.NET DECK Flashcards
1
Q
Four phases of web application attacks
A
Recon, Mapping, Discovery, Expoit
2
Q
Most attacks are ________ specific to .NET; they are found in….
A
NOT specific to .NET, and don’t need any knowledge of it to exploit it. Found generically in HTTP, AJAX, JS, XML, SQL.
3
Q
Four main things that can be attacked on a page
A
Verbs. (Using Gets vs. Posts, etc)
URL
Headers (User agents, referrers, cookies)
Content in the page (Page forms, JS, CSS, etc)
4
Q
Places where data validation needs to happen
A
Between every layer of the model. From application to middleware to back end DB, and from DB back to the application.
Should be parameterized and encoded, validated w/whitelists.
5
Q
Before performing data validation, it’s important to identify every _________ in your system diagram/threat model.
A
trust boundary
6
Q
How should validation be performed?
A
- At every layer/tier.
- By senior, experienced developers
- Consistently, simply, and in a way that it can be audited.
7
Q
What are some validation techniques?
A
Indirect Selection (moving a string variable to an integer, etc) Blacklists Whitelists (better) Parse CMD Regex
8
Q
A WAF is a big, shiny, _________.
A
blacklist. It blocks known bad characters. (better than nothing)
9
Q
Whitelists
A
Validation construct that allows only known good, established chars. Better than blacklists.
10
Q
Indirect Selection
A
Change input adding fields to drop downs, associate strings as integers so they can be parsed and don’t allow free form, don’t directly access objects.
By storing a string with a number representation, it means that validation just needs to be an integer check.
11
Q
Validation Paradigm
A
How to validate:
- White list input
- Constrain/reject in that sample
- Assign input to a local variable so it can be referenced w/o touching the value. (validate the input, assign the original value to CleanString, then only reference CleanString)
12
Q
TryParse()
A
Built in .NET/C# method. Easy way to take invalid strings and parse them into corresponding type w/o generating an exception. Easy way to constrain places where users enter input.
13
Q
Why use TryParse()
A
Common way to convert strings into a usable integer; lots of classes are set up this way. Easy way to constrain user input.
14
Q
What happens when TryParse() has an error
A
Rather than throwing an exception, it will return a converted number or a zero.
15
Q
How to test regex
A
Deconstruct them and run them through a tool, such as the regex coach/the Regulator/Expresso
16
Q
what is (^\d{3}-\d{2}-\d{4}$)
A
the SSN regex
17
Q
What is (\p{Lu}) and (\p{LI})
A
Regex to match one Unicode uppercase character and lowercase character.
18
Q
What is (\w) or \d)
A
Regex for matching a word character or a digit
19
Q
How do data annotations work?
A
Data annotations are patterns (in the form of attributes) for standard input validation in MVC. They include things like “Credit Card” or “Phone” or “URL” that validate a specific set of rules on a a field.
Annotations are decorated on the method to enforce the behavior.
20
Q
How do errors get added to ModelState, so that that it can be valid or invalid?
A
Model binding automatically adds errors to the state when it receives POST form data. If any POST data has an error in validation, it automatically adds it. You can also manually have code add an error to the state.
For example, you can have an if/else block where the “else” throws an error and adds it to the model state, for custom errors.
21
Q
When does Model State binding happen?
A
When POST form data is received, it “binds” the value pairs to the model, with any errors its received.
22
Q
What is under-posting and over-posting?
A
When an attacker adds post value/pair fields that aren’t there in the standard request, or deletes ones that are.
23
Q
How to prevent under-posting and under-posting
A
ViewModel design.
Create a ViewModel with a 1 to 1 mapping between the specific view and a model. Model is then mapped to an entity object by the controller.
24
Q
.NET custom annotations
A
.NET has options for annotation (attribute) driven validation. You can make your own, add it to the model. (Like with SANS.Appsec.Name annotation referencing a common validation custom validation scheme
Can create your own ModelState errors to check against the IsValid library.
25
ASP .NET MVC "helpers"
when you you @.property style fields (such as @html.Displayfor) it automatically HTML encodes the field
- most of the frameworks *try* to encode these fields
26
How to force validation in Web Forms
By calling Page.Validate (runs on client and server)
27
RegularExpressionValidator does not run...
if the target value is an emoty string. Used in conjuction with RequiredFieldValidator to make sure the field exists and has the correct regular expression.
28
Can group validators in web forms together on a form, and then have it checked by...
the Page.IsValid before handling any data.
29
Web forms validators run on
both client and server
30
Deferred Validation
Added to .NET in version 4.5, deferred (or lazy) validation only runs on an item in the reuqest collection when the app code accesses it.
For example, Requests.Form["Feedback"] or Model.Feedback would check to make sure that specific field is validated.
31
Parameter Manipulation vulnerability
Ability to manipulate parameters in post data; headers, cookies, hidden fields.
Can jack with session IDS.
32
How to defend against parameter manipulation
1. keep service-side session state, storing in object on the server.
2. Encrypt request parameters with AES and MAC to protect anything you dont want the user to manipulate. (put in HMAC viewstate)
3. Perform server side auth checks.
33
what is an unvalidated redirect vulnerability?
When unvalidated data is used to redirect or forward a user to another site.
Can lure victims to an evil forged version of a site. (that is vulnerable to other attacks)
34
Protection from unvalidated redirect attacks
Always have the input validated
| Use whitelists for authorized redirect locations
35
Web Forms Unvalid Redirect defense
use the TryCreate() method, to make sure the redirect is relative (in the same application/domain path)
36
What is an unvalidated forward vulnerability
when the 302 (redirect) code is provided via the server and not the browser. All the redirecting action is run on the back end, not visible to the user.
If the user can control the URL involved in that back end transfer, its a problem.
37
What process/method is manipulated with the unvalidated forward vulnerability?
its a problem with the server.Transfer method; not an MVC/.NET issue.
38
Unvalidated Forward defenses
keep user-controllable data OUT of the server.Transfer. If you have to do it, make sure the user data is auth checked/validated.
39
In DOM based XSS, rather than the XSS being combined reflected back via the server, the XSS attack _________
is merged with the DOM and JS in the browser executes the XSS attack. (The JS in the page extracts the XSS attack and merges it into the DOM method)
40
Places to put XSS attacks (Contexts)
HTML elements, attributes, and comments
URLs
JS
VBS/CSS.
Protections vary by conmtext.
41
Html tag that does no encoding
@html.raw
42
Levels of a .NET web forms directory that you can disable validation at.
You can bypass or disable request validation at the:
1. field (Unvalidated property on HttpRequest object, such as Request.Unvalidated.Form["Feedback"])
2. page (setting ValidateRequestMode on any .Net Control to Disabled)
3. application (via validateRequest=False in web.config)
43
Problem with unvalidated forwards
It bypasses authorization/authentication rules
If you must do it, perform code based authorization before forwarding and on the landing page.
44
XSS exposes the users of your app to
```
Malware
JS based key-loggers
CSRF attacks
Phishing, spam, and ads
cookie theft
```
45
What are some "data preparation" methods for defending code from XSS?
Encoding (ensure server and application are using same consistent UTF style, etc)
Canonicalization (different ways you can represent the same tag, in UTF
Output encoding
46
What happens if encoding is missing, from an XSS standpoint?
Users can inject code that response and FORCE their own encoding, bypassing validation/encoding roles.
47
What is canonicalization?
THe different ways to represent characters based on encoding types.
How to represent in a dozen different ways. (UTF-7: +ADw-script+AD4-), %3C%73%, etc
48
.NET libraries for output encoding
AntiXSSEncoder
MS Web protection library (WPL)
HTTPUtility class
49
___________ offers additional contexts that aren't part of AntiXSS class
MS Web Protection Library (WPL)
50
WPL offers what features?
Whitelist encoding methods
an HTML sanization library
Named entity support (auto encoding of HTML-specific special characters, like , and "
51
________ can be used to sanitize parts of an HTML doc or an HTML doc fragment
WPL Sanitizer class
52
MVC has the _________ class to automatically encode dynamic data. It uses tags such as ________.
HTML helper class
Tags such as @Html.DisplayFor() method will encode content and prevent XSS attacks, as will @Html.ActionLink
53
Shorthand way to variable encode content in .NET 4.5+
Use
54
What is NOT properly encoded using the shorthand (
JS, VBScript, URL, CSS, or attributes
55
Razor shortcut to apply HTML encoding to a dynamic value parameter
HTML helper class, via the @ sign.
56
XSS Header protections include:
1. setting the HttpOnly flag (preventing access to cookies from client side scripts)
2. X-XSS protections (level 0, 1, and 1;mode=block) for variable levels of protection.
3. Content Security Policy (header used to set rigid, granular levels of controls for what sources content can come from, and how.
57
Prerequisites for Content Security Policy to work
Code can not be placed in tags within the HTML page, or with inline event handlers (such as
Can't have app code that calls to functions that allows JS to execute from strings. (Such as eval, setInterval, etc)
58
what are CSP directives?
The way Content Security policy defines where content can be retrieved from. Items include script-src, object-src, media-src.
59
In order for ASP .NET (web forms) and CSP headers to be compatible...
You have to disable the unsafe-inline and unsafe-eval directives, and explicitly allow them. Weakens the security provisions.
60
SQL injection defenses include
Escape command characters in SQL using:
ADO .NET (Parameterization)
LINQ to SQL (automatically parameterizes)
Entity Framework
Dynamic TSQL params
61
How does ADO .NET solve SQL injection issues?
Parameterizing queries. Rather than directly inserting dynamically concatenated code, it uses parameters (such as username and password) which are properly encoded. (@username)
62
LINQ is a framework that can.....
.......translate when applications speak to model objects, like SQL, and they translate the properties/queries so that you *don't have to understand the underlying DB store*. The queries are then written in C# versus SQL
63
Newer version of LINQ, that has improved support for other DBs such as __________
Entity Framework. (EF)
Uses a similar syntax (C# to SQL) as Linq, but has wider support.
64
Vulnerable class within entity framework that can be used for direct commands to be run against the underlying DB.
DBContext. Contains ExecuteSqlCommand and SqlQuery methods, which runs direct commands at the DB.
65
Two main places LDAP injection can occur
the LDAP filters (such as & and |, which allow queries to look for specific items) and Distinguished names.
66
How to mitigate LDAP injection
Encoding the content, with WPL LDAP encoding.
67
What is an Object Relational Model (ORM)
allows objects to be retrieved in a more object-oriented (vice RDBMS) Most common forms of data not stored as objects are RDBs and XML.
LINQ and EF do this type of object to DB language conversion
68
Defense against XML injection
Encoding, using the WPL Encoder.XmlEncode or XmlAttributeEncode() methods.
