Trivial C# Random Exploitation

[u/nibblesec]

https://blog.doyensec.com/2025/08/19/trivial-exploit-on-C-random.html

[u/albinowax]

Love it. This vulnerability is almost identical to this Academy lab! https://portswigger.net/web-security/race-conditions/lab-race-conditions-exploiting-time-sensitive-vulnerabilities

[u/JaggedMetalOs]

There was an online poker site with a similar vulnerability like 25 years ago

[u/smetana-]

Very cool! You mention in the blog that there's another algorithm that does not seed by time. That one (Xoshiro256**) was only available starting in .NET 6 — possibly the app you were testing was on an older .NET version? It's also possible to crack the new Xoshiro algorithm: system-dot-random-predictor

[u/jpgoldberg]

The default RNG in pretty much every language’s standard library is not cryptographically secure. They were never designed to be. Now a-days they typically do offer cryptographically secure RNGs as well. I don’t know specifically about C#, but I’d be surprised if it didn’t.