C# Authentication failed because the remote party has closed the transport stream

Question

I want to point out that I have searched a lot for this without a solution. So, I've created a loop that will go throw listBox2 that contains links, each time creating a http GET request in order to access the full source code.

My code:

 private void button4_Click(object sender, EventArgs e)
    {
        try
        {
            for (int i = 0; i < listBox2.Items.Count; i++)
            {
                code(listBox2.Items[i].ToString() + "\'");
                //await PutTaskDelay();
                //Console.WriteLine(listBox2.Items[i].ToString());
                if (VarrileKeeper.s.ToLower().Contains("mysql"))
                {
                    Console.WriteLine("possitive " + listBox2.Items[i].ToString());
                }
            }
        }
        catch (Exception Fejl)
        {
            Console.WriteLine(Fejl);
        }
    }


 public static String code(string Url)
    {

        System.Net.ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };


        HttpWebRequest myRequest = (HttpWebRequest)WebRequest.Create(Url);
        myRequest.MaximumAutomaticRedirections = 4;
        myRequest.MaximumResponseHeadersLength = 4;
        myRequest.Credentials = CredentialCache.DefaultCredentials;

        myRequest.Method = "GET";

        WebResponse myResponse = myRequest.GetResponse();


        StreamReader sr = new StreamReader(myResponse.GetResponseStream(), System.Text.Encoding.UTF8);
        string result = sr.ReadToEnd();
        sr.Close();
        myResponse.Dispose();
        myResponse.Close();
        VarrileKeeper.s = result;
        return result;
    }

The error below is triggered when the loop hits various of urls for example (http://www.memphremagog.org/fr/lexique.php?id=32). The weird thing is that if I remove the loop and make a http GET reqeust to that site everything works just fine.

A first chance exception of type 'System.Net.WebException' occurred in System.dll System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream.

I don't think it's a problem with the certificate because otherwise I would still get an error on http://www.memphremagog.org/fr/lexique.php?id=32 when I removed the loop.

Any suggestions are appreciated.

Uncircumcised

when you debug, in your code() method what is the string that you are passing? was it something like "http: //www.memphremagog.org/fr/lexique.php?id=32\'"? Make sure you are passing valid URL – Botanomancy

Does the code work at all with the loop and it only fails intermittently? Or does the loop not work ever? – Samiel

The URL is valid otherwise it would not work when I run the code() outside the loop I have tested all the links manually outside the loop witch works with no errors. The loop works fine untill it hits for example this url (memphremagog.org/fr/lexique.php?id=32) and again when I run it with that url outside the loop it works fine. So to me it seems like everything works fine untill I start looping. And yes it only happens intermittently. – Uncircumcised

debug and check the value of string Url when it hits the error. – Botanomancy

Making a request to that url doesn't seem to require credentials. Are you passing credentials for any specific reason? Try removing them. – Samiel

Sometimes I need the credentials, I removed them anyway without luck. this is the url that triggered the error in this case zvoxaudio.com/…' – Uncircumcised

In your loop, you have this line code(listBox2.Items[i].ToString() + "\'"); where is the trailing "\'" in the url (zvoxaudio.com) you sent in that case? – Botanomancy

It's not a "\" im defining its a '. You define that with "\'" if you use chrome and go the the link you should see %27 at the end witch is a ' – Uncircumcised

woah woah woah.. You are trying to scan for mysql injection exploits aren't you. – Samiel

Indeed I am, but not for the purposes you think. I have a smaller company that does IT-security for people, now I'm trying to create some of my own tools to help my business. – Uncircumcised

Are these websites you are testing it out against your customers? – Samiel

It's not, and it's not illegal to test rather the site is vulneble. – Uncircumcised

You're probably being blocked because the firewall is flagging you as a threat or something similar. I think your test worked, the site is not vulnerable. – Most

Yes, my solution was to run everything async and first of all make a HEAD request. I still looking for a more reliable way than making a HEAD request since it will throw an error if the remote site is down for example. – Uncircumcised

I think you're sending many requests in a short time and the site blocks your requests. – Coaler

Answer 1

The zvoxaudio.com url, from your comments, is pretty tricky. They have a some bot detection for adding items to a cart. The link you specifically used doesn't seem to work no matter what, I think it is using an expired item id; I was able to use it by updating the id to 4007001 and change it to 'https'. This link however is adding an item to the cart and the site does not allow bots to add items to a cart, the site returns a 400 error with this key:value in the headers:

X-Error-Message: Bots are not allowed to add items to cart

Try adding a UserAgent to your request like this:

  myRequest.UserAgent = "Nada";

With those few changes the ZVOXAUDIO link works!