Also, the System.Xml class built into .Net has some encoding.
69
________ is a Power query language for XML that gives you a syntax for selecting nodes in a document, which are ________.
Xpath
Elements, Attributes, etc.
70
Defenses against XPath injection, and how it works
3rd party MvpXML project; parameterizes Xpath expressions
Through parameterization, encoding occurs on elements
71
Types of authentication attacks
Weak passwords
Authentication
Improper Restriction of Authentication ATTEMPTS (vulnerable to brute forcing)
Overly restrictive lockout mechanisms (DoS)
Missing auth checks for critical functions
72
Authentication Bypass attacks fixate on
1. Changing what's assumed to be immutable data: environment variables, hidden form fields, cookies
2. Inject SQL/LDAP language into login fields
3. Adjust client side auth details, insert into AJAX
73
What are rainbow tables for?
Cracking hashes that ARE NOT SALTED
74
Improper restriction of excessive authentication attempts
Without restricting attacks, vulnerable to brute forcing user accounts
75
Overly restrictive account account lockout
DoS 'ing someone's account
76
When people accidentally expose admin functions on an app to the web, it's an example of _______
Missing auth for critical functions
77
When an actor attempts to access a resource, and the software doesn't perform an auth check on him, it's an example of ___________
Missing authorization
78
When users change their passwords, for any reason, they should:
Be sent the request out of band, and have to provide their old password/have their auth token checked.
79
For changing passwords, .NET has what two controls to add a second factor?
SMS out of band checks and one-time, time sensitive temporary passwords
80
When using challenge questions for auth, they're much more effective when:
1. Combined with out of band, rotatinmg 6 digit SMS code
| 2. Made Safe to store/transit, stable information, memorable, and definitive.
81
How are passwords salted? How many bits?
The system generates a pseudo-random crypto number have it added to the hash. (Can be stored beside it; doesn't need secure storage)
Make sure it's at least 128 bits.
82
Also referred to as a "nonce"
A salt
83
What library is required for providing actual randomness for things like salts
system.cryptography.RNGCryptoServiceProvider
84
Alternatives to recovering passwords
Don't do it, ever. Don't allow passwords to be recreated or dispensed; it's an easy way to steal account info.
1. Send a temp password that allows users to change it
2. Generate a temporary, non-discoverable password change link
3. email the users to alert for a change in status/activity
85
Secure automated account creation via web app pitfalls
Easy to screw up.
1. Don't echo passwords to the user, especially via email or HTTP. (Which shows that the passwords are stored in the clear or using reversible encryption)
2. Make users verify the account, so that attackers can't just drop in 10k accounts with automation
3. Make sure account creation confirmation page is destroyed after the account is verified.
86
Recommended/typical workflow for account creation
1. When created, send a confirmation email to user email.
2. User follows the link (over HTTPS) to activate the account and re-authenticate. (confirmation contains only text, no private details)
3. Set the confirmation opportunity to expire
4. Make sure sensitive parts of the app (anything where private information is displayed) is protected with TLS.
87
Account lockout best practices
1. Auto-unlock accounts after a set time, to eliminate DoS/strain on help desk
2. Use a captcha to prevent automation of account cracking
88
Difference between IIS 7.0 and previous versions for integrating ASP .NET (web forms)
In version 6, all ASP activities were received by ASP .NET, and then sent to IIS via Aspnet_isapi.dll and duplicated by an IIS process. (Gateway between the server and the app framework) clunk and cumbersome.
IN version 7, IIS and .NET ASP are more tightly integrated and have a the features are combined for point Auth, Handlers, and HTTP responses, when set to "Integrated mode"
89
All configuration for ASP. NET and the underlying IIS structure are combined in the _________ in IIS version _________
applicationhost.config and web.config, IIS 7.0 and later
90
Limitations to the IIS 7.0 integrated web forms/IIS architecture
Unmanaged code creates a lot of overhead, and forms authentication may not protect unmanaged resources like pics, PDFs, office docs, etc.
91
Benefits of IIS 7.0+ integrated web forms/IIS architecture
Unified functionality
1. Can add custom modules into pipeline. (perfect for security)
2. Can define config, tracing, logging, output, authorization, etc.
3. all inbound web goes through pipeline; this means you can "bolt on" functionality that isn't resident in apps to the framework/IIS.
92
What are .NET modules?
Modules are libraries/classes that HTTP requests treaverse through and do something to the data within requests. (often security focused)
93
What are .NET handlers?
Handlers are what waits at the end of the request to do the dynamic processing: endpoint for the request.
94
Relationship of modules and handlers to requests
```
Modules are: 1 module to many requests
Handlers are: 1 handler for every 1 request.
```
95
How does data go through modules/handler?
Each module inspects the request, does a specific job (like setup a user session, perform authentication, or do an auth request)
After modules handle flow, it's passed to the HTTP handler that does the GET/POST, along with the URI (.aspx, trace, asxd, etc)
96
They're not built-into the framework, but folks use custom HTTP modules to do:
```
Can do things like CSRF checks,
User input checking/validating,
customized auth (SSO, SAML, smart cards, etc)
```
97
If you wanted to make your own custom event, such as something that fires when specific HTTP security module events fire. "I'd like to subscribe to the AuthenticateRequest event, and have this custom code fire when XYZ happens" you'd use...
Use the IHttpModuleInterface, and create a custom event. Use things like PostAuthenticateRequest and Endrequest, for example.
98
Provide specific implementation for all incoming requests. (everything *.aspx, everything *.asmx, WebResource.axd for GET requests, etc)
HTTP Handlers
99
Specify how to handle custom dynamic content, like what to do for requests for PDFS, Word Docs, gifs, etc. (How to serve a word doc to only specific role-based users)
Http Handlers
100
Gives HTTP handlers access to the "http context" which includes information like session state, cookies, request parameters, etc
iHttpHandler Interface
101
To use modules and handlers, add them to the _________
applicationHost.config or the web.config. (Can have modules apply to specifc apps, or go site wide)
102
ApplicationHost.config is ___________
is the IIS 7.0 global control file for both IIS and .NET.
103
to set up to set up centralized authentication policies server wide, use
modules and handlers.
104
Six .NET managed authentication methods (modules)
1. ASP .NET Identity
2. Forms auth
3. Membership Provider
4. Windows auth
5. Default
6. Anonymous
105
Problem with ASP .NET web forms auth
It's user/pwd based, and creds are past in the POST in the clear, so it requires TLS to encrypt
106
What is OWIN, and what is used in .NET 4.5 and later for?
Open Web Interface for .NET (OWIN) provides a managed authentication/authroization foundation for .NET identity. What the identity services are built on.
107
What service in .NET allows functionality with Oath, SAML/SSO, and most backend DB languages?
.NET identity, via OWIN.
108
3 Categories of .NET auth options
1. Individual users (cookie based, username/pwd, social auth)
2. Tied to AD/O365/SSO
3. Windows IIS auth. (Intranet)
109
Important security options for using .NET identity cookie based auth
Configuration of Cookie security options, such as CookieHttpOnly, CookieSecure, ExpireTimeSpan, etc
110
This module manges all user specific items authentication items. Its methods let you change passwords, enforce password complexity/MFA, Send an SMS message to users, etc
.NET Identity User Manager
111
This module configuration options let you configure methods from the user manager class, like registering two factor APIs, max failed login attempts before lockout, and pwd complexity
.Net Identity User Manager manager config
112
crypto.cs
The crypto hashing values used by User manager to hash passwords. (Work factor, characters, salt, etc)
113
After configuring the .NET Identity User Manager module, go here to begin setting up user registration
AccountController.cs, where the Register action takes place and the relevant info (User account, email address, etc) is passed on to the DB, via UserManager.CreateAsync option.
114
The ______ class is auto-generated by VS and inherits from MS.ASpNet.Identity.EntityFramework.IdentityUser, , and is used to match the .NET database schema.
ApplicationUser class. Lets you configure what properties are stored in the database, like AccessFailedCount, Email, EmailConfirmed, PasswordHash, PhoneNumber, etc.
115
Application user class Code first migration for Entity Framework is used to....
add new data attributes for a user into the application, and automatically update the backend DB to make sure that the data is consistent and persistent.
EX: if I add CustomerId, BirthDate to a user profile, the EF Code First migration will update the back end DB with those two fields.
1. Enable-Migrations
2. Add-Migration Init
3. Update-Database
After completion , you'll see the DB schema will have new columns for these properties.
116
Problems with OWIN
1. Doesn't enforce account lockout by default
2. Weak password length by default
3. Missing password expiration/password history (using old passwords is easy) features
4. OWIN Cookie Manager bug by default"
117
OWIN bug and the fix
OWIN uses middleware cookie collection (Separate from application cookies) which are lost if Response.Cookies are modified. (First cookie added overwrites the OWIN cookie)
Fixed via setting the CookieManager to SystemWebCookieManager, which will sync cookies between middleware/app up.
118
Three main problems with forms auth
1. Is older, and only works with SQL/AD out of the box. (oracle and such needs a customer connector)
2. Stores in 3 formats: clear, MD5, and SHA1. (not great options)
3. Even if hashing the passwords in the web.config, they're still vulnerable to brute force style/rainbow table attacks.
119
Bolt on solution to overcome a lot of the security problems with older .NET security problems, like those found in forms auth and old versions
Membership Provider. Provides a bolt-on solution for older .NET versions to hash passwords with SHA256, and store them in a backend DB for use. Blocks poor security features, such as non-complex passwords.
Can customize the hashing/salting done by the membership provider forms auth feature. (for example, change it from SHA1 to PBKDFv2)
120
Uses Kerberos V5/NTLM for auth, and doesn't function through a proxy/firewalls
Integrated Windows authentication
121
Best auth for use on the intranet apps
Integrated Windows authentication
122
Sole purpose is to make sure there is an IPrincpal object in case nothing was assigned.
Default Auth. Gives everyone accessing the system a "GenericPrincipal" object with no user info.
123
Grants/denies users and roles access to URLs. Controlled by developers, and configured in web.config with and sections of the web.config.
.NET Managed Url Auth
124
the tag (In URL auth module) indicates...
a file or folder that you're applying authorization code to (such as /privateFiles), and then
125
In some cases, you might have to programmatically check whether a user has access to a resource based on role and URL. You'd use the following tags in the URL Auth module.
Checks based on the and configuration.
