I received results back for an ethical hack assessment for one of my asp.net webforms sites. One of the items was a multi step way the hacker changed the request to display a page he shouldn’t have had access to with his user privileges. Below are the steps he performed to execute the hack:

1) logged in using Admin level rights.
2) navigated to page ‘A’.
3) using his Burp tool, saved a copy of the page headers.
4) he then logged in using a User account which shouldn’t be able to see page ‘A’.
5) goes back to the home page to get a fresh request.
6) using his Burp tool, opens the request headers for the home page and replaces them with the contents he saved from page ‘A’.
7) he continues on with the request and is now able to see the contents of page ‘A’.

I tried to programmatically check the request.url and compare it against what pages the user has access to but the hacker said that didn’t fix it.

Is there a built in way to prevent this in ASP.NET 4.x? Is there some web.config property I can set to stop someone from changing the request headers and performing this kind of hack?

Ethical Hack Changing Request Headers to Access Restricted Page ASP.NET

How can I create request ID in POST API and log it

I am sending POST request to API and getting response but API do not reply any request ID, is there a way I can have request ID that I can generate after sending POST & log in a txt file for reference in case anytime request is not processed I can send request ID to API owner and get response file for my request ID

I have a table in SQL Server that have a NOT NULL Column that uses a SEQUENCE as default (NEXT VALUE FOR SeqDefa), that column is not the PK from the table.

I building a web form in ASP.NET that does a CRUD in that table, when i want to send a null value in that column to use the default in that table i get an error. that's because LINQ says that you can't send a null value to a not null column

can i get the sequence´s next value from LINQ in my form? there's another option than changing table column from not null to allowing nulls?

webforms

Trending Blogposts on webforms

Popular Discussions on webforms

openEthical Hack Changing Request Headers to Access Restricted Page ASP.NET

0

0

0

openHow can I create request ID in POST API and log it

1

0

0

openHow to send a null value to a not null column in ASP.NET with LINQ

1

0

0

PRODUCTS

QUICK LINKS

LEGAL