I was wondering if you guys could share some resources for building secure API using .net core, not looking for stuff like XSS or some javascript stealing since I'm building API only.
Currently I'm looking at authentication & authorization, but I'd like to know if there are some hidden tricks, maybe there's some exploit in the data binder MVC uses? or something in the MVC it self? or??? of course I'll be looking into each of them, but having some resources could save quite a good amount of time.
Thanks in advance.
Have a cool signature? hit me up and I might use it.
DO NOT DEAL WITH THIS MEMBER
I find it hard to understand what you want.
You want to know how to build a Web API in .NET Core? There are plenty of results on Google, such as:
https://docs.microsoft.com/en-us/aspnet/...st-web-api
(May 25, 2017 09:17 AM)Ninja Wrote: I find it hard to understand what you want.
You want to know how to build a Web API in .NET Core? There are plenty of results on Google, such as:
https://docs.microsoft.com/en-us/aspnet/...st-web-api
I'm looking to build a secure API, building an API is fairly easy, just copy&paste codes around, but I want to learn about securing it.
Maybe things like this link: https://www.owasp.org/index.php/.NET_Sec...heat_Sheet it provides some nice notes, but some of them don't apply to API since they're related to the html such as cookies, unvalidated redirect, Anti Forgery and XSS (do they apply to API??)
Have a cool signature? hit me up and I might use it.
(May 25, 2017 09:58 AM)severos Wrote: I'm looking to build a secure API, building an API is fairly easy, just copy&paste codes around, but I want to learn about securing it.
Maybe things like this link: https://www.owasp.org/index.php/.NET_Sec...heat_Sheet it provides some nice notes, but some of them don't apply to API since they're related to the html such as cookies, unvalidated redirect, Anti Forgery and XSS (do they apply to API??)
No. God no! Don't copy paste code for your API. please.
![[Image: HJdK32K_x]](https://lensert.com/HJdK32K_x)
lensert.com is the new screenshot utility, try it out now!
OSX & WINDOWS
DO NOT DEAL WITH THIS MEMBER
May 25, 2017 11:44 AM
(This post was last modified: May 25, 2017 11:45 AM by Ninja.)
(May 25, 2017 09:58 AM)severos Wrote: I'm looking to build a secure API, building an API is fairly easy, just copy&paste codes around, but I want to learn about securing it.
Maybe things like this link: https://www.owasp.org/index.php/.NET_Sec...heat_Sheet it provides some nice notes, but some of them don't apply to API since they're related to the html such as cookies, unvalidated redirect, Anti Forgery and XSS (do they apply to API??)
APIs are vulnerable to SQL injection attacks, and XSS attacks as well (maybe even persistent ones).
(May 25, 2017 09:58 AM)severos Wrote: just copy&paste codes around
Oh god...
This is such a wide question it's impossible to answer. If you can provide some more specific scenarios or examples maybe someone could contribute.
Probably coding some useless shit.
May 25, 2017 03:29 PM
(This post was last modified: May 25, 2017 03:33 PM by 0xDEAD10CC.)
(May 25, 2017 11:44 AM)Ninja Wrote: APIs are vulnerable to SQL injection attacks, and XSS attacks as well (maybe even persistent ones).
Oh god...
You're assuming they all use SQL, and certain false assumptions are also being made on your part here to include XSS vulnerabilities also. :/ I can guarantee that my RESTful Philips Hue system API is not vulnerable to either of those. That's not a universally true statement that you've made, only in a handful of cases.
@OP - You could look at building an API using OAuth 2.0 with Two factor authentication, and have a RESTful back end for a scalable platform agnostic solution; HTTP requests and XML and/or JSON.
(May 25, 2017 11:44 AM)Ninja Wrote: APIs are vulnerable to SQL injection attacks, and XSS attacks as well (maybe even persistent ones).
Oh god... I understand the SQL part, but how would they be vulnerable to XSS??? didn't XSS happen only when rendering pages? how would that affect JSON objects for example??
(May 25, 2017 11:49 AM)ubbelol Wrote: This is such a wide question it's impossible to answer. If you can provide some more specific scenarios or examples maybe someone could contribute. I know it's wide, but that's the nature of the question, I'm trying to get a hold on many things, if you know a scenario it'd be awesome if you provide info about it, then I'll just collect the info from whatever is provided here.
As a start, I'm looking into what vulnerabilities would exist if I'm using the default MVC for .Net Core, maybe something that can break the routing? data binding? also, what are other possible attacks and how to prevent them (slowloris for example, or local/remote file execution).
(May 25, 2017 03:29 PM)0xDEAD10CC Wrote: You're assuming they all use SQL, and certain false assumptions are also being made on your part here to include XSS vulnerabilities also. :/ I can guarantee that my RESTful Philips Hue system API is not vulnerable to either of those. That's not a universally true statement that you've made, only in a handful of cases.