```
Looks like:
UrlAuthorizationModule.CheckUrlAccessForPrincipal(
"/privateFiles"
, User
, Request.HttpMethod)
```
126
Best practices for configuring the Role Manager (ways roles are stored) include...
avoid caching
protection is set to "all"
requiring TLS, keeping timeouts low
no persistence
127
Two types of authorization driven by code:
Declarative (preferred: annotation in MVC)
Explicit (secondary: boolean "has this role, y/n")
128
Iprincipal object (use, data contained)
Can perform authorization checks. Holds general info about the user, like privileges and roles.
Has a property named "Identity" that contains specific info about user.
129
Identity property (part of IPrincipal object) contains what info?
Authenticated users user account
User.Identity.IsAuthenticated
User.Identity.Name
130
Two ways to access the IPrincipal object
Through the current web page (System.Web.UI.Page.User) and HTTP context (HttpContext.Current.User)
131
MVC uses _________ to do declarative authorization checks
the AuthorizeAttribute class, with [authorize] attributes. Kept in the controller.
Can perform basic "is this account authenticated" checks and more advanced role based checks. (Is this user in the manager role?")
132
Explicit authorization checks works by....
Querying the IPrincipal object, performing boolean checks on the response.
(if (User.IsInRole("Admin") then do stuff, else log/exit.)
133
Managed file authorization works by...
Using windows authentication. File authorization uses the Winodws ACL to limit access to the file system. Used mostly for internal network ops.
"get the windows current user token, check it's ACL"
134
What are the various .NET session (user) tracking methods?
Session Cookie, Role Cookie, Forms Auth Ticket cookie, custom cookie, custom URL value, or auth headers
135
What's the difference between .NET session tracking and general session tracking?
General Session tracking is a way of tracking users, irrespective of .NET session feature (that has its own architecture, use, API, etc)
136
What is Application State for?
global variable available on every web page in an app by every user..
the state is only stored in memory, and in a single process. Not replicated across application farms, other processes, or if app restarts.
*Only good for use as an app dictionary.
137
Pros and cons of storing server-side session information in Profile Properties?
Pros:
1. Can attach any type of user info to the profile object. (ex, Profile.Name, Profile.Age) How we used to track users. (via profile objects)
2. Works for anonymous/unauthenticated users.
3. Properties are defined for the Profile oject in the web.config
4. Works for Forms/Windows auth, too"
Cons:
1. not good for security purposes.
2. The profile properties state is stored in a sql database in a single DB column, and all the objects are aggregated into a user ""blob"" which can then be read back to the object. (or anyone else with access to that blob can de-serialize it and see all the stuff) Not good for searching for specific properties, like an age.
138
How are profile properties stored and utilized by an application?
he profile properties state is stored in a sql database in a single DB column, and all the objects are aggregated into a user ""blob"" which can then be read back to the object. (or anyone else with access to that blob can de-serialize it and see all the stuff) Not good for searching for specific properties, like an age.
139
anonymous users can have user defined properties set via the:
Profile Properties, which are defined in the web.config
140
Dictionary that contains information managed between page requests, used to track users
Session Object. Tracked via URL value w/Session ID or via cookie.
141
Session state can be used for what tasks?
Uniquely identify browsers/client device requests, and map them to a session instance on the server
Store session-specific data on the server for multiple browsers/client device requests within that session
Raise appropriate session mgmt events.
142
Five .NET session state modes
```
In-Proc
StateServer
SqlServer
Custom
Off
```
143
Session object main purpose
Server side storage for state management. MOST secure fashion of storing user info server side. Assigned to one user, and tracked via cookie or URL value that has a session ID
144
InProc session state mode for .NET
Stores session data in memory w/the web app; very fast but memory intensive
145
StateServer session state mode for .NET
Windows service to store session info in memory, OUTSIDE of the app pool process state.
146
SQLserver session state mode for .NET
MAX SCALABILITY. Stores the session state centrally in a sql server (or sql cluster)
147
Custom session state mode for .NET
Developers can create or use third-party session state storage libaries to extend or enhance capability
148
________________________ doesnt work for anything aside from single server applications; object doesn't traverse to other servers, across trust boundaries, etc. Volatile storage. Stored in THE SAME WORKER PROCESS POOL.
.NET "In Proc" state storage
149
.NET in proc storage is hard to utilize because....
It doesn't traverse servers, trust boundaries, and is lost in a reboot; memory intensive.
150
in .NET ________ session state mode, a module reaches out across a process boundary, to the network, and stores state information.
StateServer mode. Very memory intensive, but efficient. Can be used by multiple web servers.
151
Restrictions for using StateServer .NET session state mode and SQL server mode
Network traffic between worker process and state server (or sql server) is not encrypted. (Must use IPSec/TLS)
Because the data crosses a process boundary, it must be serializable
152
What is Aspnet_regsql.exe tool used for?
creating the sql database for .NET to use to store state info
153
Where is the .NET session state mode set? How is it protected?
Which session state configuration mode is used is configured in web.config. Set as InProc, StateServer, SqlServer, Custom, or Off.
Can be protected by encrypting the web.config, but unless its combined with "integrated auth" sql server state management won't work with an encrypted web.config section. (Will have to store the creds in the clear)
154
What does integrated auth do for a sql server connection in the web.config?
For sql server state management, just server/DB name required, no creds stored...use trusted_connection=true
155
If session management in the web.config is set to "custom" options include...
Can use whatever back end you want to store session state info; MySQL, Oracle, Mongo, etc.
156
How to clean up/end sessions? What are some considerations for the method calls?
1. InProc mode: Session_OnEnd event, removes active session fm mem
2. Session.Clear() needs to be called before Session.Abandon() for log outs
3. in SQLMode, Session.Abandon() doesn't do anything, DB is cleared out periodically by SQL jobs
"
157
Pre .NET 2.0, _________ was used to encrypt a web.config
aspnet_setreg.exe (DPAPI)
158
Post .NET 2.0, __________ is used to encrypt a web.config
aspnet_regiis.exe (RSA or DPAPI)
159
It's a smart idea in .NET to use _________ for client side data instead of hidden fields
ViewState
160
Only _________ session mode supports the Session_OnEnd event, and uses it to ________-
InProc mode, and uses it to remove active session info from memory.
161
What cleans up SQL server session state info?
Periodic SQL tasks. Should still use Clear() and Abandon() to make sure it gets cleared out.
162
ViewState is used ONLY in ________
web forms; each viewState is tied to a specific Web Form.
163
View State is transmitted as ________ and holds ________
a hidden field, and it holds data for a user's session.
164
Viewstate weaknesses
Can be extracted and viewed, if not encrypted, and can be replayed from old requests. Not associated with a user or session by default.
Can be used in CSRF attacks, or manipulated.
165
How to add integrity measures to viewstate
Use HMAC (message auth code) to prevent tampering of view state
166
Don't set viewstate encryption to always unless
you have sensitive data to protect. it slows down processing, and isn't always necessary for non-sensitive fields.
167
the ______________ is used to create HMAC hash. Can see the decryption key//validation key in the ________.
machineKey element
web.config
168
you can avoid having someone replay view state by....
....and how does this work?
by tying View State User Key to a specific user (using SessionID, for example)
if someone tries to replay using CSRF, they'll have a different Session ID, because it will be an old value. (Different HMAC); That SessionID becomes a nonce.
169
Dont store ________ in cookies.
Sensitive info; if you have to store sensitive info there, encrypt the cookies.
170
How to secure client side cookies
Turn cookies to secure = true and HttpOnly = true.
171
Make sure that sensitive data is handled in a transaction: transactions are transactions, one-to-one, and not one step in a process to prevent ________
race conditions
172
What encryption methods are available for view states?
AES, 3DES w/the machine key
173
What integrity algorithms are available for view states?
HMAC via SHA1, MD5, 3DES, AES, etc.
SHA1 preferres
174
Protection against race conditions
1. Make sure all modifications to a data record happen in one transaction.
2. Use locks for a thread so that nothing can access those objects in different threads
3. Use .NET session module; its immune to race conditions
175
View State User key works by tying a ___________ to a POST, to create a nonce.
SessionID, which means that the server is performing a diff on requests to see if the POST came from a different user
176
A blob of data created by the server and assigned to/stored on the client
A cookie
177
When software doesn't use sufficiently random number values for security token/ID its considered...
A weak session ID. Shoot for 128 bit values, same as salts.
178
all ___________ don't support HttpOnly
browsers. (It's not included in the RFC)
179
_________ instructs the browser to share only the cookies w/a TLS secured connections
secure
180
Weak Session ID countermeasures include: (3)
1. Use cryptography namespace (library) and RNGCryptoServiceProvider to generate strong, random numbers.
2. Use expiring session cookies over persistent cookies or long-lasting tokens.
3. Use .NET session features, which are strong.
181
MITM countermeasures (4)
1. Use encrypted (at all times) comms: VPN, TLS, HTTPS, IPSEC.
2. Don't use kerberos, if possible; vulnerable to pass the hash style attacks, vulns in NTLM.
3. set secure flag on ALL security-related cookies
4. Use .NET session cookies, Role provider cookies.
182
Why was HSTS created?
In response to the sslsniff/sslstrip vulnerabilities
183
What is HSTS? (HTTP Strict Transport Security)
When browser receives HSTS header, it forces all comms to always use HTTPS with valid certificates.
184
Stealing the authentication token by stealing or predicting a valid session is called
Session Hijacking
185
Happens frequently when session IDs are placed in the URL. Get a valid user ID, Get a user to authenticate using that session ID (using phishing attack or otherwise), and then "share" the authenticated session.
Session Fixation, or "borrowing"
186
This language constantly passes it's session id in the url/clear, and is more vulnerable to session fixation as a result of it
JScript
187
Session hijacking defenses
1. Secure auth cookies
2. HttpOnly auth cookies
3. Strict Transport Security response header (HSTS)
188
Session fixation defenses
1. always assign new session ID during authentication. Throw away old auth cookie.
2. no cookieless sessions.
3. Always use HTTPOnly
189
Getting a user to browse to a page and submit a request which you may not have wanted to do is...
CSRF
190
When a web app can't verify whether a properly formed,valid, consistent request was intentionally sent by the user who submitted it
CSRF
191
CSRF defenses (6)
1. Anti-CSRF tokens, nonce, or form key that is tied to a session/auth. Even if the user knows everything else to execute a transaction, they wont have the user generated nonce
2. reduce session timeout values
3. Use session cookies vs. persistent cookies
4. Re-authenticate for critical operations
5. Use CAPTCHAs
6. Use POSTS to modify data, never GET
192
Biggest .NET specific anti-CSRF mechanism
Validate Anti-Forgery token
193
What is the Validate Anti-Forgery Token?
built into MVC
1. NET uses a syncronizer token, which doesn't match the original cookie value
2. Double submit cookie pattern (The same CSRF token generated using pseudo-random number, and is embedded in a cookie AND hidden form field, and matched up on each request.
