90
If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS.
IIS has a very simple checkbox to enable Windows Integrated Authentication.
IE, on Windows 7, will by default send your credentials to any web server in the local intranet. (This is not your password, don't worry, but it is ...
32
Dropdown lists are an HTML/UI construct. There isn't any such concept in HTTP, which is how the client and the server ultimately talk to one another.
So, while yes, a client could alter the page, that isn't absolutely required, because there doesn't actually need to be a page. In the end a client simply sends an HTTP request back to the server and it ...
32
That's incredible simple, and a really old trick.
Create a different survey for each department, even if the surveys have the same questions.
Everyone that answers to Survey X is from Department A.
Everyone that answers to Survey Y is from Department B.
Then, you just need to mash up the results and you're done!
That alone is enough to do a lot of ...
17
As well as via a cross-domain AJAX request with credentials, the POST in your example could also be sent by using a standard form without AJAX:
<form method="post" action="http://MyApp/Page" name="hiddenFormInIframe">
<input type="hidden" name="my" value="a" />
</form>
<script type="text/javascript">
document.hiddenFormInIframe....
16
Yes, it's normal for a pen tester to ask for credentials (but not so much an ISP).
The application as a whole can't really be tested without access to credentials. Someone without credentials should only be able to interact with one interface - the login screen. Given test credentials, however, every form, every upload, every data entry point in the ...
15
The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...
14
1. Where to authenticate the user?
If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user credentials. You verify the user credentials, and issue an accesstoken/refreshtoken pair in case the credentials are known. You will ALWAYS have to go via the back-...
13
As a penetration tester I have found that "Request Validation" fails in a number of situations. Developers tend to believe that "Request Validation" == "magic", and it protects them completely from XSS, when in fact this false sense of security results in in very serious problems. All forms of DOM based XSS and Persistent XSS will bypass "Request ...
12
Creating a random token containing absolutely no information and linking it in the database with a username and an expiration time is by far the best solution.
Encryption (and hashing) is used to store and transfer data that absolutely must be sent. If there is any way to do something without having to send that data, encrypted or not, that provides ...
11
Mutual TLS (aka Client Authentication) is a solution to this.
As for issuing certs I wouldn't do that. I would take self-signed certs from the client and pin them directly to principals (users) in some manner. I would have a lookup table indexed by both common name and certificate public key to do that. This makes potential problems like cert revocation (...
10
Actually PHP strings can contain null bytes; so can a .NET string (hence ASP.NET). At the PHP level, this byte is nothing special; the character U+0000 is just another Unicode code point. Trouble begins when the string is passed to another system, for which the null byte is a string terminator. In particular for file accesses: if the PHP code tries to open ...
10
ASP.NET does not provide a XSS API. I suspect you are talking about Request Validation which is a feature in ASP.NET that inspects HTTP requests and looks for potentially dangerous input. To my knowledge PHP does not offer anything like this.
While request validation can be a benefit by preventing certain types of XSS attacks, it is not a replacement ...
10
You are correct that this is not possible without mis-configuration or security vulnerabilities that allow it.
Generally, the most likely culprits when it comes to coughing up application code are commented out code, backup files that have extensions allowing them to be delivered directly to clients without processing, and probably more likely that all ...
9
Simply, yes it can be done. User downloads the HTML, modifies the content, and sends the from with modified content.
Make absolutely sure that you are validating all form data before it hits your DB. Depending on your web framework, there is usually a way to limit options to exactly what you specify.
9
The issue is that the code sample in the OWASP guide is not complete. Specifically, it is missing the implementation of the master_Page_PreLoad method that it wires up in the last line of the Page_Init method.
What you would see, if that method were included (and I may go add it shortly here) is that the ViewStateUserKey value being set by the cookie is ...
9
If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file.
All you need to do is add a Custom Header as in the following config entry.
<httpProtocol>
<customHeaders>
<remove name="X-Powered-By" />
<add name="X-XSS-Protection" value="1; mode=block" />
</customHeaders&...
8
I am pretty sure that this is not Apache Synapse, it's some tool built with Ararat Synapse, this is a TCP/IP library built with Delphi . I downloaded source code from both projects, and as far I can see Apache Synapse has a configurable user-agent, and default is :
Synapse-HttpComponents-NIO
On the other hand, Ararat Synapse has default user agent :
Just ...
8
This condition was probably not an exploitable XSS vulnerability for most applications. This is more likely a "defense in depth" filter to prevent programmers from unintentionally causing problems.
XSS is solved in an API's by setting the content-type to application/xml or application/json depending on the return data type (and text/plain is also commonly ...
8
While, as @gowenfawr has answered, it is normal for a professional pentester to ask for user-password you should ask them the following questions:
What tests are you going to perform with these users? (so you know exactly what they are doing).
How are you going to manage the credentials I give you? (so you can know if they are going to protect the ...
8
Your confusion is the result not of a coding or configuration error, but of a misunderstanding about how cookies work.
When the server wants to create or change a cookie, it does so with the Set-Cookie response header. There, the server can also specify how the browser should treat the cookie, e.g. how long to keep it, if it is secure or not, etc. This ...
7
As far as I understand, this CVE is a dud. The strong name is basically a signature on the DLL, and the public key is identified by the "public key token", which is a SHA-1 hash of the key truncated to 64 bits. The core functionality of the "strong name" is to avoid clashes when several developers, who do not know each other, publish different DLL with the ...
7
Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and ...
7
No, when you encrypt a web.config section, you specify which application and site the configuration belongs to. The container is going to be specific to that site and application, and will not be accessible to other applications.
If you control the system, then you can do whatever you want, including just decrypting the section. There is no protection ...
7
A more common term for this is "parameterized SQL". You are still taking user data, as you pointed out, but the security lies in the fact that the application knows what is data, and what is executable.
When you build a SQL statement as a string and pass it in it's completed entirety to the database, the application simply has to trust that the SQL ...
7
An even more specific-to-user way is to create the surveys from a list. The list would include employee names, emails, id, etc. You can then send out a survey with a unique link to each email address for the employee and call it anonymous. While this is unethical (saying a survey is anonymous when it really isn't), I have seen it done in a few different ...
7
Short answer: This is extremely dangerous and must be avoided.
There are a few things here that should be changed. First, user passwords must always be hashed. As I said in the comments, bcrypt is a common and appropriate hashing mechanism.
Secondly, sending credentials back to a user leaves it open for abuse by an attacker - there is never a good reason ...
6
I think the answer to your question pivots on a slightly different perceptual view - which is, where does the decryption take place?
Technologies like TDE function at the database level. In practical terms, this often means that a DBA - or someone who has compromised appropriate privileges - can access the decrypted data and structure.
Cell-level ...
6
There are cases of SQL Injections leveraging the implicit conversion of Unicode homoglyphs from Unicode character string types (NCHAR, NVARCHAR) to character string types (CHAR, VARCHAR). A character such as ΚΌ (U+02BC) in NVARCHAR may slip through the escaping routine and get translated to ' (U+0027) in VARCHAR, which may result in an SQL Injection when such ...
6
The risk/issue is exactly the same and the mitigation as well. Regardless if it loads the database partially or completely into memory. There will be no way for you to tell which keys have been compromised and which haven't. So the only option would be to revoke them all, regardless if it's a Redis or SQL database.
Most of the time the reason why people are ...
Only top voted, non community-wiki answers of a minimum length are eligible
