Do HttpWebRequest have any vulnerabilities that can infect OS - c#

My question is, with below way of harvesting web, can the program running OS get infected with any possible way ?
The os is windows server 2008 r2 or windows 7 sp1
c# 4.5
Here the method i am using
I am just looking answer of any possible way of getting infected via any virus or any security vulnerability
I mean is below way 100% secure ?
using (System.Net.WebClient webClnt = new System.Net.WebClient())
{
HttpWebRequest request = (HttpWebRequest)WebRequest.Create(srQueryRequest);
if (srProxyHost != "none")
{
webClnt.Proxy = proxy;
webClnt.Credentials = proxy.Credentials;
request.Proxy = proxy;
}
request.Timeout = irTimeOut * 1000;
using (WebResponse response = request.GetResponse())
{
using (Stream strumien = response.GetResponseStream())
{
using (StreamReader sr = new StreamReader(strumien))
{
string srResult = sr.ReadToEnd();
}
}
}
}
}

With regards to security, that depends what you do with the returned string. If it cointains javascript and you exectute it in a browser, you could in theory pick up something nasty.
That aside, the code is something of a mess.
WebClient ( a wrapper of webrequest)is not used, the above code could be condensed down to:
using (System.Net.WebClient webClnt = new System.Net.WebClient())
{
webClnt.proxy = proxy;
var srResult = webClient.DownloadString(srQueryRequest);
}

Related

C#.NET 4.0 - HttpWebRequest.GetRepsonse() does not reach web service

I have an .Net Core 2.1 Web API running on our server. Now I have a .NET 4.0 application where I want to consume the webservice.
I managed to get Data from the api when i ran it locally on localhost. After deploying the api to the server and modifiyng the url in the application, it does not work.
When I call WebRequest.GetRepsonse() nothing happens, till it gets to timeout and throws an Exception with the timoeout message.
The Web API runs on the IIS and I already Enabled TLS 1.0, TLS 1.1, TLS 1.2 on the server.
When I make the POST request from Postman ist works fine. We are using a proxy for internet-connections but since both client and server are in the same network, I think it could not be the proxy settings. I also tried to set proxy settings but I still not getting it to work.
I'm now running out of ideas. Can anyone help?
Here is my code:
Client-App C#.NET 4.0:
var resultDt = new DataTable();
var url = "https://myServer:5100/api/Service/Execute";
var request = (HttpWebRequest)WebRequest.Create(url);
request.Credentials = CredentialCache.DefaultCredentials;
request.UseDefaultCredentials = true;
request.ContentType = "application/json";
request.Method = "POST";
ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls | (SecurityProtocolType)3072;
try
{
using (var streamWriter = new StreamWriter(request.GetRequestStream()))
{
string json = string.Format("{{\"CommandText\":\"{0}\"}}", query);
streamWriter.Write(json);
}
using(var response = (HttpWebResponse)request.GetResponse())
{
using (var reader = new StreamReader(response.GetResponseStream()))
{
var result = reader.ReadToEnd();
if (!string.IsNullOrEmpty(result))
{
var rows = JArray.Parse(result);
foreach (var row in rows.Children())
{
var columns = row.Children<JProperty>();
if (resultDt.Columns.Count == 0)
{
foreach (var column in columns)
{
resultDt.Columns.Add(new DataColumn()
{
ColumnName = column.Name,
DataType = typeof(string)
});
}
}
var newRow = resultDt.NewRow();
foreach (var column in columns)
{
newRow[column.Name] = column.Value;
}
resultDt.Rows.Add(newRow);
}
}
}
}
}
catch (Exception ex)
{
Logger.Instance().Fatal(ex.Message, ex);
}
return resultDt;
Note:
When I use HTTPS, the programm hangs in request.GetRequestStream().
When I use HTTP, the programm hangs in request.GetResponse().
It's very strange
I finally found the solution: I just needed to set the proxy to an empty instance:
request.Proxy = new WebProxy();
I found that in wireshark, the request from the .NET 4.0 app was going to the proxy port while postman was using the correct port.
Thanks anyway

