+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] A secure login or method for security (/showthread.php?tid=3714609)
Pages: Pages
1
2
A secure login or method for security - Monetization - Aug 25, 2013
Let's say if I wanted to code a booter project privately for some people on a youtube channel.
I would need either a secure login client, or a secure method of making sure the client doesn't get sourced for the "power".
If I make it so, People Register/Login and then if the user correctly logged in, It can boot based upon the database information hosted on a hosting site.. And if it's a valid user, It can boot. If not, It cant. If I make it like this, How secured is it?
Also, What are other methods of security I can add to prevent leaking of personal power within the booter.
I would need either a secure login client, or a secure method of making sure the client doesn't get sourced for the "power".
If I make it so, People Register/Login and then if the user correctly logged in, It can boot based upon the database information hosted on a hosting site.. And if it's a valid user, It can boot. If not, It cant. If I make it like this, How secured is it?
Also, What are other methods of security I can add to prevent leaking of personal power within the booter.
* - SkyRider2 - Aug 25, 2013
I'd recommend just using .NET seal, it's secure and easier. Seeing everything is basically done for you.
* - Aristocles - Aug 25, 2013
NetSeal is NOT a secure login system. It's a licencing system.
* - SIM-1456245 - Aug 25, 2013
A very dangerous thing. Why ? Because .Net is very easaly decompiled, so everything you try to store securely there is acctually not secure.
* - pow3rful_UP - Aug 25, 2013
You can do this easy with php and vb.net if you dont know html, if you do know html just make everything webbased, if you do not, then use a vb.net client and connect to php
Make the client type in his username and password , connect to the php script, check for the username, password and ip address, if they match create a session variable, then in the booter.php script you check if the user has this session variable , if they do then they logged in previously and are legit users, if they do not have that session then they aren't logged in.
Easy to code.. easily done..
* - Monetization - Aug 25, 2013
(Aug 25, 2013 06:11 AM)#Tiger Wrote: I'd recommend just using .NET seal, it's secure and easier. Seeing everything is basically done for you.
Lol, I've cracked applications with this so many times it's not funny. This allowed me tons of booter and crypter applications. Because of me actually knowing this has happened, I'd be stupid to allow this on my project.
* - infamousnoone - Aug 25, 2013
........................................
* - Carl Elias - Aug 25, 2013
I sent you a PM. Most of the time as long as the program it self has enough protection as in blocking debuggers, fiddler, and other reverse engineering software, many times Net Seal is pretty good. I have one that so far no one was able to bypass. Net seal is a great licensing, but not the best for protection. Obfuscate, Block debuggers, and make it difficult to know how it works and many will not be able to do anything to it. Not saying this is the best, but it works for me.
-Ty
* - Onlykl - Aug 25, 2013
Check it :) http://www.screencast.com/t/1jkq1JRu
* - Yuuki - Aug 25, 2013
making your auth in .net is your first problem. the most you'll get out of protection is just obfuscating your assembly, and just some basic debugger checks. But if you're doing this in .net, it really won't stop anyone.
* - tweety - Aug 25, 2013
Use Net Seal and use an online PHP hub that checks if net seal is authenticated and carrys out the attack.
* - Qmz_ - Aug 25, 2013
If you would do this in vb6, you could simply make some basic protection and protect the application with vmprotect. I bet you would be quite safe. :)
* - ·Evolved· - Aug 25, 2013
(Aug 25, 2013 06:11 AM)#Tiger Wrote: I'd recommend just using .NET seal, it's secure and easier. Seeing everything is basically done for you.
That is a terrible idea, no offense. It is not useful at all for doing anything more than just a license code and possible a few server sided variables. It is easily cracked if you don't have the software just be a GUI for a server sided program.
(Aug 25, 2013 06:54 AM)XenocodeRCE Wrote: NetSeal is NOT a secure login system. It's a licencing system.
THIS ^. Thank you. At least someone understands.
(Aug 25, 2013 09:17 AM)infamousnoone Wrote: Since you client should only be a skeleton (that is log in and send requests to the server), when a client logs in using {user,pass} a third field should be generated server-side at random (most importantly not sequential) and relayed back to the client as {id}. The client can now dispose of the {user,pass} information, and all requests thus forth are done using {id}. Ensure that {id} expires after a fixed amount of time; Or due to inactivity for a fixed amount of time.
Even if someone decompiled your client all together and fully understood how everything worked, it wouldn't make a difference since the server would not process any requests that did not have a valid {id} attached to them; And since they are generated at random, it's very unlikely a user would be able to guess a valid id session.
Exactly. This is what I do on ALL of my software as long as it is possible, and I haven't had an issue yet. I have had some people "bypass the login", but woohoo, congrats being able to accomplish nothing with that non-existent session id. OP, this is what you need to do.
(Aug 25, 2013 11:28 AM)Yuuki Wrote: making your auth in .net is your first problem. the most you'll get out of protection is just obfuscating your assembly, and just some basic debugger checks. But if you're doing this in .net, it really won't stop anyone.
That is incorrect. .Net can be just as secure as any other language, you just have to know what the hell you are doing instead of just following someone's instructions blindly expecting something to work. Once you know how a language works, it's quite easy to make something secure, no matter if you can read the source, edit the source, etc.
* - WinA - Aug 25, 2013
May aswell make a webclient lol tons of free sources online
* - System[X] - Aug 26, 2013
Use ONLINE STRINGS
Ok, first off make a php page to connect to a database, send info with username/password to that php page and if login is correct then download varibles.
The page also needs to check user agent, add some random user agent in the webrequest to stop others viewing the page on any browser.
Basically all your strings/varibles are online and not in the tool, so if anyone does acually cracks your tool then it simply wont work for them.
A bit more work but is worth it.
Thanks