194
What is a synchronizer Token pattern?
Defense to CSRF.
Generates a challenge token, which is a random value associated with the current session/user. That token is submitted with every request. (Hidden field for POSTS or the URL for GETS) The server then checks to make sure that token is current for each session/user.
Can do it per request or per session.
195
What is a double submit cookies defense?
Defense to CSRF.
Synchronizer pattern. CSRF token generated using pseudo-random-crypto generator, but is embedded in HTTP header in a cookie as well as a hidden form field.
Attacker can't replicate what is in the victim's browser cookie store, and make it match the value on the form.
196
What is the ViewStateUserKey?
Web forms defense from CSRF.
Unique key value for each ViewState that is user/session specific. Auto generated in VS 2012.
197
What is clickjacking?
Happens when an attacker tricks a victim into clicking a hidden UI element, which redirects a user to another site.
(Also called a UI Redress attack)
198
Clickjacking countermeasures
Set .NET ""X-Frame-Options header"" to ALL requests in the app using Application_BeginRequest event. Set header to ""deny""
1. You can change to ""allow from"" the specified origin option, but better to replace with content security policy."
199
How to defend against clickjacking in legacy browsers?
Can add an "anti-clickjacking" JS code that "breaks" frames and displays them.
200
Options for X-Frame-Options as a click-jacking countermeasure
DENY:: Prevents any site from framing the page
SAMEORIGIN: Allows framing only from the same origin
ALLOW-FROM: only from the specific source. Some browsers can't support
201
How do you fight clickjacking across all requests in your applications in ASP .NET? (Web forms)
Add the X-Frame-Options header (ASP .Net Response.AddHeader method)
set DENY, SAMEORIGIN, ALLOW-FROM options.
202
Restricted Algorithms
Proprietary, closed source algorithms. NTLM (Lanmanager)
Closed does not equal good
203
What is an HMAC?
One way, irreversible, keyed-hash. (Uses a secret key) provides authenticity)
204
Key spaces in an algorithm provide...
the level of protection. More bits, larger keyspace = more protection.
205
Uniqueness/strength of an algorithm is measured in bits of...
The key. a
206
For crypto algorithms, what is the part that needs to be protected?
the key, not the algorithm. A 128 Bit RC4 algorithm (with 112 bits of key) is stronger than a 1024 bit RSA algorithm, with 80 bits of key.
207
How are HTTPS connections governed, from a key perspective?
Browser has public key, Server has private key; once decrypted, they switches over to symmetric key for the rest.
208
Similar to a salt, this adds randomness to the first block of a block cipher. (It's a nonce, added to each block to make it unique)
Initialization vector
209
When is an IV used for a Block Cipher?
Block ciphers use the results from the previous block as a nonce to encrypt the next block, so the IV is just the "randomness" needed for the first block
210
Crypto Key issues (4)
Keys are hard to securely store
Keys have to be rotated
Keys are hard to exchange securely (without intercept)
Proper implementation
211
The first thing that should be checked in a web application for security review
The way crypto is utilized. Stored in System.Security.Cryptography, see how the app is utilizing the various algorithms.
212
What is the lowest-level human-readable programming language defined by the Common Language Infrastructure specification and is used by the .NET Framework.
MSIL, Microsoft Intermediate Language
213
All crypto (hashing, encryption, signature, etc) functions are inherited from what namespace
System.Security.Cryptography
214
Algorithms derived from the base Hash Algorithm class will either end in "CryptoServiceProvider" or "Managed" What is the difference?
Crypto Service Provider hashes are wrappers around the base system crypto libraries, and call down into the MS code.
"Managed" algorithms are implemented entirely in MSIL (C#) and are written/executed entirely in and by .NET.
215
Process for hashing a string
1. Converts the string to a series of bytes (ASCII) that the algorithm can work on (hashing algorithms can't directly work on a string)
2. Encode the string (UTF or ASCII) via the encoding class
3. Run the SHA1 (or whatever) hashing function on the encoded byte array.
4. Convert that hashed byte array into a hex string (using the BitConverter class) and return it to whatever called the hashing method.
216
What is the SoapHexBinary class used for?
Converting a hex string (hash) back into a byte array so that it can be converted back to a string.
217
What is the difference between the HashAlgorithm class and the KeyedHashAlgorithm class?
the KeyedHashAlgorithm class utilizes a key property; this key value must be initialized (set to value) before calling the ComputeHash method.
218
Difference between CryptoServiceProvider (AES, 3DES, RC2) symmetric algorithms and Managed (Rijndael) symmetric algorithms
CSP algorithms are wrappers that call into the Windows Crypto Library (underlying OS) vs Rijndael which is exclusively built in .NET/C#/MSIL.
219
Ensuring that any objects from a symmetric encryption process are closed, cleared, and set to null does what?
Ensures the streams are closed, the crypto objects are cleared, and that they're marked for garbage collector pickup.
Protects against inadvertent disclosure of info.
220
Only asymmetric algorithm that can be used to encrypt data w/.NET
RSA
221
This class provides a managed implementation of the native Crypto API, which abstracts the storage and use of keys.
What use is this?
The Cryptography Next Generation Classes.
Lets you store a key pair or a public key securely, refer to it using a simple string name.
222
Only appropriate way w/.NET to generate random, cryptographically unique numbers
Create strong crypto random numbers, using the RandomNumberGenerator method in the RNGCryptoServiceProvider class.
223
Right algorithm to use for secure storage, Integrity checking
Hashing
224
Right algorithm for use in Integrity and authenticity via a secret key
HMAC
225
Best algorithm for Bulk encryption of large amt of data
symmetric
226
Asymmetric algorithms are best for:
small amounts of data, or for the exchanging of symmetric keys (ssl)
227
3 questions to ask regarding secure storage
1. Does the information NEED to be stored, for the app to function? (example: guy storing an unnecessary backup of credit card data at business to be able to re-authorize purchases. Nice functionality, but it's a headache, and should be deleted)
2. Does it actually protect our data? Some encryption (such as transparent encryption, SQL) only protects against stolen backups, doesn't protect against sql injection.
3. Where do we store it? (Key storage is hard; encrypting the keys compounds the problem, have to backup the keys to ensure recovery)
228
Where to store keys (if you own the box, are in a web farm, or in shared hosting environment)
1. Use DPAPI to secure code, such as the web.config (IIS6+) Uses w3wp.exe to encrypt the file w/local machine code. This is the ".NET way" (stores in UserStore) Can also store in MachineStore or Registry.
2. In a web farm, store in the registry, and use the User-centric option for retrieval, that involves an additional secret to unprotect the data.
3. No good options for shared hosting environment.
229
DPAPI uses _________ to protect data, but does require _________ when used across multiple locations. (app-wide, multiple server key storage)
User's logon creds.
Uses an extra key (secret) to unprotect the data when used in multiple server setup.
230
When is the DPAPI machine-centric configuration used?
For a trusted environment that is not accessible by external users. Protected data is made available to any process on that machine, and it uses the logon creds to determine access.
231
3 steps to PCI compliance (or HIPAA compliance, really)
1. Use tokenization, if its necessary to store CC/sensitive info.
2. use Rijndael, SHA-1, or 3DES. Have to encrypt the Account Number, Cardholder Name, Service Code, Exp, token to encrypt with AES/Symmetric key.
3. Can't store CVV2 or PIN anywhere.
232
PER PCI, at a minimum, _________ must be rendered unreadable.
CC #
233
3 rules for storing passwords
1. Always store passwords as a hash (PBKDF preferred, SHA-512 with custom work factor okay; can use bcrypt.net if you're not looking for FIPS compliance)
2. Always add a salt before hashing; salts should be per-user, not per database. Don't need to protect the salt
3. Make sure you have at least a 1/4 second work factor (adaptive hashing delay)
234
Strongest hashes available for storing passwords
PBKDF and Bcrypt; use adaptive hashing w/work factor and salts.
235
Salts for passwords in .NET should be generating using ______.
This protects against
RNGCryptoServiceProvider
Dictionary/rainbow table attacks.
236
How does PBKDF work?
PBKDF has salt and work factor (iteration count) built in, you just pass it the counts. Easy to implement.
1. Feed it the password, salt, hash, and iterations.
2. You then tell it how many of those bytes to get back. (32-64) can then store it off.
3. Has a built in feature to GenerateSaltValue which you can throw into the hashing feature.
237
What do you use to make a symmetric key with only a password as the given input?
PBKDF; it's how Lastpass works. (use the Rfc2898DeriveBytes method to input cleartext, a salt, and some iterations and then turn the resulting bytes (32, 64) it into a strong AES key.
238
Pros of threading
1. Helps make GUI more responsive.
2 Splits work across multiple cores
3. push long running tasks into a background
4. Improve performance
239
Cons of threaded code
1. Harder to debug
| 2. Threading creates availability concerns, especially when race conditions occur and lock up the system.
240
What is concurrency, w/r/t threading?
Timing issues. When code is performing multiple things at a time, timing issues occur. Sometimes a second thread can see data the first thread is working on, and it creates problems.
Sometimes problems in code don't appear until code is executing on multiple threads.
241
When is code considered "thread safe"
When code is written to make sure there's no race condition/concurrency issues.
242
How to write thread safe code in .NET
1. Have to design w/threading as objective. too hard to "bolt on" after
2. Use .NET modules designed to prevent concurrency issues
3. Perform extensive testing and analysis. Put the system under load.
243
The crux of threading (concurrency) issues revolve around what?
State. If an object is being modified by one thread and and another thread inspects it at the same time, it's possible to have two threads with a different "state" of the application.
Any class with stateful members has the potential to be in an inconsistent state when accessed concurrently.
244
How to ensure consistent state for critical sections of code, in a threaded application.
Thread Synchronization; require all threads to wait until critical code finishes doing its work.
Use the lock() and Monitor object to employ thread synchronization.
245
More advanced objected for handling thread synchronization (when Lock() and Monitor aren't enough) include...
EventWaitHandle, Semaphore, Mutex)
246
How the Monitor object works
Monitor.Enter() can act on any object, and until Monitor.Exit() is called, that object is blocked. (IE, will wait for the code to finish)
247
How to define a section of code as thread safe, and that everything should complete in the method/object (all transactions) before it can be touched by another thread.
the lock() method
248
what is a race condition?
When one bit of code depends on the result of one of two threads finishing, and the results vary depending on which completes first. (Code will have different results depending on when it runs)
249
What is a deadlock?
When two threads are waiting on the release of the same object.
250
What 4 things are required to happen to create a deadlock?