Logging into Jenkins Programmatically in C#

I have jobs in Jenkins that i cannot access unless i log in first using a my username and password.
For example if i try to access "localhost:xxx/job/some_job_1" i will get a 404 Error unless i log in first. And i say this because i have tried the following using WebRequest class:
string formParams = "j_username=bobbyLee&j_password=SecretPassword25&from=%2F&json=%7B%22j_username%22%3A+%bobbyLee%22%2C+%22j_password%22%3A+%22SecretPassword%25%22%2C+%22remember_me%22%3A+false%2C+%22from%22%3A+%22%2F%22%7D&Submit=log+in";
// ***this is the exact string that is sent when i log in normally, obtained using Fiddler***
string formUrl = "http://serverName:PortNum/j_acegi_security_check";
// ***I have also tried http://serverName:PortNum/login***
string cookieHeader;
WebRequest req = WebRequest.Create(formUrl);
req.ContentType = "application/x-www-form-urlencoded";
req.Method = "POST";
byte[] bytes = Encoding.ASCII.GetBytes(formParams);
req.ContentLength = bytes.Length;
using (Stream os = req.GetRequestStream())
{
os.Write(bytes, 0, bytes.Length);
}
WebResponse resp = req.GetResponse();
cookieHeader = resp.Headers["Set-cookie"];
string pageSource;
string getUrl = "http://serverName:portNum/job/some_job/";
WebRequest getRequest = WebRequest.Create(getUrl);
getRequest.Headers.Add("Cookie", cookieHeader);
WebResponse getResponse = getRequest.GetResponse();
using (StreamReader sr = new StreamReader(getResponse.GetResponseStream()))
{
pageSource = sr.ReadToEnd();
}
The response that i get back from the POST request is "HTML OK", and cookieHeader is not null. But when i then try to make a GET request to get what i want, i get a 404 error when attempting to access the job "http://serverName:portNum/job/some_job/", as if i didn't log in successfully.
So what is the correct way to log into Jenkins from c#, and get the HTML source code of the jobs that only appears after logging in?
The RESTAPI is your best friend here.
It is an incredibly rich source of information. I have written a system that will show an entire program of work on a page with full deployment traceability.
I am going to assume you have some security in place in your Jenkins instance which means requests need to be authenticated.
I use the following class for this:
using System;
using System.Net;
using System.Text;
namespace Core.REST
{
public class HttpAdapter
{
private const string ApiToken = "3abcdefghijklmnopqrstuvwxyz12345"; // you will need to change this to the real value
private const string UserName = "restapi";
public string Get(string url)
{
try
{
const string credentials = UserName + ":" + ApiToken;
var authorization = Convert.ToBase64String(Encoding.ASCII.GetBytes(credentials));
using (var wc = new WebClient())
{
wc.Headers[HttpRequestHeader.Authorization] = "Basic " + authorization;
var htmlResult = wc.DownloadString(string.Format(url));
return htmlResult;
}
}
catch (WebException e)
{
Console.WriteLine("Could not retrieve REST API response");
throw e;
}
}
}
}
restapi is a dedicated user I created. I think I gave it admin access just so I didn't have to worry about it. I was admin but all the other developers and testers in the 3 crews had highly controlled and limited access to only what they needed and nothing more. It is also better practice to have a dedicated users for functions like this.
I constructed my c# classes to consume (deserialise) data from any page that supports the api/json suffix.

