Security :: Insert Hash Password Into Sql Server 05 And Logging In Against It

Nov 15, 2010

I am trying to insert a string and random number into the database as hash sha1 then loggin in against it. the problem is if I use hash it wont login but if i dont use hash the login works fine... Code below.

insert hash into db
Dim user As New Label
user.Visible = False
user.Text = (myDataReader2.Item("username"))
MyConnection2.Close()
Dim MyConnection3 As New Data.SqlClient.SqlConnection("Data Source=xxx")
Dim mycommand3 As New Data.SqlClient.SqlCommand("Update Register SET [Password] = @password WHERE [username] = '" & user.Text & "' AND [email] = '" & email.Text & "'", MyConnection3)
Dim pass As String
Dim rnd As Integer, randomNum As New Random
rnd = randomNum.Next(1000, 10000)
pass = "Pass" & rnd
mycommand3.Parameters.AddWithValue("@password", FormsAuthentication.HashPasswordForStoringInConfigFile(pass, "SHA1"))
MyConnection3.Open()
mycommand3.ExecuteNonQuery()
login page
Sub Application_AuthenticateRequest(ByVal sender As Object, ByVal e As EventArgs)
' Fires upon attempting to authenticate the use
If Not (HttpContext.Current.User Is Nothing) Then
If HttpContext.Current.User.Identity.IsAuthenticated Then
If TypeOf HttpContext.Current.User.Identity Is FormsIdentity Then
Dim fi As FormsIdentity = CType(HttpContext.Current.User.Identity, FormsIdentity)
Dim fat As FormsAuthenticationTicket = fi.Ticket
Dim astrRoles As String() = fat.UserData.Split("|"c)
HttpContext.Current.User = New GenericPrincipal(fi, astrRoles)
End If
End If
End If
End Sub
Protected Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs)
Dim myConnection As New SqlClient.SqlConnection
Dim myCommand As New SqlClient.SqlCommand
Dim intUserCount As Integer
Dim strSQL As String
myConnection = New SqlClient.SqlConnection("Data Source=jrome2.db.4961680.hostedresource.com; Initial Catalog=jrome2; User ID=jrome2; Password=Richard050283;")
strSQL = "SELECT COUNT(*) FROM Register " _
& "WHERE UserName='" & Replace(txtusername.Text, "'", "''") & "' " _
& "AND Password='" & Replace(txtpassword.Text, "'", "''") & "';"
myCommand = New SqlClient.SqlCommand(strSQL, myConnection)
myConnection.Open()
intUserCount = myCommand.ExecuteScalar()
myConnection.Close()
'Response.Write(intUserCount)
If intUserCount > 0 Then
FormsAuthentication.Initialize()
Dim strRole As String = AssignRoles(txtusername.Text)
'The AddMinutes determines how long the user will be logged in after leaving
'the site if he doesn't log off.
Dim fat As FormsAuthenticationTicket = New FormsAuthenticationTicket(1, _
txtusername.Text, DateTime.Now, _
DateTime.Now.AddMinutes(30), False, strRole, _
FormsAuthentication.FormsCookiePath)
Response.Cookies.Add(New HttpCookie(FormsAuthentication.FormsCookieName, _
FormsAuthentication.Encrypt(fat)))
Response.Redirect(FormsAuthentication.GetRedirectUrl(txtusername.Text, False))
Else
login.Text = "Incorrect Log In Information"
End If
End Sub
Private Function ValidateUser(ByVal strUsername As String, ByVal strPassword As String) _
As Boolean
'Return true if the username and password is valid, false if it isn't
Return CBool(strUsername = " & Replace(txtusername.Text, " AndAlso strPassword = " & Replace(txtpassword.Text, ")
End Function
Private Function AssignRoles(ByVal strUsername As String) As String
Dim myConnection As New SqlClient.SqlConnection
Dim myCommand As New SqlClient.SqlCommand
Dim intUserCount As Integer
Dim strSQL As String
myConnection = New SqlClient.SqlConnection("Data Source=jrome2.db.4961680.hostedresource.com; Initial Catalog=jrome2; User ID=jrome2; Password=Richard050283;")
strSQL = "SELECT COUNT(*) FROM Register " _
& "WHERE UserName='" & Replace(txtusername.Text, "'", "''") & "' " _
& "AND Password='" & Replace(txtpassword.Text, "'", "''") & "';"
myCommand = New SqlClient.SqlCommand(strSQL, myConnection)
myConnection.Open()
intUserCount = myCommand.ExecuteScalar()
myConnection.Close()
'Response.Write(intUserCount)
If intUserCount > 0 Then
Return "client"
Else
Return String.Empty
End If
End Function
Protected Sub LinkButton1_Click(ByVal sender As Object, ByVal e As System.EventArgs)
txtusername.Text = String.Empty
txtpassword.Text = String.Empty
End Sub

