All Questions
6 questions
1
vote
1
answer
472
views
User Credentials for Accessing Network Resources
I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
- 129
1
vote
1
answer
2k
views
Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)
I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO.
My initial assessment is that ...
- 267
2
votes
2
answers
3k
views
C# LDAP Injection
Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor?
For example:
DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
- 361
4
votes
2
answers
1k
views
Authenticating AD user over TCP socket
I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group.
...
- 171
0
votes
1
answer
835
views
.net System.Security.Principal.WindowsPrincipal user namespace ldap injection
A recent scan of a .net web application detected an ldap injection vulnerability for a field that was used for a username assigned to an instance of a custom class named User.
After stepping through ...
- 109
5
votes
2
answers
12k
views
How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?
In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended.
...
- 51.1k