C#: HttpWebRequest POST data not working

I am developing a C# wpf application that has a functionality of logging into my website and download the file. This said website has an Authorize attribute on its action. I need 2 cookies for me to able to download the file, first cookie is for me to log in, second cookie(which is provided after successful log in) is for me to download the file. So i came up with the flow of keeping my cookies after my httpwebrequest/httpwebresponse. I am looking at my posting flow as maybe it is the problem. Here is my code.
void externalloginanddownload()
{
string pageSource = string.Empty;
CookieContainer cookies = new CookieContainer();
HttpWebRequest getrequest = (HttpWebRequest)WebRequest.Create("login uri");
getrequest.CookieContainer = cookies;
getrequest.Method = "GET";
getrequest.AllowAutoRedirect = false;
HttpWebResponse getresponse = (HttpWebResponse)getrequest.GetResponse();
using (StreamReader sr = new StreamReader(getresponse.GetResponseStream()))
{
pageSource = sr.ReadToEnd();
}
var values = new NameValueCollection
{
{"Username", "username"},
{"Password", "password"},
{ "Remember me?","False"},
};
var parameters = new StringBuilder();
foreach (string key in values.Keys)
{
parameters.AppendFormat("{0}={1}&",
HttpUtility.UrlEncode(key),
HttpUtility.UrlEncode(values[key]));
}
parameters.Length -= 1;
HttpWebRequest postrequest = (HttpWebRequest)WebRequest.Create("login uri");
postrequest.CookieContainer = cookies;
postrequest.Method = "POST";
using (var writer = new StreamWriter(postrequest.GetRequestStream()))
{
writer.Write(parameters.ToString());
}
using (WebResponse response = postrequest.GetResponse()) // the error 500 occurs here
{
using (var streamReader = new StreamReader(response.GetResponseStream()))
{
string html = streamReader.ReadToEnd();
}
}
}
When you get the WebResponse, the cookies returned will be in the response, not in the request (oddly enough, even though you need to CookieContainer on the request).
You will need to add the cookies from the response object to your CookieContainer, so it gets sent on the next request.
One simple way:
for(var cookie in getresponse.Cookies)
cookies.Add(cookie)
Since the cookies in response is already a cookies container, you can do this (might help to check for null in case all cookies were already there)
if (response.Cookies != null) cookies.Add(response.Cookies)
You may also have trouble with your POST as you need to set ContentType and length:
myWebRequest.ContentLength = parameters.Length;
myWebRequest.AllowWriteStreamBuffering = true;
If you have any multibyte characters to think about, you may have to address that as well by setting the encoding to UTF-8 on the request and the stringbuilder, and converting string to bytes and using that length.
Another tip: some web server code chokes if there is no user agent. Try:
myWebRequest.UserAgent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)";
And just in case you have any multibyte characters, it is better to do this:
var databytes = System.Text.Encoding.UTF8.GetBytes(parameters.ToString());
myWebRequest.ContentLength = databytes.Length;
myWebRequest.ContentType = "application/x-www-form-urlencoded; charset=utf-8";
using (var stream = myWebRequest.GetRequestStream())
{
stream.Write(databytes, 0, databytes.Length);
}
In C# Application (Server side Web API) Enable the C++ Exception and Common Language Run time Exceptions using (Ctrl+Alt+E) what is the Server side Exception it's throw.
First you check data is binding Properly. After you can see what it is Exact Exception. the Internal Server Error Mostly throw the data is not correct format and not properly managed Exception.

