Forms Authentication Login Redirection with Authentication Cookie Timeout

I was recently using a Bootstrap template that had static navigation and menu items.  Since we were using this in a _Layout Razor View and using the @RenderBody section for all of our Views, when the Forms Authentication Cookie would time out or expire, we would end up with the Login page inside of our existing _Layout page rather than completely replacing the entire _Layout view!

Well, fortunately, this was fixed through some JavaScript on our _Login view:

<script type="text/javascript">

   if (window.top.location.pathname.indexOf("/Account/Login")<0) 

   {

       window.top.location.href = window.top.location.origin + "/Account/Login";

   }

</script>

If you find it tedious to try and get the exact Url path in JavaScript, you can get the Paths in C# using methods such as the following:

public static string GetLocalPath(HttpContext context)

{

    string baseUrl = string.Empty;

    baseUrl = string.Format("{0}://{1}{2}", context.Request.Url.Scheme, context.Request.Url.Authority, context.Request.Url.LocalPath);

    return baseUrl;

}

public static string GetFQDN(HttpContext context)

{

    string baseUrl = string.Empty;

    baseUrl = context.Request.Url.AbsolutePath;

    return baseUrl;

}

Then you can assign these values in JavaScript using the following code:

var loginPath = "@UrlHelpers.GetLocalPath(HttpContext.Current)";

var currentPath = "@UrlHelpers.GetFQDN(HttpContext.Current)";

Then your JavaScript just becomes the following:

<script type="text/javascript">

    if (window.top.location.pathname.indexOf("/Account/Login")<0) 

    {

        window.top.location.href = loginPath;

    }

</script>

That is all there is to it!!

Netsparker scanning of a secured ASP.NET Web site

I was recently trying to use Netsparker to perform a vulnerability scan of my secured ASP.NET Website (using Forms Authentication), when I discovered that Netsparker could not properly authenticate against my website with the credentials I provided!

Well, Netsparker support provided me with a workaround for using Custom Cookies to authenticate against my website:

https://netsparker.zendesk.com/entries/351822-Custom-Cookies

https://netsparker.zendesk.com/entries/260427-how-can-i-set-custom-cookies-for-a-website

In order to view the necessary custom cookies for your website, you will need to use Developer Tools such as Mozilla Firefox, Google Chrome, IE Developer Tools or Telerik Fiddler to copy the Cookie information and then subsequently paste it into Netsparker for passing the necessary authentication request credentials.

Netsparker Web Vulnerability Scanner

I was recently investigating Web Vulnerability Scanners and I came across Netsparker: https://www.netsparker.com/web-vulnerability-scanner/

I downloaded the demo and requested a fully functional trial version as well.

Overall, this is an excellent easy-to-use security scanning tool, and the demo version provides very useful information about the types of vulnerabilities that can be found in an ASP.NET Web Application.

Unfortunately, the demo site that they use (http://aspnet.testsparker.com) is an ASP.NET Web Forms Web Application and therefore will exhibit a different set of security vulnerabilities than the newer ASP.NET MVC Framework which many companies are using.

The lack of an ASP.NET MVC Demo Site significantly detracts from the usefulness of the demo for anyone evaluating this software for themselves (especially for modern ASP.NET development teams).

However, the friendly sales and support staff definitely makes up for this shortcoming to provide an excellent overall web security vulnerability scanner.

The Standard edition allows for 3 Websites (3 unique FQDNs) while the Professional edition allows for an unlimited number of websites (unlimited FQDNs).

The Standard edition will suit most organizations that have an autodeploy server and are not using host headers or subdomains to access the various different Web Applications.  Therefore, http://myserver.mycompany.com/App1 and http://myserver.mycompany.com/App2 and http://myserver.mycompany.com/App3 all still qualify as a single website whereas http://myapp1.mycompany.com and http://myapp2.mycompany.com would qualify as 2 separate websites.

If you are looking to incorporate Web Vulnerability testing int your development process, you should definitely take a look at Netsparker!!

Security vulnerability scanning with Burp Suite Professional

If you are using Burp Suite Professional to do your Security Vulnerability scans, you may notice that setting up your environment to simply run on a Windows OS is a rather tedious operation:  https://portswigger.net/burp/help/suite_gettingstarted.html

Well, I LOVE automation, so I decided to create PowerShell scripts to configure the most common operations needed to set up and use Burp Suite:

$regKey="HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"

$proxyServer = ""

$proxyAddress = "127.0.0.1";

$proxyPort = "8080";

$proxyServerToDefine = "$proxyAddress" + ":" + "$proxyPort";

Write-Host "Retrieve the proxy server ..."

Write-Host $proxyServerToDefine

$proxyServer = Get-ItemProperty -Path $regKey -Name ProxyServer -ErrorAction SilentlyContinue

Write-Host $proxyServer

if([string]::IsNullOrEmpty($proxyServer))

{

    Write-Host "Proxy is actually disabled"

    Set-ItemProperty -Path $regKey -Name ProxyEnable -Value 1

    Set-ItemProperty -Path $regKey -Name ProxyServer -Value $proxyServerToDefine

    Write-Host "Proxy is now enabled"

}#if

else

{

    Write-Host "Proxy is actually enabled"

    Set-ItemProperty -Path $regKey -Name ProxyEnable -Value 0

    Remove-ItemProperty -Path $regKey -Name ProxyServer

    Write-Host "Proxy is now disabled"

}#//else

$javaPath = "C:\Program Files\Java\jre1.8.0_51\bin\java.exe";

$burpPathPro = "C:\Burp\burpsuite_pro_v1.6.09.jar";

#java -jar -Xmx1024m /path/to/burp.jar

Clear-Host

$BurpCmd = @"

"

"$javaPath" -jar $burpPathPro";

"

@

Write-Host $BurpCmd

#Launch Burp Suite

& "$javaPath" -jar $burpPathPro