Skip to main content
10 votes

Enable X-XSS-Protection in an ASP.Net MVC Web app

If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file. All you need to do is add a Custom Header as in the following config entry. <httpProtocol> ...
user3496510's user avatar
  • 1,307
9 votes
Accepted

Secure flag not set to Cookies in .Net MVC application

Your confusion is the result not of a coding or configuration error, but of a misunderstanding about how cookies work. When the server wants to create or change a cookie, it does so with the Set-...
Anders's user avatar
  • 65.6k
8 votes
Accepted

Is it safe to send the user's encrypted password back to them in the browser? Why?

Short answer: This is extremely dangerous and must be avoided. There are a few things here that should be changed. First, user passwords must always be hashed. As I said in the comments, bcrypt is a ...
h4ckNinja's user avatar
  • 3,066
7 votes
Accepted

Securing a Web application using HSTS

Being able to intercept SSL traffic with an imported root certificate is not considered a weakness of the web application. It's a browser design decision to allow the import of custom local trust ...
Arminius's user avatar
  • 44.9k
6 votes
Accepted

How to defend against web server security scanners?

The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, ...
Nik Roby's user avatar
  • 390
6 votes
Accepted

How could ASP.NET forms authentication session leak into a different site?

The most likely reason is that a machineKey node is set in the web.config for each of the web applications, and the node has the same values for both. This node contains the key for encrypting and ...
Xander's user avatar
  • 35.8k
6 votes
Accepted

Should I specify JWT audience and issuer if I have only one SPA client?

This answer complements the comments on the original question. What do these claims mean anyway? Issuer: The iss-claim corresponds to the authority who issued the token. In federated identity ...
Beltway's user avatar
  • 406
5 votes

Bypass Asp.Net 4.6 "A potentially dangerous Request.QueryString value was detected from the client"

As long as a standard charset is being used, there is no known publicly available way to exploit this in HTML context for any common browsers. Source: A lot of research and experience.
joe's user avatar
  • 592
5 votes
Accepted

ASP.NET - why default SecurityStamp validation interval is set to 30 minutes?

It's to improve performance on larger scale applications. Each SecurityStamp validation requires a database hit. With the validation interval set to zero, this would cause a database hit for every ...
Polynomial's user avatar
  • 135k
5 votes
Accepted

How to securely store user-specific mail server credentials at the server side of a web application

Don’t. Don’t take the risk. Jira, for example, sets the From: <user name> [email protected] and reply to: [email protected] Then the user sees the right person’s name in the from, replies ...
Jonathan's user avatar
  • 2,346
5 votes
Accepted

Get client ip address that is not spoofed

This obviously only applies to HTTP, as it is a HTTP header. It furthermore relies on a proxy server that doesn't attempt to hide that it's a proxy server. It will not work with clients using VPN. It ...
vidarlo's user avatar
  • 16.6k
4 votes

ASP.NET Web Forms is not generating a new session ID if a user logs out and logs back in

We should make one thing clear before we move one: Depending on the setup: Session IDs are not the same as session data This doesn't mean it's safe, but it also doesn't mean it's unsafe. Now let's ...
Robert Mennell's user avatar
4 votes

Should a Web site be allowed to use a third party web service directly?

I am very pleased to have stumbled upon this question as it is a common yet mostly wrongly handled situation. My answer is there has to be an internal service to serve the purpose of consuming/...
GhostSpeaks101's user avatar
4 votes

ASP.Net Secure Connection String in Cloud Hosting

In Azure, you have several options. One is Azure Key Vault which is an HSM-backed secret storage service. Another, if you're using Azure Web Applications or App Services, there's a configuration ...
Xander's user avatar
  • 35.8k
4 votes

Is CSRF protection useless with AJAX?

Yes, you very probably need to run some check to ensure the authenticity of the request. Basically, what is it possible from a third party website ? Send cross site request from html form with ...
Xavier59's user avatar
  • 2,904
3 votes

Should a Web site be allowed to use a third party web service directly?

