Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [asp.net]

ASP.NET is a Web application framework developed and marketed by Microsoft to allow programmers to build dynamic Web sites, Web applications and Web services.

Filter by
Sorted by
Tagged with
3
votes
1answer
220 views

Is it secure to use HttpSessionState.Session to store Identifying Information

I am writing an ASP.NET web app and am wondering if there is anything that is insecure to store in HttpSessionState.Session? More specifically, is it bad practice to store such information as UserID, ...
2
votes
1answer
375 views

Which server is responsible for “security” when ASP.NET Core Kestrel is hosted behind IIS?

I want to understand how the flow between IIS and Kestrel works with regards to security. It seems that the integration between IIS and Kestrel is that IIS just sends absolutely all that it receives ...
1
vote
1answer
587 views

ASP.Net usage of the Machine.config file

In ASP.Net, the normal way of encrypting an object ( as an exmaple a user cookie in the server side ) is read the shared key located in the machine.config file. The machine config file contains ...
3
votes
1answer
9k views

Secure flag not set to Cookies in .Net MVC application

I have included the below lines of codes in my Web.Config and Glbal.asax.cs files, but still when I use developer tools in the browser I the secure flags were not set for the below cookies. Also ...
3
votes
1answer
1k views

Securing a multi-tenant API with SSO and different roles per tenant

I am working on developing a REST API that will be used by first party clients that we develop, and third party clients in the future. The first party clients include a SPA client side application, ...
0
votes
2answers
679 views

Is it safe and secured to use Mono-Project for Ubuntu to run a ASP.NET with a MySQL database?

I am looking to rent a VPS server to host a game server, MySQL database and an ASP.NET site on it. A Windows server is too expensive for me but Mono-Project for Ubuntu does everything that I need it ...
1
vote
2answers
1k views

Is CSRF protection useless with AJAX?

I've asked a question regarding an ASP.NET WebAPI implementation of CSRF protection: https://stackoverflow.com/questions/45389512/the-anti-forgery-cookie-token-and-form-field-token-do-not-match-when-...
3
votes
1answer
1k views

Hydra - Possible to follow redirects

I'm trying to use Hydra on an ASP web application. Their login page uses the following method: site/Login: username/password If successful, I am redirect back to site/Login but with a newly set ...
2
votes
3answers
4k views

(Solved) Meterpreter over ASPX webshell

I am a beginner and have just started working on pentesting engagements. I have a case where I have a victim IIS server (without PHP support) where I have aspx based web shell (https://github.com/...
4
votes
1answer
737 views

ASP.NET - why default SecurityStamp validation interval is set to 30 minutes?

I'm currently studying authentication mechanisms in ASP.NET Core and came across SecurityStamp feature, which is known also from ASP.NET Standard. From what I understand from the answer here, this was ...
1
vote
1answer
36 views

Returning parameterised view

So I just came across this nasty looking piece of code. public ActionResult Display(string viewName) { return View(viewName); } I would avoid having that parameter or at least I would get ...
1
vote
2answers
766 views

Can http referrer value be used to stop spam bots?

I have a public sign up site, and when they click submit, a verification text message goes out to the phone number specified in sign up by calling an aspx page via ajax. I don't want spam bots sending ...
5
votes
1answer
377 views

ASP.Net Secure Connection String in Cloud Hosting

Background In a normal bare metal hosting (IIS) we can use Integrated Security(eg : With AD) and hence, the config entry do not contain the connection string's plain text password. Or we can ...
4
votes
1answer
849 views

User authentication in JavaScript application

I'm developping a web application which will be communicating with a server over WebAPI. The server side will be on Azure and the client side will be on custom hosting with a JavaScript application (...
-1
votes
1answer
914 views

windows authentication vs ADFS

I have an ASP.NET website hosted on premises and only accessible by my company. I discovered that if I connect it to a server in the DMZ (open to the internet) even though the IIS folder is set to ...
2
votes
1answer
467 views