View 1 Replies


Similar Messages:

Security :: Compare The Hash Password

Feb 15, 2010

i m trying to change my password. the password in database is in hash formatting. the class FormsAuthentication. is using for hash conversion. the password is indicating the same in if condition. but after if applying it suddenly go on else part , even the value on if condition is same.

View 2 Replies

Store Hash Password In SQL Server?

May 13, 2010

Is this how hashed password stored in SQL Server should look like? This is function I use to hash password (I found it in some tutorial)

public string EncryptPassword(string password)
{
//we use codepage 1252 because that is what sql server uses
byte[] pwdBytes = Encoding.GetEncoding(1252).GetBytes(password);
byte[] hashBytes = System.Security.Cryptography.MD5.Create().ComputeHash(pwdBytes);
return Encoding.GetEncoding(1252).GetString(hashBytes);
}

EDIT: I tried to use sha-1 and now strings seem to look like as they are suppose to:

public string EncryptPassword(string password)
{
return FormsAuthentication.HashPasswordForStoringInConfigFile(password, "sha1");
}
// example output: 39A43BDB7827112409EFED3473F804E9E01DB4A8

Result from the image above looks like broken string, but this sha-1 looks normal....

View 1 Replies

Security :: Recreate A Md5 Hash That Will Be The Equivalent Of The Hash That Php Would Generate

May 19, 2010

Hopefully someone knows a way to fix this issue, but here is my problem. I need to be able to recreate a md5 hash that will be the equivalent of the hash that php would generate.

The encoding I have tried is listed below. None of these will produce the same values.

UnicodeEncoding

UTF7Encoding

UTF8Encoding

UTF32Encoding

View 6 Replies

Security :: Form Aunthetication / Show Admin Pages Only After Logging In A Form With Username And Password?

Jan 27, 2010

Me with C# asp.net

I want to show the admin pages only after logging in a form with username and password and also want to logout from the admin pages, if in the browser history select a admin page after logout it should not be shown

how can I do it.

View 1 Replies

Active Directory Authentication / How To Hash Password

Feb 12, 2011

I'm using the code below to authenticate a user in Active Directory, but the password is sending in clear text. How can I hash my password and then send it to Active Directory?

DirectoryEntry entry = new DirectoryEntry(path, username, pwd);
try
{
//Bind to the native AdsObject to force authentication.
object obj = entry.NativeObject;
DirectorySearcher search = new DirectorySearcher(entry);
search.Filter = "(SAMAccountName=" + username + ")";
search.PropertiesToLoad.Add("cn");
SearchResult result = search.FindOne();
if (null == result)
{
return false;
}
//Update the new path to the user in the directory.
_path = result.Path;
_filterAttribute = (string)result.Properties["cn"][0];
}
catch (Exception ex)
{
throw new Exception("Error authenticating user. " + ex.Message);
}
return true;

View 1 Replies

Generate Membership Password Hash In Pure TSQL

Feb 17, 2011

I'm attempting to create a pure t-sql representation of the default SHA-1 password hashing in the ASP.Net Membership system. Ideally, what I would get would be this:

UserName Password GeneratedPassword
cbehrens 34098kw4D+FKJ== 34098kw4D+FKJ==

Note: that's bogus base-64 text there. I've got base64_encode and decode functions that round-trip correctly. Here's my attempt, which doesn't work: SELECT UserName, Password, dbo.base64_encode(HASHBYTES('SHA1', dbo.base64_decode(PasswordSalt) + 'test')) As TestPassword FROM aspnet_Users U JOIN aspnet_membership M ON U.UserID = M.UserID

I've tried a number of variations on the theme, to no avail. I need to do this in pure T-Sql; involving a console app or something like that will double the work. So if anyone can supply what precisely the syntax should be to duplicate that password from the ASP.Net membership stuff

View 2 Replies

VS 2010 - Hash Password For Storing In Config File

May 31, 2012

I use this code to use in login

Code:
FormsAuthentication.HashPasswordForStoringInConfigFile(txtPassword.Text, "SHA1")

My question is how about, i how can convert into a string where it display the user password so that i can send it to the user when he/she forgot it?

