Hot answers tagged

90 votes
Accepted

Anonymous surveys that aren't so anonymous

If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS. IIS has a very simple checkbox to enable Windows Integrated ...
user avatar
  • 72k
32 votes

Anonymous surveys that aren't so anonymous

That's incredible simple, and a really old trick. Create a different survey for each department, even if the surveys have the same questions. Everyone that answers to Survey X is from Department A. ...
user avatar
  • 538
15 votes

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

1. Where to authenticate the user? If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user ...
user avatar
  • 5,363
15 votes

Anonymous surveys that aren't so anonymous

The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...
user avatar
  • 151
11 votes

How client certificate works for authentication (in Web API)

Mutual TLS (aka Client Authentication) is a solution to this. As for issuing certs I wouldn't do that. I would take self-signed certs from the client and pin them directly to principals (users) in ...
user avatar
  • 1,605
10 votes
Accepted

Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?

You are correct that this is not possible without mis-configuration or security vulnerabilities that allow it. Generally, the most likely culprits when it comes to coughing up application code are ...
user avatar
  • 35.5k
10 votes

Enable X-XSS-Protection in an ASP.Net MVC Web app

If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file. All you need to do is add a Custom Header as in the following config entry. <httpProtocol> ...
user avatar
  • 1,257
9 votes
Accepted

_ _ VIEWSTATE to Protect Against CSRF

The issue is that the code sample in the OWASP guide is not complete. Specifically, it is missing the implementation of the master_Page_PreLoad method that it wires up in the last line of the ...
user avatar
  • 35.5k
9 votes
Accepted

Secure flag not set to Cookies in .Net MVC application

Your confusion is the result not of a coding or configuration error, but of a misunderstanding about how cookies work. When the server wants to create or change a cookie, it does so with the Set-...
user avatar
  • 64.2k
8 votes
Accepted

Does encrypting a setting in web.config actually provide security?

No, when you encrypt a web.config section, you specify which application and site the configuration belongs to. The container is going to be specific to that site and application, and will not be ...
user avatar
  • 35.5k
7 votes
Accepted

Placeholders for cshtml --- ASP.NET

A more common term for this is "parameterized SQL". You are still taking user data, as you pointed out, but the security lies in the fact that the application knows what is data, and what is ...
user avatar
  • 35.5k
7 votes

Anonymous surveys that aren't so anonymous

An even more specific-to-user way is to create the surveys from a list. The list would include employee names, emails, id, etc. You can then send out a survey with a unique link to each email address ...
user avatar
  • 142
7 votes
Accepted

Is it safe to send the user's encrypted password back to them in the browser? Why?

Short answer: This is extremely dangerous and must be avoided. There are a few things here that should be changed. First, user passwords must always be hashed. As I said in the comments, bcrypt is a ...
user avatar
  • 3,006
7 votes
Accepted

Securing a Web application using HSTS

Being able to intercept SSL traffic with an imported root certificate is not considered a weakness of the web application. It's a browser design decision to allow the import of custom local trust ...
user avatar
  • 43.7k
6 votes

Is it unwise to use Redis to store PII, private keys, and other secrets?

The risk/issue is exactly the same and the mitigation as well. Regardless if it loads the database partially or completely into memory. There will be no way for you to tell which keys have been ...
user avatar
6 votes
Accepted

How to defend against web server security scanners?

The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, ...
user avatar
  • 390
6 votes
Accepted

How could ASP.NET forms authentication session leak into a different site?

The most likely reason is that a machineKey node is set in the web.config for each of the web applications, and the node has the same values for both. This node contains the key for encrypting and ...
user avatar
  • 35.5k
5 votes
Accepted

Is the ASP.NET .ASPXAUTH cookie value always the same for a given user?

No, it will not be. The value contains a forms authentication ticket which has several values, some of which (like the expiration) will change every time the cookie is created, and could change on ...
user avatar
  • 35.5k
5 votes

How to encrypt all existing customer passwords

Passwords should be salted and hashed, not encrypted. You should use a slow hash to mitigate precomputation attacks. There is .NET code here: https://crackstation.net/hashing-security.htm Edited to ...
user avatar
  • 5,270
5 votes

CSRF in ASP.NET

Change password forms are commonly bad targets for CSRF attacks as, if they're following good practice, they'll require the users existing password (failure to do so would be a security weakness in ...
user avatar
  • 60.7k
5 votes

Placeholders for cshtml --- ASP.NET

To expand on Xander's answer - when you use a parameterized query the parameters are never inserted directly into the statement. Instead, the query itself along with all of the parameters are passed ...
user avatar
  • 8,145
5 votes
Accepted

How did the Code Red worm work?

I'm only speculating, but yes the N's are for the initial buffer overflow. You'll notice that %u9090%u6858%ucbd3%u7801 is repeated over and over. These are 8 bytes of unicode values in hexidecimal. ...
user avatar
  • 12.3k
5 votes

Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?

If the web server you are using is correctly configured, you don't have to worry about the actual uninterpreted ASP / PHP files themselves being served out (unless of course the attacker is exploiting ...
user avatar
  • 1,160
5 votes

What happens when CA server is down?

The CA is used for signing the certificate which then gets used inside the HTTPS connection. The CA is not involved in the validation of the trust chain of the certificate since this validation is ...
user avatar
5 votes

Bypass Asp.Net 4.6 "A potentially dangerous Request.QueryString value was detected from the client"

As long as a standard charset is being used, there is no known publicly available way to exploit this in HTML context for any common browsers. Source: A lot of research and experience.
user avatar
  • 582
5 votes
Accepted

ASP.NET - why default SecurityStamp validation interval is set to 30 minutes?

It's to improve performance on larger scale applications. Each SecurityStamp validation requires a database hit. With the validation interval set to zero, this would cause a database hit for every ...
user avatar
  • 132k
5 votes
Accepted

How to securely store user-specific mail server credentials at the server side of a web application

Don’t. Don’t take the risk. Jira, for example, sets the From: <user name> noreply@jira.com and reply to: user@realaddress.com Then the user sees the right person’s name in the from, replies ...
user avatar
  • 2,278
4 votes
Accepted

Client Certificates

Yes, and no. Using client certificates doesn't solve the problem, it moves the problem. Whereas before your problem is the creation, distribution, and protection of a password or other secret. And ...
user avatar
  • 82k
4 votes

Best practice for identity management methods with regards to confirming user existence

I've been thinking that the better practice would be not to confirm nor deny whether the email address exists. For this reason I want to show the success message: "Instructions on how to proceed was ...
user avatar
  • 5,040

Only top scored, non community-wiki answers of a minimum length are eligible