Password is in plain text in ASP.Net Page submit.

Hello,

In my web application, we are creating users using salt and hash technique with SHA256. we are able to login with the users created with the hash and Salt technique. All APS.Net controls are server side controls.

We approached a security audit team for any security issues. When our security auditor check the application using Burp Suite, they say that password is still in clear text. What they are saying is the encrypt the password before transmitting the data on to the server. The security testing on an http. we have a https also but they wanted to do the testing on http only. Would you please kindly let us know what is the approach that we need to follow?

Thanks and Kind Regards,

Venkat.

Hi Venkateswarlu Parvatam,

Source Code Link

https://drive.google.com/open?id=15IY_f0o7lunzhD4pkqoU1qWxjYV1b3y8

10 Points to Secure Your ASP.NET MVC Applications.

https://www.codeproject.com/Articles/1116318/Points-to-Secure-Your-ASP-NET-MVC-Applications

Steps

1. Use MD5 Algorithm.

2. Store Md5 Password without seed in Database

( Seed or Salt is Used only while Login such that Hacker cannot guess it).

3. Generate Salt on Page Load and Keep in Session

Generating Salt

protected void Page_Load(object sender, EventArgs e)
{
if (!IsPostBack)
{
Session.Add("rno", 0);
Random randomclass = new Random();
Session["rno"] = System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(randomclass.Next().ToString(), "MD5");
}
btnlogin.Attributes.Add("onclick", "javascript:return md5auth('" + Convert.ToString(Session["rno"]) + "');");
}

On Submit button

protected void btnsubmit_Click(object sender, EventArgs e)
{
// https://www.md5hashgenerator.com/
//Plain Password :- Pass@123
//Md5 Password :- f91e15dbec69fc40f81f0876e7009648
var storedpassword = "f91e15dbec69fc40f81f0876e7009648";
var username = txtuserid.Text;
var password = txtpassword.Text;
var orignalpassword = ReturnHash(storedpassword.ToUpper(), Convert.ToString(Session["rno"]));
if (password == orignalpassword)
{
}
}

ReturnHash

public string ReturnHash(string strPassword, string token)
{
string randomNo = token;
pragma warning disable 618
return FormsAuthentication.HashPasswordForStoringInConfigFile((randomNo + strPassword), "MD5");
pragma warning restore 618
}

ClientSide Generating Md5 + Salt (Seed)

Output

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Saineshwar Bageri8y ago
Hi Venkateswarlu Parvatam,

Source Code Link

https://drive.google.com/open?id=15IY_f0o7lunzhD4pkqoU1qWxjYV1b3y8

10 Points to Secure Your ASP.NET MVC Applications.

https://www.codeproject.com/Articles/1116318/Points-to-Secure-Your-ASP-NET-MVC-Applications

Steps

1. Use MD5 Algorithm.
2. Store Md5 Password without seed in Database
( Seed or Salt is Used only while Login such that Hacker cannot guess it).
3. Generate Salt on Page Load and Keep in Session

Generating Salt
protected void Page_Load(object sender, EventArgs e)
        {
            if (!IsPostBack)
            {
                Session.Add("rno", 0);
                Random randomclass = new Random();
                Session["rno"] = System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile(randomclass.Next().ToString(), "MD5");

            }
            btnlogin.Attributes.Add("onclick", "javascript:return md5auth('" + Convert.ToString(Session["rno"]) + "');");
        }
On Submit button
protected void btnsubmit_Click(object sender, EventArgs e)
       {
           // https://www.md5hashgenerator.com/
           //Plain Password :- Pass@123
           //Md5 Password :- f91e15dbec69fc40f81f0876e7009648

           var storedpassword = "f91e15dbec69fc40f81f0876e7009648";
           var username = txtuserid.Text;
           var password = txtpassword.Text;
           var orignalpassword = ReturnHash(storedpassword.ToUpper(), Convert.ToString(Session["rno"]));

           if (password == orignalpassword)
           {

           }
       }
ReturnHash
public string ReturnHash(string strPassword, string token)
       {
           string randomNo = token;
pragma warning disable 618
           return FormsAuthentication.HashPasswordForStoringInConfigFile((randomNo + strPassword), "MD5");
pragma warning restore 618
       }
ClientSide Generating Md5 + Salt (Seed)

Output