Collaborate Disseminate
Most of the browsers supports the X-XSS-Protection header to prevent XSS atatcks. How we can enable this header in a ASP.Net MVC application?
Do we need to enable it in the application or do we need to do some configuration… Continue reading Enable X-XSS-Protection in an ASP.Net MVC Web app
I am working with a ASP.Net Web API 2 service and the firewall denies the DELETE method to go through (only POST and GET are allowed).
Is there a way that we can bypass this and invoke my DELETE method in the API?
Continue reading Allow DELETE method over firewall WEB API 2
I am developing an ASP.Net Web forms application. Our Test team is using some some tools and they reported me that there is a XSS Vulnerability in my search page. I did some tweaks in the the client side to prevent this.
Bu… Continue reading Prevent XSS attacks in ASP.Net Web Forms Application
I have a web project where I need to store a username and password in an SQL database. the username/password are for exchange web services.(so it cannot be hashed, I need to be able retrieve a clear text password) Each user o… Continue reading Storing NetworkCredential in SQL database
So I’m setting up single-signon authentication for the organization I work for.
Our IT guy has setup an ADFS server, which is where we’re getting our logon credentials from. He’s using an in-house security certificate that w… Continue reading How to properly handle security certificates in asp.net (ws-federation)
So I’m setting up single-signon authentication for the organization I work for.
Our IT guy has setup an ADFS server, which is where we’re getting our logon credentials from. He’s using an in-house security certificate that w… Continue reading How to properly handle security certificates in asp.net (ws-federation)
I am responsible for some public-facing web applications, and I want to test these for the username enumeration risk as explained in Testing for User Enumeration and Guessable User Account (OWASP-AT-002) by the OWASP project…. Continue reading How to effectively test for username enumeration risk?
I am a beginner and have just started working on pentesting engagements. I have a case where I have a victim IIS server (without PHP support) where I have aspx based web shell (https://github.com/samratashok/nishang/tree/mast… Continue reading Meterpreter over ASPX webshell
I am a beginner and have just started working on pentesting engagements. I have a case where I have a victim IIS server (without PHP support) where I have aspx based web shell (https://github.com/samratashok/nishang/tree/mast… Continue reading Meterpreter over ASPX webshell
Before logging in to the asp.net application, i checked the headers and there was already a session id in cookie header
cookie: ASP.NET_SessionId=3de0es3brpfbcmvkzhkidsmt
And when i logged in to the application, the same cookie header was… Continue reading Session id remain same after and before logging in asp.net application