It can access it directly There may be reasons why an intermediate internal service may be useful, such as abstracting out the 3rd party web service or providing a common interface to several ...
Ángel's user avatar
  • 18.9k
3 votes

Bypass Asp.Net 4.6 "A potentially dangerous Request.QueryString value was detected from the client"

Maybe not when it's just immediately reflected, but it depends a lot on the application. I would suggest testing "strange" inputs such as non-ASCII characters, accents, non-printable characters etc, ...
lime's user avatar
  • 131
3 votes

Is this a true CSRF attack?

Yes, it is a true CSRF attack. Keep in mind, a CSRF attack is designed to happen with an external forged link sent to somebody that's already logged in, to make them do an action in their session ...
Wadih M.'s user avatar
  • 1,132
3 votes

I'm not sure if this Website is SQL Injectable

Your error message is not really conclusive. It just states (if my french isn't as bad as I think it is) that the site encountered some kind of error. This may mean literally everything from "SQL ...
Ben's user avatar
  • 2,064
3 votes
Accepted

Unauthorized API Access Without Key Header

There is not much known about your actual setup. But apart from trying to guess the key (i.e. brute forcing) the attacker might also Try to sniff the key on the wire Proper use of HTTPS will protect ...
Steffen Ullrich's user avatar
3 votes
Accepted

Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?

First, let's clear up a misconception. There is no such thing as a "server-side cookie." While a server can send cookies with an HTTP response, there is no server-side cache of valid cookies. That ...
Xander's user avatar
  • 35.8k
3 votes
Accepted

Hardening ASP.NET against session fixation: Should I change the session ID despite the additional Auth cookie?

I think you could ignore the report. Tools automate tasks so you should always review the findings, as in this case. The tool maybe just checks if the value of the cookieA is equals to the value of ...
Maicake's user avatar
  • 567
3 votes

ASP.Net XSS - How does this vulnerability work

This particular attack is related to how ASP.NET was dealing with support for cookieless browsers. The case was that in old times there were browsers which have not supported cookies. In that case the ...
Bartosz Rosa's user avatar
2 votes

Do IIS / ASP.NET / MVC version headers reveal patch presence?

No, these headers don't say anything about the server itself, only that it's running Windows (Because of the IIS). The other two headers are the .Net and MVC framework version, which both are ...
Robin Hilber's user avatar
2 votes

(Solved) Meterpreter over ASPX webshell

I know basically what you're saying, you need to tunnel your session. try this: https://github.com/SECFORCE/Tunna It's designed to tunnel an installed meterpreter session, through a website. All ...
standarduser's user avatar
2 votes
Accepted

If an input field accepts <% data then how can one say there is risk of stored XSS

No, printing <% in an HTML context doesn't make it vulnerable to XSS. For an XSS attack you need to allow a letter after the opening bracket, as has also been discussed here. Starting with <% ...
Arminius's user avatar
  • 44.9k
2 votes

Storing NetworkCredential in SQL database

Not sure if there is a better way, but this is how I would do it. I think it is similar to what you describe in the question. Store the network credentials encrypted with a key that is derived from ...
Anders's user avatar
  • 65.6k
2 votes

ASP.Net Web API make HTTPS Mandatory

Unless I'm misunderstanding your question, wouldn't you be able to just create a RequireHttpsAttribute (inherit from ActionFilter) that does this, and decorate your controllers/actions with it? ...
Claus's user avatar
  • 146
2 votes

Is "Windows" mode inherently more secure than Forms authentication for .NET web apps?

In my experience, the biggest problem is that Windows authentication tends to conflate authentication and authorization. Just because a user has a Windows account does not mean they should be able to ...
Reid Rankin's user avatar
  • 1,092
2 votes
Accepted

How to effectively test for username enumeration risk?

visual differentiation is a consequence of HTML differentiation. It cannot happen that the same HTML + JS + CSS will lead to different visualizations (barring some intentional fudging like, I don't ...
LSerni's user avatar
  • 22.9k

Only top scored, non community-wiki answers of a minimum length are eligible