Get web page contents from Firefox in a C# program

I need to write a simple C# app that should receive entire contents of a web page currently opened in Firefox. Is there any way to do it directly from C#? If not, is it possible to develop some kind of plug-in that would transfer page contents? As I am a total newbie in Firefox plug-ins programming, I'd really appreciate any info on getting me started quickly. Maybe there are some sources I can use as a reference? Doc links? Recommendations?
UPD: I actually need to communicate with a Firefox instance, not get contents of a web page from a given URL
It would help if you elaborate What you are trying to achieve. May be plugins already out there such as firebug can help.
Anways, if you really want to develop both plugin and C# application:
Check out this tutorial on firefox extension:
http://robertnyman.com/2009/01/24/how-to-develop-a-firefox-extension/
Otherwise, You can use WebRequest or HttpWebRequest class in .NET request to get the HTML source of any URL.
I think you'd almost certainly need to write a Firefox plugin for that. However there are certainly ways to request a webpage, and receive its HTML response within C#. It depends on what your requirements are?
If you're requirements are simply receive the source from any website, leave a comment and I'll point you towards the code.
Uri uri = new Uri(url);
System.Net.HttpWebRequest req = (System.Net.HttpWebRequest)System.Net.WebRequest.Create(uri.AbsoluteUri);
req.AllowAutoRedirect = true;
req.MaximumAutomaticRedirections = 3;
//req.UserAgent = _UserAgent; //"Mozilla/6.0 (MSIE 6.0; Windows NT 5.1; Searcharoo.NET)";
req.KeepAlive = true;
req.Timeout = _RequestTimeout * 1000; //prefRequestTimeout
// SIMONJONES http://codeproject.com/aspnet/spideroo.asp?msg=1421158#xx1421158xx
req.CookieContainer = new System.Net.CookieContainer();
req.CookieContainer.Add(_CookieContainer.GetCookies(uri));
System.Net.HttpWebResponse webresponse = null;
try
{
webresponse = (System.Net.HttpWebResponse)req.GetResponse();
}
catch (Exception ex)
{
webresponse = null;
Console.Write("request for url failed: {0} {1}", url, ex.Message);
}
if (webresponse != null)
{
webresponse.Cookies = req.CookieContainer.GetCookies(req.RequestUri);
// handle cookies (need to do this incase we have any session cookies)
foreach (System.Net.Cookie retCookie in webresponse.Cookies)
{
bool cookieFound = false;
foreach (System.Net.Cookie oldCookie in _CookieContainer.GetCookies(uri))
{
if (retCookie.Name.Equals(oldCookie.Name))
{
oldCookie.Value = retCookie.Value;
cookieFound = true;
}
}
if (!cookieFound)
{
_CookieContainer.Add(retCookie);
}
}
string enc = "utf-8"; // default
if (webresponse.ContentEncoding != String.Empty)
{
// Use the HttpHeader Content-Type in preference to the one set in META
doc.Encoding = webresponse.ContentEncoding;
}
else if (doc.Encoding == String.Empty)
{
doc.Encoding = enc; // default
}
//http://www.c-sharpcorner.com/Code/2003/Dec/ReadingWebPageSources.asp
System.IO.StreamReader stream = new System.IO.StreamReader
(webresponse.GetResponseStream(), System.Text.Encoding.GetEncoding(doc.Encoding));
webresponse.Close();
This does what you want.
using System.Net;
var cli = new WebClient();
string data = cli.DownloadString("http://www.heise.de");
Console.WriteLine(data);
Native messaging enables an extension to exchange messages with a native application installed on the user's computer.

C# using Privoxy/TOR

I find many example how use Privoxy/TOR for proxy. For example: How to use Tor to make a C# HttpWebRequest
First I installed Vidalia Bundle and than also Privoxy.
Vidalia Bundle using address 127.0.0.1:9115
Privoxy using address 127.0.0.1:8118
I try in code create request on server http://whatismyipaddress.com/.
HttpWebRequest request = (HttpWebRequest)WebRequest.Create("http://whatismyipaddress.com/");
request.Proxy = new WebProxy("127.0.0.1:8118");
using (var response = request.GetResponse())
{
using (var reader = new StreamReader(response.GetResponseStream(), Encoding.GetEncoding("utf-8")))
{
webBrowser1.DocumentText = reader.ReadToEnd();
}
}
But this server still see my IP address. What I am doing wrong ? Any advance, thank you.
Edit, with leppie advice:
I use this constructor :
request.Proxy = new WebProxy("127.0.0.1",8118);
But server still see my IP adress. :(
Application is using Privoxy on port 8118. I need foward on 9115-this is TOR port.
I suspect the url is wrong.
You should probably use the WebProxy(string Host, int Port) constructor.
This works for a remote proxy:
HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create("http://whatismyipaddress.com/");
request.Proxy = new WebProxy("110.139.166.78:8080");
using (var req = request.GetResponse())
{
using (StreamReader reader = new StreamReader(req.GetResponseStream()))
{
Console.WriteLine(reader.ReadToEnd());
}
}
Console.ReadLine();

Categories

Resources