PC

We have an ASP.NET web app running in IIS, with about 200 users, some are inside our LAN and other ones are outside our LAN. Every user has a userid account and a password to login. Besides those ...
0
votes
1answer
256 views

Security benefits to have IP-filter in HttpModule instead of Page-Load in asp.net pipeline?

I'm working on implementing an IP-filter which blocks all requests by machines outside our IP-range. This is for an asp.net project (written in c#). I've read on multiple forums that the safest way ...
4
votes
1answer
147 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ASP....
6
votes
1answer
308 views

Is it unwise to use Redis to store PII, private keys, and other secrets?

I'm reviewing a system that is using Redis to store all client secrets, private keys, and other things. The problem is that Redis loads the entire DB into RAM Since SSL's heartbleed, Rowhammer, and ...
1
vote
1answer
202 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
1
vote
1answer
758 views

How do I prevent tampering with form submission data, and changing the details for any account?

Although this is something that only employees can use, I'd like to prevent the tampering anyway. I don't like insecure code, and this is hideously insecure. Here's an example link: <a href="#' + ...
1
vote
1answer
121 views

What is the best way to track the authenticated user on the server side? [closed]

For a web app, the client side is javascript in the browser. The server side is ASP.NET with a REST API. At present there is a single server but we plan to scale out with a server each in the US, UK, ...
7
votes
3answers
1k views

How to encrypt all existing customer passwords [closed]

I work for an online shop and since I worked here we have stored customer passwords in plaintext. I joined the company as a data inputter and when I discovered that we did this I flagged it up with ...
8
votes
1answer
364 views

CSRF in ASP.NET

There's this "change password" ASP.NET form that has both event validation and viewstate enabled. There are no specific anti-csrf tokens. From I understanding, in order to execute a successful CSRF ...
1
vote
2answers
442 views

Is string concatenation vulnerable to null character in aspx?

I just see this line of code in VB in one file .aspx FileUpload.SaveAs(sPath & "/" & FileUpload.FileName) This line save a file that an user uploaded. It use the SaveAs method. I was ...
3
votes
2answers
1k views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
4
votes
2answers
468 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...
-1
votes
1answer
261 views

Measures that must be taken to protect online banking website [closed]

I building an online banking service in ASP.NET and my objective is to implement all possible security measures. Currently at database level I am using RES 2048 bit encryption to encrypt database ...
0
votes
1answer
1k views

Is the ASP.NET .ASPXAUTH cookie value always the same for a given user? [closed]

Is the ASP.NET .ASPXAUTH cookie value always the same for a given user?
-1
votes
1answer
300 views

Home PC has been compromised remotely and even after cleaning my PC repeatedly, the problem still comes back, help please? [closed]

I'm a regular guy running two small franchise businesses with a basic understanding of computers etc, (very basic really), but I am certain my home network has been hacked and I am finding lots of new ...
-3
votes
1answer
4k views

Hown I can test “Microsoft ASP.NET Forms Authentication Bypass” in ASP.Net 4.0.30319

I searched in google for "ASP.Net 4.0.30319 vulnerability " keyword. finally,I found "Microsoft ASP.NET Forms Authentication Bypass" in below link: http://dl.packetstormsecurity.net/1203-exploits/SA-...
1
vote
2answers
11k views

1'or'1'='1 help

When I put Username:anything and Password : 1'or'1'='1 Then my database retrieves the first row in the mysql table. But I want to retrieve the row corresponding to Username:anything row. How should I ...