1. Mutual exclusion: When one thread owns a resource/process, another can't take it. GUI's in Windows are owned by a single thread, and are responsible for processing everything.
2. Hold+Wait: When a thread is executing a critical section, it can reach out to another critical section, which can cause it to lock up if that section is held by another thread.
3. No preemption: No resource can be forcibly removed from a process holding it.
4. Circular wait: When a chain of two or more threads is waiting on a resource.
Deadlocks are WAIT conditions. A thread is waiting on another one to finish, and the other thread can't/wont finish.
251
What is the Interlocked class for?
More efficient way to handle race conditions for counters than the Lock() method.
Lets you increment variables as an "atomic" operation, meaning that it's handled as a single event.
252
What causes starvation?
Caused by unfair scheduling decisions and changing thread priorities.
253
Why shoudn't novices adjust thread priorities?
The O/S has a scheduler to balance threads and prevent starvation. If you manually change the priorities, you can screw it up and create starvation.
Threads have the ability to be set to below normal priority up to high.
254
.Net resource for when you have multi-threaded situations where reads are more common than writes.
ReadWriter locks.
Class that lets a write activity jump in to execute really quickly. Used in situations where there's a lot of reads, and you need the ability for a write to jump in.
255
Specific potential causes of deadlocks
locking on "this"
Locking on a type: for example, lock on "system.string"
256
When should Monitor.TryEnter() be used?
as a countermeasure to deadlocks; you can set a timeout, in seconds, and have it continue to try to acquire a lock as part of a try/finally/else block. (Either it conducts the lock/runs the code, then exits normally, or exits and throws an error that it couldn't get the lock.
257
Why should programmatic impersonation be avoided? (3 reasons)
It uses an "impersonation token" for access.
1. This token doesnt propogate across threads, and this can introduce vulnerabilities in the code.
2. If an exception is thrown and code is exited when "impersonating" a different user, the impersonator could get stuck as that user.
3. Possible to lose the impersonation context when using components that don't use the same threading model.
258
ReaderWriterLockSlim is a better basic implementation of ____________ that favors _______.
a ReaderWriter lock, that favors writers.
259
How to fix impersonation issues across threads, when required to use them in code
In .NET 2.0, you can set to have the token flow across threads.
"Specifies that the Windows identity always flows across asynchronous points, regardless of how impersonation was performed."
260
Is it possible to stop impersonation tokens from flowing across multiple threads?
Yes, using the System.Threading.ExecutionContext.SupressFlow() method.
(requires special permissions, in book)
261
For types that wont change, declare them as _________.
const.
262
readonly keywords are helpful for state data, but it can be modified by _____________
static constructors
263
Are static members thread safe?
Not always. In situations where static members manipulate state, they need to be synchronized.
Race conditions CAN and WILL occur in static methods and static constructors
264
Why use the .NET singleton class?
its a .NET design pattern to provide global access to an object and verify there's ONLY ONE INSTANCE.
1. Can be used as a state object!
2. create a cleaner object structure than global variables
265
Why do we do a double null check on singleton objects to make sure it's thread-safe?
1. First, the person using the object runs a check to see if an instance exists.
2. Second, it locks the object (_lockobj)
3. Third, it checks to make sure an instance doesn't exist. (This verifies there wasn't another thread creating it! thread safe!)
4. It creates a new instance.
266
What is the best implementation for a thread-safe Singleton?
Seal the class, then create a read-only instance. This allows the field to be set at the class level or in a constructor, after which it cannot be changed.
267
Why isn't an Int64 type thread safe?
If the hardware isn't robust enough, the binary representation of the number might not be assigned in a single atomic operation because it's too large.
268
Static constructors aren't thread safe if....
To fix this, _________.
they modify static state.
Synchronize static constructors.
269
Why should thread.abort() use be avoided?
Can cause the thread to exit in an unpredictable way depending on platforms/third party code.
270
How do you make dispose methods thread-safe?
Lock within dispose to make sure they aren't called by multiple threads at once
271
Security concern w/race conditions of security states.
When you persist the output of a security decision, multiple threads referencing it can create a race condition. Make sure to use those security states in a thread-safe fashion.
272
Ordinal comparison for strings is executed how?
Used to compare if two strings match and for putting lists of strings into order.
1. Ordinal means a bit by bit/character-by character matching.
2. works by comparing the individual characters in the strings based on their numeric values. (e not the same as é, numerically)
273
Culture-Sensitive comparison of strings
Culture-sensitive comparisons work to treat some sequences as the same. (for example, Resume and resumé can be compared as the same)
Use it to sort lists when strict matching isn't necessary!
274
When comparing strings, use _______ instead of == or a.Equals(b)
Use String.Compare instead
275
Don't convert string case for comparison operations, instead use
StringComparison.xxIgnoreCase
276
What is the biggest security issue w/Strings?
Strings are immutable. Once they are stored in memory, they are there until the garbage collector removes it from memory.
It's not possible to zero out/null out a string in memory or overwrite it. If you write to it again, it stores it with the variable name in a second instance. (there's two instances of "string s = blah/bill" in memory.
277
How to store passwords in memory (issues with strings)
Use arrays or the SecureString object instead.
Strings are immutable; it's a good idea to store passwords in another format other than strings, so it can be removed.
278
How is char[] used as a more secure method of storing sensitive strings?
1. Stored on managed memory stack, not heap.
1. Creates smaller attack surface, less exposure
2. Use Array.Clear() on array types that store sensitive info. Can be wiped from memory, unlike strings.
279
What is Array.Clear best utilized for?
Wiping out/clearing an array that has sensitive contents
280
Used to securely store sensitive/private info. It's automatically encrypted, and when data is extracted from it, decrypted. (Uses DPAPI)
SecureString
281
the _______ method within the SecureString object is used to permanantly erase its contents from memory.
Clear()
282
Critical flaw in SecureString, and how to overcome it
SecureString usually accepts input (say, from a text box) and stores it as a string, before storing it in a secure string.
To store a string as a SecureString, store it in a char[] array first, so that it never makes it to memory and can be wiped.
283
4 general Rules of thumb for using SecureString
Put data directly into the object
Don't leave the SecureString object until it's ready for use
Don't put it into a String object
Use APIs that accept SecureString object
284
What is a numeric overflow vulnerability?
when the bounds of a specific numeric data type can be exceeded beyond its range. It's a Validation problem, When you don't plan for what #'s you'll see.
285
What is the MSB for an Int16 short?
The bit that notates whether the value should be handled as a positive or negative number. It's the 16th bit.
286
What number range can an Int16 support? A ushort?
-32k to 32k
a ushort is 65k, but only positive numbers. (doesn't have a bit for +/-)
287
4 ways you see numeric overflows
1. Exceed the boundary. (ex: 66,000 in a Ushort register)
2. "Signed" number in an unsigned register (negative number in an Ushort)
3. "Cast" from one numeric type to another
4. "Cast" from signed/unsigned types.
288
two main causes of numeric overflows
Math operations and downcasting/converting will cause this
289
Two main exploits related to numeric overflows in managed (.NET) code
1. DoS: Try to get the app to fail to correctly handle a numeric overflow gracefully and crash. ()Flip the sign of a numeric value, for example....or overload a register with a large number
2. Logic flaws: Exercise the application in a way it wasn't meant to be exercised; like controlling the sign of a numeric value from positive to negative and getting items for free.
290
.NET prevents numeric overflows in managed code, so these overflows happen only in...
Only in unmanaged.NET. Unsafe, Process invoking, and Com interop methods
291
Two ways to turn .NET into a "checked" context
Turn it on in the compiler, or by using the checked keyword for specific operations.
(recommended that you turn it on and use "unchecked" only when necessary.
292
What is a checked context?
When working in a checked context, .NET will analyze a cast or numeric operation to determine whether a numeric overflow condition will occur, and if so, report an error
293
What is System.Math.BigMul for?
Static method that lets you safely multiply two unsigned integers together, which is stored in an unsigned long
294
Is it possible for a numeric overflow to lead to a buffer overflow in .NET?
No. Only unmanaged code can lead to a buffer overflow via numeric overflow
295
How do you perform numeric overflow checking in VB?
1. /optionstrict+ compiler option or
| 2. /removeintchecks- compiler option
296
How does .NET handle exceptions by type?
By implementing exception handling at the application layer all the way down to the method, via System.Exception.
297
Why is exception handling expensive?
The runtime will execute a stack walk to find where the exception occurred, which is computationally expensive. Checks the handler first, and then checks each method in the call in the stack.
298
Base class for all exceptions in .NET
System.Exception
299
System.ApplicationException class is used for:
user-defined exceptions specific to a given app.
300
.NET Framework's exceptions provide two things:
a human-readablpe text that describes the error, via the exception.message property
2. The state of the call stack when it was thrown, via stack trace
301
This contains a list of type-based (common) exceptions....which are generic types of errors. Directory not found, end of stream, path too long, etc.
System.IO.IOException
302
Part of the .NET framework's exception handling; contains a list of all the methods and line numbers in the source file where they were called, when something goes wrong.
Stack Trace Property
303
How try/catch blocks are used for exception handling
Catch blocks start (from top to bottom ) with the most specific error, down to the most generic. When the code in a "try" block fails, the CLR will parse through the catches until it finds one that matches. If there's a "throw" command in that catch block, it's executed instead of the exception handlers default.
304
What does the "finally" in a try/catch/finally exception handling block do?
When the code in a try/catch block runs to the end, the "finally" block does the cleanup work (and runs regardless of which catch statement executes)
305
By choosing to "throw" a catch statement with no argument, you can...
...pass an exception thrown back to the caller. (the method that invoked the code that threw the error)
306
What does wrapping exceptions let you do?
Wrapping exceptions lets you wrap each less specific into a more general one in the method above it. Each new exception is thrown for each catch statement.
Nice way to add information/nest information in a bigger error message.
307
When to use fine and coarse grained EH blocks.
"Can wrap every individual method in exception handling, but it makes the code base very dense and hard to read.
Conversely, don't use coarse grain (too general) exception handling for important code that you need specific errors for.
Find a blend of both.
308
What is the [HandleError] notation in MVC for
the first place the framework looks for how to handle an exception for an action. looks for the same notation in the controller, if not found there.
309
If a [HandleError] is found by MVC, where is the exception shown to the user?
/Views/Error or /Views/Shared/Error
310
In MVC, if an unhandled exception isn't handled by the [HandleError] annotation, where does it go next?
Will propagate up the call stack through Application_Error method, and from there it will display based on what is in the in the web.config
311
What is the in the web config for?
Last resort for MVC unhandled errors.
