Let's continue with some other very common application weaknesses. This set of levels will focus on 3: Sensitive Data Exposure and 4: XXE vulnerabilities
3: Sensitive Data Exposure
Insecure Cryptography - Insecure Randomness
Seeding the RNG with DateTime.UtcNow.Ticks will not provide an output that is random enough. An adversary could easily crack it.
private void NextBytes(byte[] bytes)
{
for (var i = 0; i < bytes.Length; i++)
{
bytes[i] = (byte)(DateTime.UtcNow.Ticks % 256);
}
}
Using BouncyCastle's SecureRandom provides a cryptographically strong random number generator (RNG). It can have up to 128 bits. In addition, SecureRandom uses random data from your OS (for example, the interval between keystrokes, etc.) and uses that as a seed.
4: XXE vulnerabilities