Collaborate Disseminate
I am coding a windows application in C# and I would like to get the client’s machine IP . I am using this code :
foreach (var ip in Dnshost.AddressList)
{
if (ip.AddressFamily == AddressFamily.InterNetw… Continue reading Is getting IP by Dnshost.AddressList secure in C#
This is a theoretical question: does this make sense and is secure?
My goal is to strengthen the passphrase. The flow is the following:
I enter a pssphrase admin1234. This passphrase is going to be used to derive a key for… Continue reading Automatic choice of the hash function for key derivation
This is basically a theoretical question: is the logic below secure? By secure I mean that the defender is not weakening himself. To put it in other words — attacker cannot speed things up.
The goal of the method below is t… Continue reading Determine key derivation hash function
Recently me and me colleague was wondering about obfuscating / removing project info. If application is reverse engineered than what kind of information the engineer sees?
Can he see the email of the person on which visual s… Continue reading Visual Studio anonymity
I hosted an application in ASP.NET 4.0 webforms.
When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like:
A potentially dangerous Request.Quer… Continue reading Potentially dangerous request loads the page
I have application where I receive Fernet encrypted message and I have to decrypt it to get the original message.
I searched on google but what I understood is that I have to use AES to decrypt it in c#.
I use the following… Continue reading How to decrypt fernet encrypted message in c#
I have some data to encrypt on my database and every tenant will have his own database so surely every tenant will have a different key.
I’m searching for the best way to store the key for every tenant.
Web api written usin… Continue reading Best way to store AES keys (web api) while dealing with multi tenants (key per tenant)
I am performing a penetration testing for the first time in a .NET application that instead of providing cookies for session management uses the viewstate hidden field.
I am using the .NET Beautifier plugin in BURP in order … Continue reading How to get session info out of encrypted .NET viewstate?
See this question/answer first: When calling a process from another process, Is sending stdin password more secure than sending an ENV variable?
I am a Java developer that is building an app where it needs to call a C# proc… Continue reading How to securely send a password from one app to another app?
According to https://msdn.microsoft.com/en-us/library/mt661872.aspx and https://github.com/dotnet/roslyn-analyzers/issues/563 the code below is vulnerable to DTD expansion attack:
var src = “?payload?”;
TextReader… Continue reading Example of Insecure DTD Processing in XmlSchema.Read