Login system

Nimboso · 2016-12-10T05:17:25.000Z

I use butterflies (https://xkcd.com/378/)

Posts 16–30 of 45 · Page 2 of 3

123

I use butterflies

Originally Posted by Silent

Or use php scripts and make it A LOT more secure.

Creating a login system which submits post requests to a web server with php to verify the login or not would be a good idea.

Originally Posted by skatfield

Creating a login system which submits post requests to a web server with php to verify the login or not would be a good idea.

Originally Posted by Silent

The file "AntiNetworkTampering.cs" looks interesting, anything you're willing to share?

Originally Posted by ERGaergaergaergaergearg

The file "AntiNetworkTampering.cs" looks interesting, anything you're willing to share?

It's a incomplete class. Basically checks for network redirection.(Example: Google is redirecting to localhost, It will detect that.)

Originally Posted by Silent

It's a incomplete class. Basically checks for network redirection.(Example: Google is redirecting to localhost, It will detect that.)

Ahh I thought it was something special

Thanks fo sharin' anyhow!

Originally Posted by ERGaergaergaergaergearg

Ahh I thought it was something special

Thanks fo sharin' anyhow!

No problem!

@Silent I suppose you didn't read the right way what @skatfield said:

Originally Posted by skatfield

Creating a login system which submits post requests to a web server with php to verify the login or not would be a good idea.

he agreed with you. I don't think there is a reason to post a screenshot of your futile, unavailing anti-reversing structure. Any reversing-practiced guy can bypass that junk.

Originally Posted by javalover

@Silent I suppose you didn't read the right way what @skatfield said:

he agreed with you. I don't think there is a reason to post a screenshot of your futile, unavailing anti-reversing structure. Any reversing-practiced guy can bypass that junk.

I was trying to give a understanding of the things you would need to make a secure login. and antis aren't made to stop people, like you said, any good reverse engineer could bypass it. And no shit, it's in .NET the most insecure language created. If I was aiming for secure I would use qt.

And no shit, it's in .NET the most insecure language created

.NET isn't a language, it's a framework. I don't agree with what you said however, because you are evaluating it as insecure from a reversing standpoint, when in the software's nature everything is always reversable, indipendently from the language or from the framework you are using. Qt is a framework, not a language.
The only way to make something compact as an anti-reversing idea is to use a server-client architecture and to process the critical and crucial parts in the server, it would be very efficient but it's not versatile (and so not always adjustable).

Originally Posted by Silent

I was trying to give a understanding of the things you would need to make a secure login

Creating a naive anti-reversing structure in a login application doesn't affect in making a `secured login`, but in making `a little bit more invulnerable, but an always vulnerable application from RE`. In both the two senses, you'll still be as procarious as you were before doing that anti-reversing scheme.

I spend the last 2 days learning C# how to connect to a MySQL online database, now today I learned how to encrypt it.

After reading this thread thats a bad idea?

What I want to try is; user names and passwords will be handed out by me, so then their encrypted hashes are going to be stored on MySQL online server. The program does the login authentication with MySQL server and if their login and password matches the server's hash the program process to Form2 or ect.

Is the php script way that much better? (I don't know any t php btw)

Originally Posted by Sheep0

1st security rule
don't authenticate on client-side

PHP is a server-side language so I would definitely use PHP instead of C# for it

Originally Posted by Zaczero

1st security rule
don't authenticate on client-side

PHP is a server-side language so I would definitely use PHP instead of C# for it

http://www.mpgh.net/forum/showthread.php?t=1290937
http://www.mpgh.net/forum/showthread.php?t=1290941
http://www.mpgh.net/forum/showthread.php?t=1290947

test those

Originally Posted by Sheep0

Is the php script way that much better? (I don't know any t php btw)

I would not advise you to authenticate users on the client. I'll send you a simple php authentication script that I use for pretty much all my projects. You will need to make it compatible to work with a C# desktop application though.

Virus scan: https://virustotal.com/#/file-analys...UwNDAzNzg3Mg==

authentication-base_mpgh.net.zip18 KB · 14 downloads Clean

Download & Thanks

do you have a website where users / customers can login / signup?

if so, you could create a type of auth that saves their HWID (Hardware ID) when logging in for the first time, which prevents them from using the application on another computer / laptop, but make sure to encrypt your application and all users passwords

ps: dont do it from a text file

- - - Updated - - -

Originally Posted by ERGaergaergaergaergearg

The file "AntiNetworkTampering.cs" looks interesting, anything you're willing to share?

theres several types of anti tamper

here is one i use now and again,

it checks for the debugging process and sniffing processes

Code:

private static void SNIFFER_CHECK()
        {
            string[] SNIFFERS = new string[] 
            {
                "wireshark",
                "fiddler",
                "httpdebugger",
                "burp",
                "ettercap",
                "dsniff",
                "ethereal",
                "tcpdump",
                "sandboxie",
                "SandboxieRpcSs",
                "sandboxierpcss"
            };
            foreach (Process Meme in Process.GetProcesses())
            {
                if (SNIFFERS.Contains<string>(Meme.ProcessName))
                {
                    Meme.Kill();
                    Environment.FailFast(null);
                }
            }
        }
        private static void DEBUGGER_CHECK()
        {
            string[] DEBUGGERS = new string[]
            {
                "dnspy",
                "megadumper",
                "olydb",
                "ilspy",
                "dotnet",
            };
            foreach(Process Meme in Process.GetProcesses())
            {
                if (DEBUGGERS.Contains<string>(Meme.ProcessName))
                {
                    Meme.Kill();
                    Environment.FailFast(null);
                }
            }
        }