ASP NET Core Identity password reset form prompts for email address

I notice that the default ASP.NET Core Identity templates ask for email address after the reset email notification link has been followed (i.e. the "choose a new password" form in the ResetPassword....
2
votes
3answers
805 views

How to defend against web server security scanners? [closed]

I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like: /CFIDE/administrator/ and ...
0
votes
1answer
428 views

Secure compiled .NET source code applications ASP.NET and Windows Forms [closed]

Right now I'm working as a software development leader in my enterprise. Here's the main issue of everything. A software developer that works with us. There has been some rumours about this user ...
3
votes
1answer
935 views

How to properly handle security certificates in asp.net (ws-federation)

So I'm setting up single-signon authentication for the organization I work for. Our IT guy has setup an ADFS server, which is where we're getting our logon credentials from. He's using an in-house ...
6
votes
4answers
16k views

How to stop other websites from sending cross domain AJAX requests?

From two different applications, I was able to send cross-origin requests. Though the browser returns a "cross origin" error my server is still receiving and executing the request. For example, from a ...
1
vote
1answer
180 views

What does setting Unrestricted = false on PrincipalPermission supposed to do?

I am doing some maintenance on a 10 year old ASP.net web-forms application. It has a business layer that has its methods protected by System.Security.Permissions.PrincipalPermissionAttribute, like ...
1
vote
1answer
531 views

asp.net+bearer token: Tampering of claims possible?

I am experimenting with an OAuth2 authentication in an asp.net web-service. When accidentally generating a huge amount of claims I've discovered that the bearer token increases drastically in size. ...
3
votes
1answer
178 views

Storing NetworkCredential in SQL database

I have a web project where I need to store a username and password in an SQL database. the username/password are for exchange web services.(so it cannot be hashed, I need to be able retrieve a clear ...
2
votes
2answers
2k views

Code injection in .NET possible?

I wonder whether code injection is possible for .NET-based web applications as defined by OWASP. After performing some research on .NET and code injection there is something called code injection in ...
4
votes
1answer
2k views

What specifically is “potentially dangerous” about an ampersand in a URL

ASP.NET includes a request validation system that halts page processing if any of the following characters are present in the path portion of the URL < > * % & : \ ?. Instead of the normal ...
1
vote
0answers
110 views

How can I audit the modules and stage markers in OWIN's authentication pipeline?

ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline. I want to ensure that there are no rogue Nuget packages no hard to find partial classes ...
2
votes
3answers
1k views

ASP.Net Web API make HTTPS Mandatory

Is there any programmatic way that where I can mandate the HTTPS in my ASP.Net Web API? I need to perform this for all HTTP methods in my Web API. Can we mandate HTTPS to specific HTTP messages as ...
1
vote
2answers
585 views

Allow DELETE method over firewall WEB API 2

I am working with a ASP.Net Web API 2 service and the firewall denies the DELETE method to go through (only POST and GET are allowed). Is there a way that we can bypass this and invoke my DELETE ...
2
votes
1answer
841 views

Securing a Web application using HSTS

Background I am developing a Web application using ASP.Net MVC. I deployed the application in IIS(V8) and now doing the Web app hardening process. I configured the SSL in IIS and the Web app is ...
1
vote
2answers
104 views

If an input field accepts <% data then how can one say there is risk of stored XSS

I am having a ASP.Net Web Forms (upgraded to framework 4.0) application that has request validation on all pages. Someone attempting a script injection (entering something like <script>location....
3
votes
3answers
1k views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
2
votes
0answers
4k views

How to exploit a file upload to an IIS 5.1 [closed]

I found the following services in a testing environment: 21/tcp open ftp Microsoft ftpd 80/tcp open http Microsoft IIS httpd 5.1 The FTP server allows anonymous logins and ...
0
votes
2answers
161 views

malicious file on my websites, can't delete it [duplicate]

About 10 days ago I saw 2 unknown files on my websites (ASP.NET websites). they spread on all 3 of my websites, and placed them selves in the CSS folder. The first one was with the name of 'Paths....
2
votes
2answers
19k views

How to retrieve a particular row from database vulnerable to SQL Injection?