@OP - You could look at building an API using OAuth 2.0 with Two factor authentication, and have a RESTful back end for a scalable platform agnostic solution; HTTP requests and XML and/or JSON.
So for authentication OAuth is best option? far as I understood OAuth is used when you want to let other services access someone's data, not when you want someone him self to access his own data, right? or I got lost somewhere while reading??
what if I don't want 2FA, what would be the best option?
The API will be using JSON, and looking to make it scalable as much by making every component independent and can run alone, so it allows running multiple instances on different machines (something like micro-services?)
Have a cool signature? hit me up and I might use it.
DO NOT DEAL WITH THIS MEMBER
May 26, 2017 07:52 AM
(This post was last modified: May 26, 2017 07:54 AM by Ninja.)
(May 25, 2017 03:29 PM)0xDEAD10CC Wrote: You're assuming they all use SQL, and certain false assumptions are also being made on your part here to include XSS vulnerabilities also. :/ I can guarantee that my RESTful Philips Hue system API is not vulnerable to either of those. That's not a universally true statement that you've made, only in a handful of cases.
@OP - You could look at building an API using OAuth 2.0 with Two factor authentication, and have a RESTful back end for a scalable platform agnostic solution; HTTP requests and XML and/or JSON.
Of course its not universally true, dipshit. I never claimed all APIs use SQL and they are all vulnerable to SQL attacks or XSS attacks. Why do you always nit pick on everything I say?
(May 25, 2017 09:13 PM)severos Wrote: I understand the SQL part, but how would they be vulnerable to XSS??? didn't XSS happen only when rendering pages? how would that affect JSON objects for example??
If you have an API with a front end, or a registration panel, or anything a user interacts with, then it can be vulnerable to XSS.
(May 26, 2017 07:52 AM)Ninja Wrote: If you have an API with a front end, or a registration panel, or anything a user interacts with, then it can be vulnerable to XSS.
I see, so I'll need to filter/escape whatever string I get from users? is this the only solution to use? or there are hidden tricks that bypass this and will need other solutions??
Have a cool signature? hit me up and I might use it.
Just use a good framework and you'll be good on most things, I'm not so sure about .NET frameworks but I know in PHP, frameworks like Laravel do most of the heavy lifting for you including security.
DO NOT DEAL WITH THIS MEMBER
(May 26, 2017 09:05 AM)severos Wrote: I see, so I'll need to filter/escape whatever string I get from users? is this the only solution to use? or there are hidden tricks that bypass this and will need other solutions??
I think (but Im no expert) that with url encoding (UTF8 or whatever it is called) it will be fine.
May 26, 2017 07:17 PM
(This post was last modified: May 26, 2017 07:19 PM by 0xDEAD10CC.)
(May 26, 2017 07:52 AM)Ninja Wrote: Of course its not universally true, dipshit. I never claimed all APIs use SQL and they are all vulnerable to SQL attacks or XSS attacks. Why do you always nit pick on everything I say?
If you have an API with a front end, or a registration panel, or anything a user interacts with, then it can be vulnerable to XSS.
You clearly did claim it by your general statement about API's being vulnerable to both SQL and XSS. All you said was "API's are vulnerable to _ and ___". You didn't say "some" or provide any further context to not suggest that you were talking about it as a universal thing; basic literacy.
And if you know what you're doing... https://msdn.microsoft.com/en-us/library/ff649310.aspx
The same thing applies to SQL vulnerabilities which are JUST as easy to avoid.
DO NOT DEAL WITH THIS MEMBER
May 28, 2017 08:26 AM
(This post was last modified: May 28, 2017 08:27 AM by Ninja.)
(May 26, 2017 07:17 PM)0xDEAD10CC Wrote: You clearly did claim it by your general statement about API's being vulnerable to both SQL and XSS. All you said was "API's are vulnerable to_ and ___". You didn't say "some" or provide any further context to not suggest that you were talking about it as a universal thing; basic literacy.
And if you know what you're doing... https://msdn.microsoft.com/en-us/library/ff649310.aspx
The same thing applies to SQL vulnerabilities which are JUST as easy to avoid.
Are you retarded? In no way does that mean ALL apis.
Stop misinterpreting things I say fucking retard.
May 28, 2017 04:41 PM
(This post was last modified: May 28, 2017 04:43 PM by 0xDEAD10CC.)
(May 28, 2017 08:26 AM)Ninja Wrote: Are you retarded? In no way does that mean ALL apis.
Stop misinterpreting things I say fucking retard.
Maybe if you wrote proper english you wouldn't have to become so hostile when people point things out. You're acting foolish here but you obviously need to re-visit preschool English, that's exactly what it reads.
>> "APIs are vulnerable to SQL injection attacks, and XSS attacks as well"
It's the difference between "apples are red" and "some apples are red". Use some common sense here and maybe you would actually learn. 🤝
|