View 1 Replies

Security :: Logging In, Logging Out And Still Logged In?

Jan 12, 2011

I think my subject line explains my problem in a nutshell.. I have a login page, I login like I should and everything works.I logout and when I type/paste the address to the page, in the address field, I still reach it just like if I was still logged in..The page I type in the address field is in a subfolder, only suppose to be able to be reached by logged in users and in this folder,ith it's own web.config-file:

<?xml version="1.0"?>
<configuration>
<system.web>

[code]...

View 9 Replies

Security :: Change Password Not Functioning / Password Incorrect Or New Password Invalid

Mar 14, 2011

I can recover my password but when I try to change my password to something a bit easier to remember it gives me:

Password incorrect or New Password invalid. New Password length minimum: 7. Non-alphanumeric characters required: 1.

View 7 Replies

Security :: MD5 Hash Dropping Zeros?

Apr 23, 2010

I need to pass some info to a 3rd party (for tracking) and they require I provide a checksum value which is an md5 hashed amalgamation of some of the other values. This is my code :

[Code]....

They keep rejecting my checksum. When I have tested for the following value passed in preConvert - 300265215063.79 I get :

My code gives : ED4463C84DE9D21B54C4E62F2D72CE

An online MD5 hash gives : 0ed40463c84de9d21b54c4e62f2d72ce

Which apart from the case, is exactly the same apart from missing 2 zeroes.

View 1 Replies

Logging From Framework Internals (Logging.On) - How To Turn On Logging

Jul 6, 2010

I'm debugging some unexpected behavior and while tracing in to the .NET framework I see a bunch of stuff like this:

if (Logging.On) {
Logging.PrintInfo(Logging.Web, this, SR.GetString(SR.net_log_n_certs_after_filtering, filteredCerts.Count));
...
}

But (as expected by default) the execution steps right over these. Is there some way to turn on the logging? Or is that just something that the framework developers can do while making special builds of the framework?

View 1 Replies

Security :: Generate Hash For Fixed Length?

Mar 4, 2010

I am here to generate a unique pin no of fixed length. All my previously generate pin no are stored in database and i want newly generated pin no to be unique.

I want to combine serial no and custom key and generate unique pin no.

View 1 Replies

Security :: Encrypt And Decrypt Md5 Hash Text?

Sep 27, 2010

i am encrypting textbox value in md5 using this coding and passing as querystring , and on other page i want to decrypt.....

[code]....

View 1 Replies

Security :: Is There A In Built Function To Hash Passwords

Apr 22, 2010

Is there a in built function in ASP.NET to hash passwords??

View 5 Replies

Security :: Changing The Hash Algorithm Used For CreateUserWizard?

Oct 1, 2010

I am rewriting my PHP website into C# .NET, and I need to be able to set the algorithm used by the CreateUserWizard / Membership Provider to SHA1 so that I can port all of the user accounts over without having to force them all to reset their passwords when this project is complete. At current glance it doesn't look like it is using SHA-1, and my Googlefoo is failing me.

View 1 Replies

Security :: Want To Log Into A Shared Folder On Another Server Using A Different User Name And Password?

Feb 22, 2010

I have an asp.net app written in c# and want to log into a shared folder on another server using a different user name and password.

How do I and can you give me some example code to allow me to connect to a shared folder on another server using a different user name and password.

