Collaborate Disseminate
I have an ERP portal in our college and it contains our images which size must be less than 20KB ..so when we upload our png file it changes the name of image file to gif.gif
I have tried every possible methods …Please can anyone help me… Continue reading How to Bypass File upload restrictions in asp.net website?
I am trying to understand code injection via eval in the context of different technologies.
In the case of asp.net, is it possible to be vulnerable to code injection if i am using eval?
E.g.-
<asp:Label ID="lbldtgCIDStatus" ru… Continue reading Can you do a code injection in asp.net with Eval()?
I just got a message from a security guy that my application is executing remote code if they pass a Content-Type: image/asp. For now he does not disclose anything. Now my question is that if I am using ASP.NET 5 MVC application using IIS … Continue reading Content-Type and Code Execution
I am working with a lot of ASP.NET applications this month, and I would like to learn more about security of such applications (especially in terms of penetration testing). I am not ASP.NET developer, most of the time I use Python and JS, … Continue reading ASP.NET Security Guidelines for 2020 [closed]
SCENARIO:
a web application using with ASP.NET. In the home page source code there are links like:
./WebResource.axd?d=[string with 87 characters]
./ScriptResource.axd?d=[string with 172 characters]
where in the case of WebResource the s… Continue reading Are these tests enough to check if a web app is vulnerable to Padding Oracle? How to test further?
I have been tasked with fixing a XSS issue in an ASP.Net application, but I have never seen this kind of attack before so first it would be great if I could understand how this is working and then I need some help because I haven’t been ab… Continue reading ASP.Net XSS – How does this vulnerability work
After running nikto it shows the following message
OSVDB-68127: Server may be vulnerable to MS10-070 (based on numeric calculation), thus allowing a cryptographic padding oracle. This vulnerabilty must be manually validated. See http://blo… Continue reading Which test nikto do to test oracle padding attack?
I’m testing a web app which responds with this HTTP header
X-Asp-Net: 4.0.30319
The event register validation is enabled, so If I try classic payloads like <script <img, etc, they are blocked.
I tried also the payload shown here
How… Continue reading Bypass Request validation ASP. NET 4.0.30319
I have seen how to set length using web.config such as below
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<!– ~ 2GB –>
<httpRuntime maxRequestLength="21… Continue reading Limit Content Length at URL Level in for iis or on asp project [migrated]
I’m manually testing a web application. When I read __VIEWSTATE fields they seem to be encoded in base64. I tried to decode them using
http://viewstatedecoder.azurewebsites.net/
anyway this message appears
32 byte(s) left over, perhaps an… Continue reading How to correctly decode __VIEWSTATE if is unencrypted?