If you want keep the url as an 'https' request then just add this to your code.

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12

This is required because ZVOXAUDIO does not support TLS 1.0 or earlier protocols. If the version of .NET you're using doesn't suppoert TLS 1.2, you can use SecurityProtocolType.Tls11 as ZVOXAUDIO does support TLS 1.1 still.

But since, presumably, you are attempting to have this run on as many sites as possible you probably don't want to only allow TLS 1.2, as older servers may not support it. I would set your security protocol like this:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 |
                                       SecurityProtocolType.Tls11 |
                                       SecurityProtocolType.Tls |
                                       SecurityProtocolType.Ssl3;

As a suggestion, you can set the Server Certificate Validation Callback, and the Security Protocol, outside of your loop as it is a static setting for all requests. Also if you utilize the C# using syntax, the Dispose method takes care of closing and disposing your WebResponse and StreamReader variables for you. And C# introduced 'var' back in .NET 3.0, your might want to start embracing it, that is presuming you are using the 3.0 or newer framework. If you want to see what this would look like, look below.

Make sure you have these usings:

using System;
using System.IO;
using System.Net;

Then put these two lines in the static constructor of your form, or object, I assume you are using a form right now:

ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls | SecurityProtocolType.Ssl3;

Then your two methods would look like this:

private void button4_Click(object sender, EventArgs e)
{
  try
  {
    for (var i = 0; i < listBox2.Items.Count; i++)
    {
      var response = Code(listBox2.Items[i].ToString() + "\'");
      if (response.ToLower().Contains("mysql"))
      {
        Console.WriteLine("positive " + listBox2.Items[i].ToString());
      }
    }
  }
  catch (Exception ex)
  {
    Console.WriteLine(ex.Message);
  }
}


public static string Code(string url)
{
  var webRequest = (HttpWebRequest)WebRequest.Create(url);
  webRequest.MaximumAutomaticRedirections = 4;
  webRequest.MaximumResponseHeadersLength = 4;
  webRequest.UserAgent = "Mozilla/5.0 (Taco2) Gecko/20100101";
  webRequest.Credentials = CredentialCache.DefaultCredentials;

  webRequest.Method = "GET";

  using (var webResponse = webRequest.GetResponse())
  {
    using (var sr = new StreamReader(webResponse.GetResponseStream(), System.Text.Encoding.UTF8))
    {
      return sr.ReadToEnd();
    }
  }
}

Happy Coding! Feel free to ask any questions in the comments below.

Rathbun

Answer 2

This is happens due to a security protocol issue.Just add below line before request context.

ServicePointManager.SecurityProtocol = (SecurityProtocolType)3072;

Arillode

Answer 3

This occurred to me , but for me, it was due to a security protocol issue.

Just add this line

ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;

More info -> https://codeshare.co.uk/blog/how-to-fix-the-error-authentication-failed-because-the-remote-party-has-closed-the-transport-stream/

Rika

I'm confused what it means to simultaneously enable tls11 and tls12. Then will it still sometimes use tls11 and get the error? – Stereometry

I printed my security protocol and it already says "Tls, Tls11, Tls12". So my problem must come from some other issue – Stereometry

Answer 4

In my case, the issue was with credentials with the mail service I was using (mailgun).

1 year had passed since the credentials were created, so I guess there was a need to renew.

Resetting the credential password solved it for me.

Iridescent

Answer 5

Just call the below function above your web request:

    protected void Application_Start()
    {
        if (ServicePointManager.SecurityProtocol.HasFlag(SecurityProtocolType.Tls12) == false)
        {
            ServicePointManager.SecurityProtocol = ServicePointManager.SecurityProtocol | SecurityProtocolType.Tls12;
        }  
       
    }

Cheloid