i am trying to create a strong name for assembly.....by giving the below code----
assembly:
AssemblyDelaySign(false)]
assembly:
AssemblyKeyFile(@"UsersABCDocumentsVisual Studio 2008ProjectscodeaccesssecuritycodeaccesssecurityinDebugABC.snk")]
assembly:
AssemblyKeyName("")]
when i am compiling project i am getting this error........
Error 1 Cryptographic failure while signing assembly 'C:UsersABCDocumentsVisual Studio 2008ProjectscodeaccesssecuritycodeaccesssecurityobjReleasecodeaccesssecurity.exe' -- 'Error reading key file 'UsersABCDocumentsVisual Studio 2008ProjectscodeaccesssecuritycodeaccesssecurityinDebugABC.snk'
-- The system cannot find the path specified. '
This question is somewhat of a follow up to How serious is this new ASP.NET security vulnerability and how can I workaround it? So if my question seems to be broken read over this question and its accepted solution first and then take that into the context of my question.Can someone explain why returning the same error page and same status code for custom errors matters? I find this to be immaterial especially if this is advocated as part of the work around to it.Isn't it just as easy for the script/application to execute this attack and not specifically care whether or not it gets a http status code and more on the outcome? Ie doing this 4000 times you get redirected to an error page where on 4001 you stay on the same page because it didn't invalidate the padding?
I see why adding the delay to the error page is somewhat relevant but doesn't this also just add another layer to fool the script into thinking the site is an invalid target?What could be done to prevent this if the script takes into account that since the site is asp.net it's running the AES encryption that it ignores the timing of error pages and watches the redirection or lack of redirection as the response vector? If a script does this will that mean there's NO WAY to stop it?Edit: I accept the timing attack reduction but the error page part is what really seems bogus. This attack vector puts their data into viewstate. There's only 2 cases. Pass. Fail.
Either Fail, they're on a page and the viewstate does not contain their data. No matter what you do here there is no way to remove the fail case because the page just will never contain their inserted data unless they successfully cracked the key. This is why I can't justify the custom errors usage having ANY EFFECT AT ALL.Or Pass, they're on a page and the viewstate contains their inserted data.Summary of this vulnerability
The cipher key from the WebResoure.axd / ScriptResource.axd is taken and the first guess of the validation key is used to generate a value of potential key with the ciphered text.This value is passed to the WebResource.axd / ScriptResource.axd at this point if the decryption key was guessed correctly their response will be accepted but since the data is garbage that it's looking for the WebResource.axd / ScriptResource.axd will return a 404 error.If the decryption key was not successfully guessed it will get a 500 error for the padding invalid exception. At this point the attack application knows to increment the potential decryption key value and try again repeating until it finds the first successful 404 from the WebResource.axd / ScriptResource.axd
Just reading about this ASP.NET security vurnerability. Just wondering if this could be used to attack a WCF service hosted under IIS to get to its web.config or if its a pure ASP.NET vurnerability
I have an app that uses impersonation to gain access to a database (on server separate from IIS). The app connects to the database using a trusted connection and seems to be working just fine. However, we get these logon failure events in the security event viewer:
[Code]....
It must have something to do with impersonation because the login failure is for the domain account which my app is impersonating under. But again, the app is working fine so I'm having a hard time figuring out how to stop these logon failures.
Here's the situation. I have an aspx page that is designed to receive a POST request with some XML values, parse the XML, grab the relevant items, and write them to the page. The problem arises when I try to launch the page using the POST request. When I launch using Fiddler, building the request manually and just pasting the XML in the body of the request everything works fine and dandy. When I launch the page from a basic HTML form, however, things don't go so great. The HTML form that I'm using looks like this:
[Code]....
When the page loads I get the error:
A potentially dangerous Request.Form value was detected from the client Everything I've read so far has told me that the solution is to add ValidateRequest="false" to the page directive in the top of the .aspx file, or in the pages element of the web.config file. But neither of these work. Afterwards, I still get the same error. Any idea what I need to do to make this work?
I have used gmail for sending mail localy which worked fine but when i uploaded the same file on server the "Failure sending mail." error occured. here is the code i have written:
Dim message As New MailMessage message.From = New MailAddress("[URL] message.To.Add(New MailAddress("[URL])) message.Subject = test mail"" message.Body = "Hi you have got a test mail from me! Dim client As New SmtpClient client.Credentials = New System.Net.NetworkCredential("[URL]"xxxxxxx") client.Port = 587 client.Host = "[URL] client.EnableSsl = True client.Send(message)
I have implemented a send mail functionality. For that i installed the SMTP Service on my local machine by going to 'add remove programs' -> windows components -> iis (properties) -> checked the smtp service option and installed. Below is my code that i am using in my application to setup the smtpclient object and sendmail()
[Code]....
Now i don't know why i am getting 'Failure sending mail' error. Definitely i am missing something. what i am missing and how can this be fixed. This is frustrating me now as i dont know much in this area.
I've got a site called domain.com and also another product on product.domain.com. The product.domain.com requires authentication to access it. For consistancy in the user experience I have set the login url in the web.config on product.domain.com to be http://domain.com/Login.aspx. This redirection is working ok - and a sample url would be:
The problem is that the RedirectURL does not take into account that the request originally came from product.domain.com so when the authentication is successful the user is not redirected back to product.domain.com
I have come up with a solution for this but would like feedback if possible.