312
What is Page_Error for in Web Forms?
for unandled exceptions at the method-level. Try/catch blocks are not necessary.,
313
If errors aren't handled at the page level in Web Forms (asp .NET) then the last chance is at.
What are the 3 modes of this setting?
the in the web.config
1. Off: full debug provided to the user
2. RemoteOnly: full debug only provided to localhost
3. On: no debug, only custom errors provided to everyone
314
Ensure sensitive database connection information isn't displayed as debug to users through two main efforts:
1. Make sure you have a custom catch-all error defined in the of the web.config, with a defaultRedirect
2. Wrap ANY SQL(DB) access code in try/catch/finally blocks, logging sensitive info to an application log while only sending generic errors back to the user.
315
What is the "paradigm" for handling DB connections to prevent resources from being used in the case of an error AND to make sure the connection is as efficient as possible/ (3 steps)
1. When accessing a DB, open the connection as late as possible
2. Use the connection for the shortest period of time possible
3. Close the connection as soon as possible.
316
6 places that .NET apps can log to
1. microsoft event logs: not great because it's a lot of events (hard to aggregate w/o a SIEM) and it uses MS account details
2. Windows Management Events (WMI) - format that can be sent to any enterprise logging mechanism
3. Custom log (text file where specific events get written to)
4. Can be sent to the IIS log (which is already full of things like every post/get request)
5. SQL Database - can be written to a custom SQL DB
6. Email inbox - only good for critical events
317
What is a WMI event?
Windows management event: format for raising events that can be captured by other enterprise logging mechanisms
318
Problems with logging application logs to the Windows Event logs
1. Log aggregation is difficult, because centralized logging isn't available without 3rd party app or MS operations manager
2. Access to the event log is based on OS security accounts, not app accounts
3. Log size and overwrite decisions are controlled globally, can't be customized for an app.
319
5 Main "things" to log.
1. Account related (creation, deletion, mod, enable/disable, logon)
2. Logging related (Event log enable/disable, event deleted/mod, entry insertion)
3. Role related (Use of priv, application start/stop/fail)
4. Transactions (success and failure)
5. Application event (start, stop, failure)
320
If you must log sensitive info, make sure to:
truncate it or obfuscate it somehow, first
321
Nuget package that provides configurable logging functions for .et
Nlog
322
Logging to the Windows event log is really only suitable for events that
Happy infrequently
323
Problem with logging to windows event logs in web forms
Work process does not have sufficient privileges to create an event source, and the soruce must be created by an admin prior to the application start. Can only write to the application log.
324
Of the three windows logs, the default ASP .NET worker process can only write to
the app log
325
Email alerts should be employed for only
critical (infrequent) application events. Never have the email contain sensitive info.
326
How to protect yourself from dangerous code in logs
Make sure to sanitize/filter/validate log data before presenting it to a screen to avoid subjecting yourself to attacks
327
Manages the execution of all the .NET programs. Makes it language agnostic and converts compiled code into machine instructions for the CPU.
Microsoft Common Language runtime
328
For .NET, it performs memory management, type safety, garbage collection, and exception handling, as well as many other things
the MS Common Language Runtime (CLR)
329
A runtime host is...
| examples
an application that understands when the CLR needs to be loaded. Each CLR needs to be loaded into a process.
Examples include shell executables, IE, Custom hosts (managed services, written by developers) and ASP .NET
330
Runtime hosts have 4 jobs:
1. Load correct CLR
2. Load assemblies into CLR, check evidence. (Such as origin, dig sig, publisher)
3. Dynamically figure out state of evidence.
4. Unload CLR.
331
type of runtime host that can be launched from the user's environment or desktop and were create by developers in Visual Studio. Usually standalone apps.
Shell Executables
332
Located on web servers, this runtime host loads the runtime .NET aware web apps to service web requests.
ASP .NET runtime
333
Written by developers to provide managed services to apps that are a mix of unmanaged and managed code. (runtime host)
Custom hosts.
IE is an example of a runtime custom host, built by MS.
334
What are the two layers of .NET "defense in depth"
Two layers of defense; the .NET framework security layer, then the OS layer.
1. First, the application checks the user context and rights to the underlying protected resource.
2. After the app deems the user as having access to the resource, THE OS performs the same check. .NET can't override the underlying windows security.
Screen reader support enabled.
Two layers of defense; the .NET framework security layer, then the OS layer.
1. First, the application checks the user context and rights to the underlying protected resource.
2. After the app deems the user as having access to the resource, THE OS performs the same check. .NET can't override the underlying windows security.
335
How is least privilege managed w/r/t .NET apps?
Even if the operating system security permits access to a protected resource, the .NET framework also has to allow access.
336
______________________________ comes in a special form called Intermediate Language (MSIL), and are the smallest fundamental part of administration in .NET
Managed code assemblies
337
Difference between legacy code and .NET managed code
Managed code is capable of being managed, meaning it can be controlled in a meaningful way.
338
Intermediate Language (IL) is...
Also called MSIL (Microsoft Intermediate Language)
1. Platform agnostic. (x76, i386, etc. Doesn't matter)
2. Has built in memory management/buffer overflow prevention.
3. CLR can enforce access to protected resources.
4. Can be checked for inappropriate behavior before exeuction; can deny access before the assembly begins to execute.
339
Managed code "defuses" many of the traditional executable hazards, such as...
Buffer overflows
Lack of control of memory access
Ensures applications don't monopolize system memory resources....protects against memory leaks.
340
Who decides what system or network resource an assembly can/cannot access.
Admins.
341
What is Just-in-time compilation?
Software developers write programs, which are compiled into Microsoft Intermediate Language. (MSIL) MSIL is sent to consumers, which, when executed, are checked for validity/errors, then re-compiled using Just-In-Time-Compilation into native code for the processor they're using. (X86, etc)
342
What are the three main parts of an assembly?
Manifest, Managed code, and metadata.
343
How is resource access managed by assemblies?
Permissions are granted to assemblies. Code access security checks an assemblies set of permissions to govern access to resources.
344
What are the two types of assemblies?
Weak named; private, relative names, stored locally
Strong named: can be shared, have a cryptographically UNIQUE name, and can be stored in special system-defined directory.
345
Characteristics of strong named assemblies
Strong named assembles have
1. cryptographically unique names, are
2. stored in a system-defined directory
3. may be shared amongst applications. Are uniquely named and referenced.
346
PublicKeyToken (in web.config) is always null for...
weak named assemblies
347
Characteristics of weak named assemblies
Also called "Partially" named assemblies.
1. Are not visible or used by more than one application, 2. must be stored in the application root directory.
3. They do not use all four elements of the assembly name, thus, "weak/partial" named.
Referenced only by it's "friendly" name. (relative name, only unique for the app)
348
Weak named apps are referenced only by
their relative name, which is unique only for the app
349
For an assembly to be shared, it must be located in a system-mandated location called
The Global Assembly Cache. Only for strong named apps
350
5 steps for creating a strong named assembly
To sign code (strong named) with a public key. (Creating an integrity check)
1. The public key is embedded in the assembly metadata. (manifest)
2. The whole assembly is hashed to create a "fingerprint"
3. The hash is encrypted with the vendor's private key, creating a digital signature.
4. The signature is embedded in the assembly. (DLL)
5. Assembly distributed to consumers.
351
An assembly's manifest contains its
public key
352
Integrity on strong named keys is established by
a hash of the of the assembly, signed by the vendor's private key, and then embedded in the assembly with the vendors PUBLIC key.
353
In order for the runtime to verify a vendor's identity via it's digital signature, it uses the _______, also shipped with the assembly
the vendors public key
354
Once an assembly is launched, the runtime runs the following 6 steps to verify it's integrity
1. Extract the public key from the manifest
2. Regenerates the hash of the assembly
3. Extract the digital signature, and uses the public key to decrypt it
4. Get original hash generated by the software dev (the software hash+public key)
5. Compare the runtime hash against the hash recovered from the digital signature. If they match, the integrity is established
355
What is a public key "token" and why is it used?
Used by developers; public key token uses the last 64 bits of the SHA-1 hash of the public key, versus the full 1024 bit public key, for ease of use/admin overhead reduction
356
Side-by-side execution.
When multiple versions of the same assembly can exist on the same computer without disruption or confusion
Possible because of strong named assemblies.
357
Flaw in strong naming assemblies
Any attacker can grab a strong-named assembly (as long as it's publicly accessible) and sign it with THEIR private key, then have the runtime's integrity check succeed.
Only way to ensure protection is if the original developer transmitted their public key out of band.
358
This strong named utility will let you create the key pair required for naming the assembly, or you can use this API.
sn.exe, provided with .NET
Microsofot crypto API (CAPI)
359
Once you create a key pair for a strong named assembly, where do you have to reference it?
the Assembly's source code (specifically, the AssemblyInfo file)
360
The GAC was basically replaced by
NuGet packages
361
4 limitations to strong-named assemblies
1. No third party validation.
2. If the private key is compromised, you can't revoke the key.
3. Signed assemblies cant reference/invoke unsigned assemblies.
4. Can't strong name EXE's. If you do they wont be able to reference any weak-named DLL's that are deployed with the app.
362
Problems with self signed code
Despite signing with a private key, it's still a self signing process. No third party verification.
Hard to keep private key storage....private.
Unlike with HTTPs (x.509v3, which binds a user's identity to a pub key) a third party doesn't verify that the private key belongs to the entitity for code signing.
363
_____________ is a third party verification of a private key's authenticity.
authenticode
364
The GAC is located at
%systemroot%\assembly and requires admin access.
365
The GAC is a good place for
Good place to keep core libraries; things to that do validation, encoding, etc.
366
Type safety is...
strict control of memory access; types cant reach into another type's memory space to muck around
367
_______________ is critical to enterprise security. Apps need to act in a predictable manner, or it can lead to crashes or exploits.
type safety
368
Microsoft's solution to prevent untrusted code from performing privileged actions.
Code Access security, which is ONLY POSSIBLE with MSIL verification.
369
MSIL verification is...
1. Cornerstone of .NET security; checks code before executing to ensure that it is type safe and properly formatted. Will throw an exception if it's not.
2. Can skip this verification, which lets excepted (not type safe) code execute anyway. Dont do this.
370
What is reflection?
Allows programs to access an assembly's internal information. (functions, fields, object metadata/properties)
"find all the properties decorated with this attribute"
utilities exist that can encrypt information in the ""get"" and ""set"" fields?"
Basically, deconstruct compiled code and give source.
371
Why is dependency management a security concern?
OWASP Top 10 (A9) - Using components with known vulnerabilities
70% of the source code powering an application we did not own, and we did not write. 70% in .NET coming from NuGet packages. Can't scan and change those components.
