90
votes
Accepted
Anonymous surveys that aren't so anonymous
If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS.
IIS has a very simple checkbox to enable Windows Integrated ...
AviD♦
- 72k
32
votes
Anonymous surveys that aren't so anonymous
That's incredible simple, and a really old trick.
Create a different survey for each department, even if the surveys have the same questions.
Everyone that answers to Survey X is from Department A.
...
- 538
15
votes
Where to store access and refresh tokens on ASP.NET client web app - calling a REST API
1. Where to authenticate the user?
If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user ...
- 5,363
15
votes
Anonymous surveys that aren't so anonymous
The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...
- 151
11
votes
How client certificate works for authentication (in Web API)
Mutual TLS (aka Client Authentication) is a solution to this.
As for issuing certs I wouldn't do that. I would take self-signed certs from the client and pin them directly to principals (users) in ...
- 1,605
10
votes
Accepted
Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?
You are correct that this is not possible without mis-configuration or security vulnerabilities that allow it.
Generally, the most likely culprits when it comes to coughing up application code are ...
- 35.5k
10
votes
Enable X-XSS-Protection in an ASP.Net MVC Web app
If your Web app is an ASP.Net MVC application , it is very easy to enable using the web.config file.
All you need to do is add a Custom Header as in the following config entry.
<httpProtocol>
...
- 1,257
9
votes
Accepted
_ _ VIEWSTATE to Protect Against CSRF
The issue is that the code sample in the OWASP guide is not complete. Specifically, it is missing the implementation of the master_Page_PreLoad method that it wires up in the last line of the ...
- 35.5k
9
votes
Accepted
Secure flag not set to Cookies in .Net MVC application
Your confusion is the result not of a coding or configuration error, but of a misunderstanding about how cookies work.
When the server wants to create or change a cookie, it does so with the Set-...
- 64.2k
8
votes
Accepted
Does encrypting a setting in web.config actually provide security?
No, when you encrypt a web.config section, you specify which application and site the configuration belongs to. The container is going to be specific to that site and application, and will not be ...
- 35.5k
7
votes
Accepted
Placeholders for cshtml --- ASP.NET
A more common term for this is "parameterized SQL". You are still taking user data, as you pointed out, but the security lies in the fact that the application knows what is data, and what is ...
- 35.5k
7
votes
Anonymous surveys that aren't so anonymous
An even more specific-to-user way is to create the surveys from a list. The list would include employee names, emails, id, etc. You can then send out a survey with a unique link to each email address ...
- 142
7
votes
Accepted
Is it safe to send the user's encrypted password back to them in the browser? Why?
Short answer: This is extremely dangerous and must be avoided.
There are a few things here that should be changed. First, user passwords must always be hashed. As I said in the comments, bcrypt is a ...
- 3,006
7
votes
Accepted
Securing a Web application using HSTS
Being able to intercept SSL traffic with an imported root certificate is not considered a weakness of the web application. It's a browser design decision to allow the import of custom local trust ...
- 43.7k
6
votes
Is it unwise to use Redis to store PII, private keys, and other secrets?
The risk/issue is exactly the same and the mitigation as well. Regardless if it loads the database partially or completely into memory. There will be no way for you to tell which keys have been ...
- 54.1k
6
votes
Accepted
How to defend against web server security scanners?
The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, ...
- 390
6
votes
Accepted
How could ASP.NET forms authentication session leak into a different site?
The most likely reason is that a machineKey node is set in the web.config for each of the web applications, and the node has the same values for both. This node contains the key for encrypting and ...
- 35.5k
5
votes
Accepted
Is the ASP.NET .ASPXAUTH cookie value always the same for a given user?
No, it will not be. The value contains a forms authentication ticket which has several values, some of which (like the expiration) will change every time the cookie is created, and could change on ...
- 35.5k
5
votes
How to encrypt all existing customer passwords
Passwords should be salted and hashed, not encrypted. You should use a slow hash to mitigate precomputation attacks. There is .NET code here: https://crackstation.net/hashing-security.htm
Edited to ...
- 5,270
5
votes
CSRF in ASP.NET
Change password forms are commonly bad targets for CSRF attacks as, if they're following good practice, they'll require the users existing password (failure to do so would be a security weakness in ...
- 60.7k
5
votes
Placeholders for cshtml --- ASP.NET
To expand on Xander's answer - when you use a parameterized query the parameters are never inserted directly into the statement. Instead, the query itself along with all of the parameters are passed ...
- 8,145
5
votes
Accepted
How did the Code Red worm work?
I'm only speculating, but yes the N's are for the initial buffer overflow. You'll notice that %u9090%u6858%ucbd3%u7801 is repeated over and over. These are 8 bytes of unicode values in hexidecimal.
...
- 12.3k
5
votes
Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?
If the web server you are using is correctly configured, you don't have to worry about the actual uninterpreted ASP / PHP files themselves being served out (unless of course the attacker is exploiting ...
- 1,160
5
votes
What happens when CA server is down?
The CA is used for signing the certificate which then gets used inside the HTTPS connection. The CA is not involved in the validation of the trust chain of the certificate since this validation is ...
- 181k
5
votes
Bypass Asp.Net 4.6 "A potentially dangerous Request.QueryString value was detected from the client"
As long as a standard charset is being used, there is no known publicly available way to exploit this in HTML context for any common browsers. Source: A lot of research and experience.
- 582
5
votes
Accepted
ASP.NET - why default SecurityStamp validation interval is set to 30 minutes?
It's to improve performance on larger scale applications.
Each SecurityStamp validation requires a database hit. With the validation interval set to zero, this would cause a database hit for every ...
- 132k
5
votes
Accepted
How to securely store user-specific mail server credentials at the server side of a web application
Don’t. Don’t take the risk.
Jira, for example, sets the From: <user name> noreply@jira.com and reply to: user@realaddress.com
Then the user sees the right person’s name in the from, replies ...
- 2,278
4
votes
Accepted
Client Certificates
Yes, and no.
Using client certificates doesn't solve the problem, it moves the problem. Whereas before your problem is the creation, distribution, and protection of a password or other secret. And ...
- 82k
4
votes
Best practice for identity management methods with regards to confirming user existence
I've been thinking that the better practice would be not to confirm nor deny whether the email address exists. For this reason I want to show the success message: "Instructions on how to proceed was ...
- 5,040
Only top scored, non community-wiki answers of a minimum length are eligible