The Code Behind The Vulnerability
summary
Covers real, fixed ASP.NET bugs with concrete root causes and fixes: a hash-collision DoS caused by predictable GetHashCode values (fixed by randomized seeding), a padding oracle leak that lets attackers recover web.config and forge auth cookies (fix: authenticated encryption), several BinaryFormatter RCE cases (Exchange, Docker, ViewState misuse) plus regex backtracking DoS, XSS from HTML.Raw/over‑binding, CSRF via GETs, host‑header password‑reset hijack, and culture/string‑compare pitfalls; recommends sign‑then‑decrypt, avoid BinaryFormatter, set regex timeouts, validate host headers and never trust database or user input.
AI-written summary · about
chapters (5)
- 0:00Start
- 4:28Hash Dos (CVE-2011-3141) A Denial of Service caused by parsing FORM inputs Caused by Hash Table and Dictionary using a predictable hash algorithm for string keys Fored by switching hash functions to one that is unpredictable or limiting dictionary size
- 10:20How can I fix this? Don't use user input as keys in dictionaries unless The user input is a string OR The HashCode for the input is strong and you implement a session key eg. SHAIHMAC with a random key set at runtime.
- 44:26Nation state attack WSDL is metadata for SOAP endpoints. Used to generate proxy objects Did you know NET Framework has a WSDL parser which generates code?
- 46:53Mistrusting user input (CVE-2018-0787) UrlHelper contains a of methods for generating URLS Including absolute URLS With hosts The host comes from the Host Header Which is browser controlled ...