Components, such as libraries/frameworks/modules/API, almost always run with full priveleges....Applications with known vulnerabilities may undermine app defenses and enable a wide rage of attacks and impacts
372
How to handle 3rd party code.
Put a process in place that catalogs all the 3rd party code, and automate the process of being alerted for vulnerabilities in that code.
373
Utility that ships with .NET SDK and parses assembly info into human readable form (browse assembly logic, turn into source)
ILDASM
374
Something installed into the runtime (CLR) that looks for anomalies. If it sees something out of the ordinary, might block it in the CLR.
Runtime Application Security Protection. RASP
375
Difference between SOAP and REST API?
SOAP typically uses XML messages to pass info back and forth.
REST APIs typically communicate using JSON.
376
Flaw with WSDL files
Usually, WSDL (Web Service Definition Language) files are deployed in production, which gives attackers a document describing the operations and message formats for web services. For JS, the swagger service provides similar interface details to a WSDL.
1. Shows all the methods and parameters for using those APIs. (guide to manipulating them)
377
AJAX security flaws
Trivial to capture an AJAX call and reply/fuzz, and manipulate them.
Zap, Burp, and SoapUI have built in support for scanning and fuzzing web services.
378
WCF is a framework for building....
WCF is a framework for building service oriented applications. (API) It's a configuration for how consumers of data interact with your application.
Builds small, simple apps that perform a purpose.
379
How do WCF apps communicate?
Data can be sent as async messages between endpoints. (API style) Secure, reliable, and scalable messaging.
380
What is a WCF "contract"
The interface (IService) that defines what happens when the API is used. (List of the methods the interface will utilize)
381
Three ways to "bind" a WCF service. (operation modes)
1. webHttpBinding: For REST APIs. Client will access a URL which will give him an XML/JSON response.
2. basicHttpBinding: old SOAP 1.1 or .asmx binding: light weight, misses a lot of security options.
3. wsHttpBinding: advanced SOAP 1.2+ binding. Can only be consumed by .NET 3.5 or later. Has transport and message security options.
382
What is the most secure WCF service binding mode? least secure?
Most secure: wsHttpBinding, which is advanced and has transport/message security options.
Least secure: BasicHttpBinding, which is an old Soap 1.1 or .asmx binding. lightweight, not secure.
383
WCF service can be secured via _________ options in the binding configuration
For wsHttpBinding, you can set the security mode, transport client creds, and message client creds.
384
Some of the client credential options that can be used for the WCF service bindings are
1. Basic
2. Certificate
3. Digest
4. NTLM
5. Windows (intranet)
385
What does a WCF credential config option set?
Set in WCF Binding. Establishes what the client of the service (API) will use for a credential.
1. Certificate,
2. UserName
3. Windows Auth
4. Issued Token (SAML) for federated ID
386
Configuration that controls whether the WSDL (Web service breakdown) is publicly accessible. Best to transmit that to consumers out of band versus directly in app.
WCF serviceMetada
387
Service configuration for WCF that turns verbose error messaging (debug info) to the client on, when set to true. For production apps, set to false.
WCF serviceDebug
388
Turns on auditing for WCF services, and sends them to the windows event log. Should be enabled for service auth and message auth for successes and failures.
WCF WCF SecurityAudit
389
Modern platform for FOR data exchange that uses REST, usually via JSON.
Web API
390
Security concerns regarding Web API usage
By default, doesnt do: data validation, error handling, authentication/authorization, CSRF, Transport layer encryption.
391
Why is Web API vulnerable to validation-type attacks, and how do you prevent them?
Web API validation is not enabled by default, and it's vulnerable to validation attacks until it's enabled.
Use model state to prevent validation problems. Standard data annotations, like MaxLength, Range, Phone, Email address, etc. will allow you to create a validation type for an input field, and if it fails that validation, it reports to the ModelState and ModelState is no longer valid.
392
Option for preventing validation style attacks for Web API
Add appropriate standard data annotations, like MaxLength, Range, Phone, Email address, etc. This will allow you to create a validation type for an input field, and if it fails that validation, it reports to the ModelState and ModelState is no longer valid.
393
____________ uses the same "auto-binding" process as MVC, and can be vulnerable to overposting and underposting attacks attempting to set unauthorized properties on the model object.
Web API
394
Why creating an action filter to check model state for Web API is smart
It's hard to remember to have model.state checked for every single Web API call, so it's easier to centralize the logic in the OnActionExecute() method, and then register the filter in the global config. (WebApiConfig)
395
Why you should set Web API error handling
It's not enabled by default; exceptions will be thrown directly to the JSON.
Create conditions in methods that will present custom errors rather than letting the null stack trace bubble up to the user.
396
Gives you global error handling on ALL API CALLS.
reate a custom global error, just like with SOAP, that logs every error to a specific location and instead presents a custom message.
you inherit the ExceptionFilterAttribute and have it perform an action with the OnException event. (It logs to the log file and throws a "an exception has occured") error.
397
How authentication is done for web APIs
Not enabled by default.
```
Can set custom auth modes via:
.NET Identity
social logins (facebook),
Forms
Windows,
HTTP basic auth. (Use HTTPS to encrypt the transport) Starts with the authentication it has from the application cookie.
```
398
How authorization actions are done for Web API
Authorization is done by using the [Authorize] annotation, and decorating the entire feedback controller with it.
Can use the "user" and "role" parameters to further restrict to specific users, or set specific methods to [AllowAnonymous] after using [Authorize] as a deny all.
399
Setting a deny all for Web API authorization
In the WebApiConfig.cs, add a filter to deny all.
Config.Filters.Add(new AuthorizeAttribute());
This denies all access, and lets you set granular control to users and roles.
400
How to defeat CSRF in Web API
1. Include AntiForgeryToken in the view, add the value to the DOM.
2. Ensure client side JS reads the token from the DOM, and adds it to the AJAX request header.
3. Service side API must validate the anti-foregery token value in header and cookie, make sure they match.
401
Used to establish minimum acceptable levels of security and privacy quality
Quality gates/Bug Bars
402
What does a quality gate establish?
Same as a ""bug Bar"" minimum level of acceptable security and privacy.
Establishing risk tolerance. ""Everything above a low must be fixed"
403
What is a privacy assessment?
Conducted during the requirements phase; analysis of the data in the system, and whether it's private or sensitive. (Credit card? PII? is it going to be encrypted, or should it be?)
Requires an understanding of what privacy policies exist.
404
What is a STRIDE report/metric?
What are the levels?
STRIDE is a way developers and QA folks can categorize bugs in code. It stands for:
Spoofing, Tampering, Repudiation, Info Disclosure, DoS, and Elevation (of Privilege). (STRIDE)
Critical, Important, Moderate, Low, or None.
405
What is a threat model "exploit"
A threat, with intent to harm, actually leveraging a vulnerability.
406
What is the "dread" ranking?
Dread is a ranking mechanism for threats. You give each subcategory a ranking (1-10) and then average them out.
```
Damage Potential
Reproducability
Expoitability
Affected Users
Discoverability
```
Older system, based on "gut feels" which is insufficent.
407
How is the OWASP risk rating for a vulnerability determined?
Risk = likelhihood * impact
408
3 techniques for secure code review
manual code, keyword searches, and static analysis.
409
3 groups who conduct code reviews
Manual Review: by developers, security team (bi-annual or so), or consulting firm. Time consuming, and requires a high level of expertise. Keep use of automated tools to high-end, critical stuff.
Peer review: Only by developers. Only looking at the code changes and affected code; small scope, needs less time, but relies on security knowledge of reviewer.
Security group review: only by security group, looks at the whole application. Lengthy, expensive, requires a high level of security knowledge, and takes time to understand whole app. Make sure findings go into backlog, not a pdf assessment.
410
Problem with dynamic testing results
Doesn't provide line numbers; is an issue or is not.
411
What is the most effective way to verify that the format of a data field matches a phone number?
Annotations or regex
412
You have recently finished the development of an application. The application
can be used only for cryptography. Therefore, you have implemented the application on a
computer. What will you call the computer that implemented cryptography?
A cryptosystem
413
You are creating an ASP.NET Web application using .NET
Framework 3.5. The application will be used to share any type of photos on Internet. All the photos
should be accessible in various sizes and formats. You need to add a download feature that can
be easily maintained. You also need to make sure that only a single version of all photos is stored on a SQL server database. What will you do?
Create an HttpHandler class to determine the request for the photo download.
414
Which modifiers in C# will you use if you do NOT want a custom-build component
to be a base class?
sealed
415
Which attributes of the customErrors element are used to specify whether custom
errors are enabled, disabled, or shown only to remote clients?
Mode
416
What is the main purpose of a try-catch block?
To catch and handle an exception generated by an executable code.
417
```
Which of the following is the best encryption algorithm to encrypt and decrypt messages?
AES
TripleDES
DES
RSA
```
rsa
418
You create an application using .NET
Framework 3.5. The application represents a WCF service. The service will be consumed by
clientside code that runs in the Web pages of an ASP.NET AJAX application. You must ensure
that data serialization between the service and the application acquires least amount of latency.
Which data format will you use to accomplish this?
A. Extensible Application Markup Language
B. JavaScript Object Notation
C. Extensible Markup Language
D. Really Simple Syndication
B. JavaScript Object Notation (JSON)
419
You create an ASP.NET Web application named
MyWebApplication. You want to provide secure access to company's customers. You want to
enable users to access the site from any browser by providing their user name and password.
Which of the following authentication methods will you use to accomplish this task?
A.Windows NT
B.. Secure Socket Layer
C. Basic
D. Single Sign-On
E. Certificate Server
C. Basic
420
You use the Regex class in the application to validate some strings. You want to search an input string for an
occurrence of a regular expression. Which of the following methods of the Regex class will you
use to accomplish the task?
A. Match
B. Matches
C. Equals
D. IsMatch
A. Match
421
Declarative security syntax uses ________ to place security information into the ________ of your code.
attributes, metadata
422
```
You create a logging utility class using .NET
Framework 3.5. The utility class writes logs to event log services. You are required to ensure that
the client applications that use the utility class can create an instance of the utility class only if they
have access rights to write to the event log services.
```
What security will let you access the event logs?
Code access security
423
Your .NET 3.5 application has a form that accepts a user name and email address. You want to validate the
input text for the email address by matching against a pattern defined in the regular expression. What validator control does this?
A. RegularExpressionValidator
424
You create an application using Visual Studio
.NET. You write code in the application and execute it, but it caused an error. Now, you want
to find out the reason that has thrown the exception. Which of the following properties will you use
to accomplish this task?
