Issues in Signing a .NET Assembly using .pfx file

Problem:

I have procured a code signing certificate with a view to ensure that one of application that we intend to distribute to external users is signed so that the same can be trusted by the end users. I imported the certificate into the certificate store and used it successfully to sign the Click Once Manifest using the Signing tab in the Projec Properties dialog in Visual Studio 2013. But I could not have the assembly signed. I exported the certificate from the store as a .pfx file and tried using it for signing the assembly, but am getting issues like "Private Key not Found", while the Private key is very much present in the .pfx file.

By: Rajkumar David

Solution:

Visual Studio 2013 has known issues in handling PKCS# 12 certificate files as it cannot handle files with multilpe certificates in the CA certificate chain. Visual studio may not still consider such certificates for signing the assembly because of the KeySpec Parameter, which is usually set as AT_KEYEXCHANGE(1), whereas Visual Studio expects this to be AT_SIGNATURE(2). It is possible that while requesting the certificate, the KeySpec is set as 1 and as such the certificate is generated with the value as 1. You may verify CSR that you have submitted to the CA to check this.

OK, now what do you with that certificate? You have option to import such certificates with KeySpec set as AT_SIGNATUR. The Windows Servers from 2003 onwards have a commandline certificate import utility - certutil.exe. This command allows you to import the certificate with the right KeySpec parameter. Use the following command to do this:

certutil -importPFX -user <pfxfilename> AT_SIGNATURE

After importing the certificate using the above command into the certificate store and then export it back as .pfx file from the store for assembly signing within Visual Studio. This should resolve the given problem.

More on the CertUtil command can be found here.

Web Application - Vulnerability Testing

Question:

I am a software tester with 11 months experience. I want to explore security testing area and would like to know more about vulnerability testing more specifically about SQL injection attack. Also guide me as to how these testing can be performed manually.

By: Saran Satyan

Answer:

Vulnerability Testing is a practice area for security professionals. There is no simple or one solution that will work in all cases. One has to go through a structured approach to accomplish this testing. The high level steps include scoping, information gathering, tool selection, and then performing the scanning. Most of the vulnerabilities require in-depth knowledge on the internals of the web application like its design and architecture in addition to the tools and technology used in its build. Manual methods or techniques may not help in identifying most of the vulnerabilities.

As we all know, SQL query language is used to retrieve data from the databases and a technique to exploit the the query language to fetch unintentional data by injecting unexpected input data is referred to as SQL Injection attack. As an example, typical where clause in a query used to authenticate a user would be like where userid = <user_id> and password = <password>. The user id and password as entered by the user would be substituted in this where clause in run time before execution. Programmers adopt different techniques to dynamically bind the input variables to build the needed where clause. One such simple method of dynamically building the where clause is by concatenating the input data like "... where userid = " + user_id + " and password = " + password = ";" In this case for instance, if the user inputs the password with something followed by "or 1=1" then the where clause of the final query will look like where userid = user_id and password = password = password or 1=1; As we all know, this query when executed will retrieve all the rows in the user table because of the condition or 1=1.

Here is an article worth referring to know more about SQL injection attacks.You may also check out the following links to know more about vulnerability testing:

Web Application Security Testing Cheat Sheet
The world's most advanced Open Source vulnerability scanner and manager
Web application security: Testing for vulnerabilities

Hope you will find this response useful.