I changed the loginURL in the web.config to http://domain.com/Login.aspx?domain=product.domain.com so the sample url is now:
I then override the LoggedIn event in the membership control and check to see if the domain value pair is specified and if it is I redirect to the domain + ReturnURL.
As I said previously i'd appreciate any comments or other ways to achieve the same result.
Is there any easy way of setting a failure text within the PasswordRecovery control?
I want to be able to notify users that there was a problem with sending an email. Is there a failure - counterpart to the SuccessTemplate i can use or is there any other template/control within the passwordRecovery control whose value can be set in a handler to the onsendmailerror event?
(Please don't send MSDN links to PasswordRecovery or onsendmailerror, i've read them)
I am using FireFox v3.6.14 I am developing on VS2010 and have a project with a web and Silverlight solution.try to run the project I get the above error.I cant work out if its Visual studio error or a firefox error, Im pritty sure its not my code!!Ive tried running the same app via Chrome with a similer error.
I am trying to implement the asychronous email code demonstrated at - [URL] I have copied and pasted the code to my own site so there should be no syntax errors and have spoken to my web provider about SMTP email access which they say is allowed and they advised me to use the following:
Host = localhost Port = 25
and that SSL should not be checked - I do not have SSL set up yet anyway. When I try to send an email I get the following message - Error occured, info=Failure sending mail. Has anyone ever encountered this before and know how to solve it?
I am trying to insert a record into a MySQL table, but the operation fails without generating any error. Here is what I have:
Code: Try n = taProject.InsertNewProject(pname, descr, idManager, startdate, tenddate, client, disable) Catch ex As Exception Beep() End Try
[code]....
I am not passing idProject, which is the primary key, and set to autoIncrement..How can I get any diagnostic output from the insert attempt to indicate what the error is?
using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Web.UI; using System.Web.UI.WebControls; using System.Net.Mail;
I have created roles and users using ASP.NET configurations for login validations, it works fine if I run my application within project but when I publish my site and try to run from my Inetpub it giving this error. I tried all shorts of solutions posted in website but nothing worked for me.
"Failed to generate a user instance of SQL Server due to a failure in copying database files. The connection will be closed"
We have developed a small method that pulls a cryptographic key from a signed xml document and then checks the signature using the SignedXml.CheckSignature method.
When run from a command line app the key validates properly. However as soon as I call it from a web app it stops working. Anybody know what could be happening?:
// Verify the signature of an XML file against an asymmetric // algorithm and return the result.XmlDocument Doc, RSA Key public static Boolean VerifyLicenceFile(string xmlLicFilePathArg) { bool isVerified = false;....
I'm trying to send an email through a form and for some reason it errors when it sends. The only error message I get is "Failure sending mail". I've followed a number of tutorials and I'm guessing I'm missing some sort of configuration. Here is the codewhich attempts to send mail:
I am trying to write a file to a network drive from my asp.Net application and i get this error - Logon failure: unknown user name or bad password. I am able to write to a local drive line C:/temp But when I try to save the file to a network drive such as ServerFolder, I get the error mentioned above.
I am keep getting an error that "Service Error : wbsTest failed" where wbsTest is my webservice.
The error comes up frequently enough for the user - normally reproducible within a minute or so of working with an application.
A bit of background: An user is a remote user accessing application hosted on our servers over https. He is software firewalled and his connection isn't the fastest but it is responsive enough. When errors do not present themselves, page loads are fairly quick.
Our asp.net 2.0 app encountered the following error:
This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.After adding the following in web.config -> <system.web> section:
I am getting an error incase user submits incorect security question's answer. I gave text in 'QuestionFailureText'. But its not working.
Below is the error getting. ' Security Exception Description:The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.
Exception Details: System.Security.SecurityException: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.
Source Error:
[Code]....
Source File: c:WindowsMicrosoft.NETFramework64v2.0.50727Temporary ASP.NET Filespng.webe16ed3ec284df543App_Web_rvfjstqa.5.cs Line: 0 Stack Trace:
I am using Itext sharp to create a pdf. I am adding an image and I keep getting this error
Request for the permission of type 'System.Security.Permissions.FileIOPermission, mscorlib, ersion=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
it is this bit of code that is causing this
[Code]....
If i comment this out, the PDF builds and no errors are thrown (there is just no image)
I don't understand cause I am am trying to do is read a file.
"System.Security.SecurityException: Request for the permission of type 'System.Web.AspNetHostingPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed."
When trying to access my simply aspx form on our local network. It works fine when debugging using Microsoft Visual studio 2008 however, when I deploy the aspx form on IIS 7.0 I get the error above. The form was working fine until I added a ajax calendar extender. I've also reviewed other posts relating to this one, such as changing<trust level="Full"> with no avail. I have listed a portion of my web.config file below.
In Visual Studio 2005.I have created a Blank solutions(XYZ) and then add a ASP.Net Web Service Project(TESTP) under it.And then create a .asmx file(WEBFI.asmx) and then write a method and add [WEB Method] on top of the method.Now compile it.And then publish it.But in publishing folder I didn’t found any WSDL file which I should call in different machine (which is in LAN ).