```
A. Message
B. TraceSwitch
C. Data
D. Source
E. StackTrace
```
E. StackTrace
425
You are developing an application using .NET Framework 2.0.You are required to use a datatype that will store only the numbers. The numbers should be in
positive form and should not be larger than 65,535. Which of the following datatypes will you use to accomplish the task? (pick 2)
```
A. System.UInt16
B. ushort
C. System.Int16
D. int
E. short
```
A. System.UInt16
| B. ushort
426
What is Content Security Policy for?
Lets application admins create a whitelist of trusted sources. (Images, frames, scripts, object sources; anything with src=)
427
What is Null Byte injection?
Attackers Inject a null byte (%00) into an application that results in a string being terminated early. Can be used to bypass validation routines, or inject dangerous input.
428
Two factor authentication is more secure than any one factor because
multiple things need to be known or possessed. A smart card with a pin makes use of something you have and something you know.
429
```
You want to enable application users to access a site from any browser by providing their user name and password. Which of the following authentication methods will you use to accomplish this task?
A.Windows NT
B.Secure Socket Layer
C.Basic
D. Single Sign-On
E. Certificate Server
```
Basic
430
He wants to secure the application by using the most
secure authentication method. The method should have a strong key for encryption and send the
encrypted password across the network. Which of the following authentication methods will Allen
use to accomplish the task?
A. Integrated Windows authentication
B. Basic authentication
C. Certificate-based authentication
D. Digest authentication
C. Certificate-based authentication
431
Three things to look for when using the singleton class (keywords)
Sealed, public static, readonly.
```
class MySingle
{
private MySingle() {}
public static readonly MySingle Instance = new MySingle();
```
432
aspnet_regiis.exe is used for
encrypting the web.config in .NET 2.0+
433
aspnet_setreg.exe is used for
encrypting the web config in versions 2.0 or earlier.
434
If using RSA to encrypt the web config, every server in the farm needs to have
a copy of the key, so they can decrypt the pertinent sections of the web.config
435
In addition to authenticating the user, what must an application do prior to calling FormsAuthentication.RedirectFromLoginPage()
The return URL must be validated to ensure it points at an expected URL
436
What .NET entity initially recieves HTTP requests and determines how to respond?
IIS
437
The RegularExpressionValidator does not run when the input field
is blank
438
All validators must return to the _________ and run a ______________ validation by definition.
SOURCE PAGE, server side
439
Public key tokens are generated from...
are derived using the low-order 64 bits of the SHA1 hash of the public key.
440
Wrapping exceptions may be permissible if
the original exception would not make sense to the caller.
441
If HSTS (strict transport security) is set and include the "include subDomains" option, what will happen as child domains are added to the main site? (Ie, if http://public.sans.org is added to https://sans.org)
The includeSubDomains option will force all domains in the sans.org website to be accessed securely (using https://), which will block standard http access to http://public.sans.org.
The Strict-Transport-Security (HSTS) header forces the browser to access the website using a secure transport (https).
442
Special characters should be wrapped in quotation marks to help defend against...
Command injection
443
A DOM based XSS attack can be parsed by the client's javascript, meaning from a validation standpoint...
it does not require server interaction to execute. (skips the server to execute on the client)
444
During the design phase of the SDLC, conduct a ________ to identify high-risk areas in an application that need to be reviewed for vulnerabilities
An attack surface analysis
445
When setting a link.Text property, that dynamically adds a URL target, _________ should be used on the target field to prevent XSS
HTML encoding
446
Vulnerabilities must have associated _______________ to pose a risk.
threats AND missing or incomplete countermeasures
Without a threat, the vulnerability has no actor to exploit it.
447
Always verify that validation was successful by the ModelState.IsValid property, which is used by ______ and set during ________
MVC, set during MVC Model Binding.
448
What is declarative security?
Uses attributes to place security information into the metadata of your code. This has to be done at complile time.
449
HTTP Handlers are generally there to perform authorization based what two things?
URL and verb
450
prodID = Regex.Replace(prodID,"[^\\d]",""); would accomplish what?
the first regular expression which removes everything except numeric data from prodID is correct.
451
By setting the response encoding (UTF/ISO format of the response) you're protecting against _________ by limiting the attacker.... how?
by setting the response encoding, the browser is informed of the appropriate character set, limiting the ability of an attacker to leverage canonicalization and multi-byte character sequences to perform cross-site scripting attacks.
452
Which of the following should be considered untrusted and filtered/validated appropriately?
A) A webservice hosted by a 3rd party
B) The database used by the application.
C) Querystring parameters.
D) Data contained within a configuration file.
All. Even configuration file data should be validated/considered untrusted.
453
the ______ should be checked in ASP. NET to make sure that all the validation logic on the page is valid
The Page.IsValid property. It can only be checked AFTER calling Page.Validate(). However, Page.Validate() is called automatically if the server control has CausesValidation set to true (which is the default value).
454
What is required (#1 item) for secure authentication?
Reliable verification of user credentials
455
What .NET identity class tracks user login failures for lockout purposes?
Application User
456
Using ASCII characters as crypto keys is..
Not good. Considered a Weak Crypto Key vulnerability. These values do not use the full key space and should use a secure random number generator or PBKDF to generate the values.
457
A 32 byte AES key would be a __________ key length, because...
Good, full 256 bit key
458
What does AntiXSS/WPL encoding provide that the standard HtmlEncoder class does not?
Whitelist Validation. Default encoding library uses a blacklist validation, while the other two libraries use whitelist validation
459
Why would you not want to log to the IIS log?
IIS can only log one string per event. It can NOT append multi-line log entries.
460
Assembly 1 is called by assembly 2 and assembly 3. If all three assemblies are written by different vendors, which of the following must be part of the application configuration?
Assembly 1 must be in the GAC.
An assembly located in the GAC is by definition shared and strong-named, whereas private assemblies-even if given a strong name-are stored in any location other than the GAC and are accessible by a single application only
461
Using a Least-Privileged Database Account will minimize the harm from...
from a SQLi attack
462
Using HTML and URL encoding will not prevent SQL injection or decrease its risk (true/false)
TRUE
463
What happens if a user is authorized by role and then subsequently denied access by name in the section
They'll get access. At run-time, ASP.NET iterates through the authorization elements until it finds a match. Any subsequent authorization elements are ignored.
464
What is the risk associated with setting EnableCrossAppRedirects in Web.Config to true?
Allows for open redirect attacks
465
What are two methods to prevent cookie replay attacks?
HttpOnly cookies and forms authentication would prevent any client script from accessing the cookie thus helping in mitigating the risk of cookie replay attacks
466
Which session mode does NOT provide any authentication method between the application and the session state store provider and therefore does not protect the session data against modification or exposure?
State Server mode. (provides no auth between app and state server)
467
Session timeout values are stored in what increments?
minutes
468
The "
HtmlEncode the contents of a variable that is inline
469
What setting allows for posting back of HTML from the "body" field?
You have to set the entire page to not validate. ValidateRequest=""False"" in a page directive.
.net 2.0 - 3.5 applications do not allow field level exclusion from Request Validation, so the entire page must be removed from validation. Request.Unvalidated and Feedback.ValidateRequestMode are only available in .net 4.5
470
For culture agnostic string comparisons, use
StringComparison.Ordinal
471
The best hashing algorithm to use for a long term password
SHA 512
RIPEMD, MD5 and SHA-1 have all had proven weaknesses in the collision properties, and therefore should be considered insecure for most applications of hash functions.
472
What is the correct description of ASP.NET’s ValidateRequest feature?
A blacklist validation mechanism that ensures known bad character sequences are not present within request parameters.
473
Can a SecureString be converted directly into a standard string type?
no
474
What can ASP .NET do to prevent client side tampering of cookie info?
Encrypt the cookie with the application's machine key.
475
ASP.NET encrypts the ______ fields in the cookie so that it cannot be viewed or modified
Role Data
476
What is the first thing MVC does when an exception is thrown?
The action is searched for [HandleError] annotation
477
You create an ASP.NET Web application using .NET
Framework 3.5. The application rarely experiences errors that cannot be reproduced on a test environment. You are required to ensure that the application meets the following requirements:
l All unanticipated errors are logged.
l Logging is configured with a least amount of alteration to the application code.
What will you do?
A. Override the base class for all forms in the application to add the Try/Catch blocks to all the major
functionalities.
B. Enable the element in the Web.config file and set the mode attribute to On .
C. Enable the element in the Web.config file and set the mode attribute to
RemoteOnly.
D. Add an event handler for the Application.Error event to the Global.asax file of the application.
D. Add an event handler for the Application.Error event to the Global.asax file of the application.
478
```
You create an unsigned Short datatype in the application. Which of the following values can be
assigned to the unsigned Short datatype?
Each correct answer represents a complete solution. Choose three.
A. 123
B. 65,535
C. 127,625
D. 32,636
E. -123
```
A, B, D
479
You need to
validate names for the application with three characters that are either "hat" or "cat". Which of the
following regular expressions will you use to accomplish the task?
A. [hc]at$
B. ^[hc]at
C. [hc]at
C. [hc]at
480
What legacy classes limits the number of threads that can access a resource or pool of
resources concurrently?
semaphore
481
```
Which class allows checks against the active principal using the language constructs defined for
the declarative and imperative security actions?
```
PrincipalPermission
482
MyWebApp1, using Visual Studio .NET. One of the pages in the application is named as
Page1.aspx, which does not need to maintain session state. To improve the performance of the
application, To disable session state for just one page, how would you do this in ASP .NET?
Set the EnableSessionState attribute in the @ Page directive to false.
483
One of the TextBox controls on a page is named txtZipCode in which a user enters a Zip code. Developer wants to ensure that when a user submits the a zip code on page, txtZipCode must contain
five numeric digits. He wants the least development effort. Which of the following validation controls
will he use to accomplish the task?
Each correct answer represents a part of the solution. Choose all that apply.
A. CompareValidator
B. RequiredFieldValidator
C. RangeValidator
D. RegularExpressionValidator
B. RequiredFieldValidator
| D. RegularExpressionValidator
484
Dev works as a Software Developer for a company. He creates a class, named MyClass1. He
wants to generate a key pair that he will use to give the compiled assembly a strong name. What tool does this?
sn.exe
485
You are assigned with developing a Web site
You wish to secure the Web
site so that only employees of the Accounts department can view the Web pages. You need to
create roles for the employees of this department. The user account information will be stored in a
SQL Server database named Database. You decide to do all this by using the Web Site
Administration Tool. Which of the following types of security will you use to accomplish the task?
A.Forms-based authentication
B.Integrated Microsoft Windows authentication
C.Basic authentication
D.Digest authentication
Forms auth