When I put Username:anything and Password : 1'or'1'='1, my database retrieves the first row from MYSQL table. How do I retrieve the row corresponding to Username:anything? This is for a project in ...
2
votes
1answer
280 views

What is the purpose of the Secret Key in MAC's ViewState ASP.net?

According to what I understand from the ViewState method in ASP.net, when the server generates the ViewState with MAC enabled, he will send it to the client with the MAC computed from the ViewState ...
-3
votes
1answer
67 views

Secuirty related certification/training for .NET Developers [closed]

I would like to know if there are any Free certifications related to writing secure code that myself and our team of .NET/AngularJS web-developers take up, So that we can write secure code and also ...
14
votes
3answers
3k views

ASP.NET MVC Security Check List

I am planning to start a new web site on ASP.NET MVC 2 (3). Does anybody have a full (if possible) check list of actions or approaches I should go through to avoid most security issues?
8
votes
5answers
10k views

Password reset links: random value or authenticated message?

Which is better? Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token. Generate a random token and store it in the database ...
1
vote
0answers
1k views

Decoding Viewstate of asp page [closed]

I already searched for an answer, and saw that the view state should be base64 encoded. However I used fiddler to try and decode it and the answer I get back is a string of strange characters. Here is ...
5
votes
2answers
494 views

When I turn off request validation in asp.net, am I vulnerable?

So I have request validation off in my web application. You can add /foo?=<script>and my web application won't catch it -it doesn't filter it- Does this make me vulnerable to attacks; should I ...
4
votes
2answers
5k views

_ _ VIEWSTATE to Protect Against CSRF

I am not a .NET developer and I am trying to understand how exactly does __ViewState protect against CSRF/XSRF attacks. I came across the following : security Stack exchange discussion on similar ...
2
votes
1answer
243 views

Is “Windows” mode inherently more secure than Forms authentication for .NET web apps?

We have a web application being reviewed and I see the usual section in Web.Config: <authentication mode="Windows"> <forms loginUrl="~/Account/Login" timeout="10800" defaultUrl="~/"/> &...
1
vote
2answers
47 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
0
votes
1answer
95 views

Is it safe to send the user's encrypted password back to them in the browser? Why?

I have planned to send the encrypted password from the application back to the user. I am currently using AES to encrypt user passwords. I want to send the user's encrypted password back to them in ...
15
votes
2answers
19k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
3
votes
1answer
178 views

Translate token into cookie

I find myself in a situation where I need to hand a user off from a mobile application into a web application. The mobile application is using WebAPI on the backend with OAUTH 2. The web application ...
1
vote
1answer
916 views

Do IIS / ASP.NET / MVC version headers reveal patch presence?

Quick question: does anyone know whether the IIS / ASP.NET / MVC version headers, like this: Server: Microsoft-IIS/8.5 X-AspNetMvc-Version: 5.2 X-AspNet-Version: 4.0.30319 can be used to determine ...
1
vote
1answer
182 views

Trying to build an open authentication controled authorization website for multiple domain users

I'm not sure that this is possible but I figure at worst, I'll be told you cannot do that. Our organization has a report server that sits in a DMZ accessible by multiple units that have their own ...
60
votes
6answers
10k views

Anonymous surveys that aren't so anonymous

In the past I have completed an 'anonymous' survey at work only to find that my employer was able to garner a lot of not-anonymous information from this survey. Location, name of manager, etc. None ...
1
vote
1answer
2k views

How restrict is an Asp .Net Web App with ipSecurity enabled?

The IT department of my company refused to host an ASP .Net Web App on our intranet. For security reasons that would be the best solution. Right now I'm considering other options. One of those is to ...