90
If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS.
IIS has a very simple checkbox to enable Windows Integrated Authentication.
IE, on Windows 7, will by default send your credentials to any web server in the local intranet. (This is not your password, don't worry, but it is ...
32
Dropdown lists are an HTML/UI construct. There isn't any such concept in HTTP, which is how the client and the server ultimately talk to one another.
So, while yes, a client could alter the page, that isn't absolutely required, because there doesn't actually need to be a page. In the end a client simply sends an HTTP request back to the server and it ...
32
That's incredible simple, and a really old trick.
Create a different survey for each department, even if the surveys have the same questions.
Everyone that answers to Survey X is from Department A.
Everyone that answers to Survey Y is from Department B.
Then, you just need to mash up the results and you're done!
That alone is enough to do a lot of ...
21
The basics
First, I assume you understand the most basic session ID security right:
you are using an ID with sufficient entropy, and
you use transport level security (HTTPS).
Any approach to session ID (URL, cookies, whatever) that does not get those right is vulnerable, your question is specifically about ID in URL, so I will not discuss that further.
...
17
As well as via a cross-domain AJAX request with credentials, the POST in your example could also be sent by using a standard form without AJAX:
<form method="post" action="http://MyApp/Page" name="hiddenFormInIframe">
<input type="hidden" name="my" value="a" />
</form>
<script type="text/javascript">
document.hiddenFormInIframe....
16
The purpose of ASP.NET ViewState is to persist control state between post-backs (see MDSN explanation), it does not implicitly enable security that would prevent CSRF.
Also note that encrypted ViewState in unpatched older versions of ASP.NET are susceptible to an encryption vulnerability.
To enable this type of protection you could:
Use ViewStateUserKey (...
16
Yes, it's normal for a pen tester to ask for credentials (but not so much an ISP).
The application as a whole can't really be tested without access to credentials. Someone without credentials should only be able to interact with one interface - the login screen. Given test credentials, however, every form, every upload, every data entry point in the ...
15
The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...
13
As a penetration tester I have found that "Request Validation" fails in a number of situations. Developers tend to believe that "Request Validation" == "magic", and it protects them completely from XSS, when in fact this false sense of security results in in very serious problems. All forms of DOM based XSS and Persistent XSS will bypass "Request ...
12
Creating a random token containing absolutely no information and linking it in the database with a username and an expiration time is by far the best solution.
Encryption (and hashing) is used to store and transfer data that absolutely must be sent. If there is any way to do something without having to send that data, encrypted or not, that provides ...
12
1. Where to authenticate the user?
If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user credentials. You verify the user credentials, and issue an accesstoken/refreshtoken pair in case the credentials are known. You will ALWAYS have to go via the ...
10
You have to distinguish two kinds of attackers:
SSL is used during transport to prevent a third person from reading and modifying the transmitted data.
The user who sends data to the server and gets answers from the server, can obviously see and modify the data any way he or she wants. So the user can modify the hidden form field containing the view state....
10
Actually PHP strings can contain null bytes; so can a .NET string (hence ASP.NET). At the PHP level, this byte is nothing special; the character U+0000 is just another Unicode code point. Trouble begins when the string is passed to another system, for which the null byte is a string terminator. In particular for file accesses: if the PHP code tries to open ...
10
ASP.NET does not provide a XSS API. I suspect you are talking about Request Validation which is a feature in ASP.NET that inspects HTTP requests and looks for potentially dangerous input. To my knowledge PHP does not offer anything like this.
While request validation can be a benefit by preventing certain types of XSS attacks, it is not a replacement ...
10
You are correct that this is not possible without mis-configuration or security vulnerabilities that allow it.
Generally, the most likely culprits when it comes to coughing up application code are commented out code, backup files that have extensions allowing them to be delivered directly to clients without processing, and probably more likely that all ...
9
There are two main (security) reasons to do this, above and beyond just using parameterized queries:
Parameter type enforcement
Least privilege.
The principle of Least Privilege requires you to allow any entity (user or application) access only to whatever it needs to do the defined task. If you don't restrict the webapp only to the SPs, the ...
9
Simply, yes it can be done. User downloads the HTML, modifies the content, and sends the from with modified content.
Make absolutely sure that you are validating all form data before it hits your DB. Depending on your web framework, there is usually a way to limit options to exactly what you specify.
9
Mutual TLS (aka Client Authentication) is a solution to this.
As for issuing certs I wouldn't do that. I would take self-signed certs from the client and pin them directly to principals (users) in some manner. I would have a lookup table indexed by both common name and certificate public key to do that. This makes potential problems like cert revocation (...
9
If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file.
All you need to do is add a Custom Header as in the following config entry.
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
<add name="X-XSS-Protection" value="1; mode=block" />
</customHeaders&...
8
It is difficult to execute a successfull CSRF attack on an application using viewstate but not impossible. One way to do a succcessful CSRF attack on an application with _viewstate is
Attacker is able to login to the application ( using own or aquired credentials)
Visit the page (with most common or most useful variable states) against which she wants to ...
8
The key here is that with closed source code, the onus is on protecting that code - attackers may try to steal the code, reverse engineer it, or just attack it. The internal processes should be designed to identify vulnerabilities and fix them, but the numbers are quite skewed:
Attackers: many Defenders: few
With open source code, there is a slightly ...
8
I am pretty sure that this is not Apache Synapse, it's some tool built with Ararat Synapse, this is a TCP/IP library built with Delphi . I downloaded source code from both projects, and as far I can see Apache Synapse has a configurable user-agent, and default is :
Synapse-HttpComponents-NIO
On the other hand, Ararat Synapse has default user agent :
Just ...
8
While, as @gowenfawr has answered, it is normal for a professional pentester to ask for user-password you should ask them the following questions:
What tests are you going to perform with these users? (so you know exactly what they are doing).
How are you going to manage the credentials I give you? (so you can know if they are going to protect the ...
8
The issue is that the code sample in the OWASP guide is not complete. Specifically, it is missing the implementation of the master_Page_PreLoad method that it wires up in the last line of the Page_Init method.
What you would see, if that method were included (and I may go add it shortly here) is that the ViewStateUserKey value being set by the cookie is ...
7
This is going to be an annoyingly trivial answer, BUT...
The only way to perform a Response Splitting attack on an updated ASP.NET (or MVC) server, is if the application itself is writing back raw HTTP responses.
Yes, of course no programmer in their right mind would do that... but in the case of the 60% of programmers that are not in their right mind, it ...
7
Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using.
I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not ...
7
As far as I understand, this CVE is a dud. The strong name is basically a signature on the DLL, and the public key is identified by the "public key token", which is a SHA-1 hash of the key truncated to 64 bits. The core functionality of the "strong name" is to avoid clashes when several developers, who do not know each other, publish different DLL with the ...
7
Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and ...
7
No, when you encrypt a web.config section, you specify which application and site the configuration belongs to. The container is going to be specific to that site and application, and will not be accessible to other applications.
If you control the system, then you can do whatever you want, including just decrypting the section. There is no protection ...
Only top voted, non community-wiki answers of a minimum length are eligible