Once connected, I wish to update a txt file

StreamWriter sw = File.AppendText(@\flcy_fluencyDNC_ListsTenantDNC.txt);
sw.WriteLine(tbTel1.Text);
sw.Close();

View 3 Replies

Security :: Finding Or Writing Hash Function - Convert Word To Number

Jan 14, 2010

I am tasked with a project to convert words from strings to numbers . I have to do this while ensuring collision-avoidance. i.e training -> 10232323

We are storing the numbers in a database and when we retrieve the records from the database, we will reverse hash and convert the number back to a string
10232323 -> training

As you might have guessed - this is not an area that I am familiar with. I researched the overridable System.Object.GetHashCode() method, but Microsoft warns that there is little guarantee that the default implementation of GetHashCode() avoids collisions.

So I am left stuck. I would like to create an algorithm, but I have no idea where to start.

Also, the function should accept unicode characters - in the event the company decides to internationalize.

View 8 Replies

Security :: Why Password Length Minimum: 7. Non-alphanumeric Characters Required: 1 - NOT PASSWORD RELATED

Feb 24, 2011

I am using Forms Authentication in a new ASP.NET 3.5 Application.I have created the Tables in my database and run the Web Site Administration Too.When I try to create a user I get a password error no matter what I throw at it and I am becoming sure of that this is a symptom of an a setup error and not a password problem.One of the things that I notice is that my aspnet_Applications is empty and I am not sure what is supposed to fill it.I have tried to delete all the aspnet tables and done the procedure again but with the same result.

View 1 Replies

Security :: Change Password Without Enter Current Password For Membership Provider?

Jan 13, 2010

I using change password control, how can i change the password without enter the current password?

View 8 Replies

Security :: Migrating Existing Cleat Text Users Password To Hashed Password Membership Provider?

Sep 9, 2010

I had been trying to solve this but there is a hidden key i wish someone point me to.

I had a simple membership database with users in first the Membership Provider configured for clear password to retrieve the original password .

Now a new requirement say that the password must be hashed and reset .

I configure the Membership password to hash , and Implemented the Reset Password Module.

My problem is as follow.

If the user is new registered user with the new configuration the password and the security answer is hashed.

also when I go and reset the password it continue to be hashed.

Now I thought that with new configuration if any previous user with clear text configuration , If he use the password Reset module , because my configuration now is hashed , I expected that the new password and security answer will be hashed . what happen is old user continue in clear text even if the configuration is hashed. so If I had new users everything is fine.

old users Membership Provider somehow know they had been stored in clear text and it keep change password and security answer in clear text . If I delete this user and create it , Membership Provider understand that everything will be hashed. I need to know how it know this , I need to migrate users not to delete and recreate users .

Also if there are no solution for that , I wish Microsoft Consider it in future cause it is a real user scenario, that can happen imagine a business system that related to membership user Id , deleting users and recreate them is not a solution .

View 1 Replies

Security :: How To Authenticate User When Enters Password That Should Be The Windows Password

Feb 4, 2010

I just begin creating a website for an organization. First page to be displayed in the login page. I dont have any knowledge in ASP.NET Security. On Login page, i want to display UserName field as disabled with the useralias of the user who currently logged into Windows. Password user has to provide and it should be that user's windows password.

How do i validate that password that user has entered is his windows password?

View 2 Replies

Security :: Password Recovery - Display On Web Page And Not Have To Use Smtp Server To Send Email

Apr 14, 2010

once user answers security question and clicks submit that you can then re direct them to a new page and display their password on screen? rather than send an email?

View 1 Replies

Security :: Password Change Control Won't Accept New Password?

Aug 18, 2010

I am developing a shopping cart with asp.net and sqlexpress. I am using aspnet authentication components to create a backend page. I designed the site to let in only authorized users in.

Yesterday, I forget my password to login to backend and asked system recover my password. with recover password of the asp.net I was able to receive the temp password. I took that and logged in, of course asp.net forward me to password change component which I am having problem with.

Every time I change my password , password change shows that I was successfull but after clicking on the continiue button password change component comes back. I went to properties of password change component and entered the main default page as destination but it is not helping.

I close the IE clear the cache , even restart the machine. When I login always taking me to the password change page.

View 2 Replies

Security :: Assign A Value To The Password And Confirm Password Fields?

Nov 18, 2010

Is there a way to assign a value to the password and confirm password fields of the CreateUserWizard control programmatically when the page loads? The CreateUserWizard.Password property is read-only.

View 3 Replies







Copyrights 2005-15 www.BigResource.com, All rights reserved