Blog Stats
  • Posts - 13
  • Articles - 2
  • Comments - 1
  • Trackbacks - 4

 

Wednesday, November 29, 2006

CodeFileBaseClass attribute in Page Class (.aspx)


While goining through code,saw this interesting stuff..basically used to specify the typename of a base class and its associated code-behind class. Check this on MSDN .

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

Sunday, September 03, 2006

DOM based XSS attack


We have heard of Cross-Site Scripting attack....basically two types of cross site scripting is normally explained everywhere.. Non-Persistent XSS - which normally occurs when the input is directly echoed on the browser which causes the script in the input to execute. This script can steal the cookie using document.cookie and may post the values to attacker's site. Persistent XSS occurs when the input (from querystring, form variables) is stored in the database and later retrieved to display it on webpage causing the script to execute.

If we can use document.cookie so why not we use document object itself !! DOM based attack works on this principle..If our code uses document.url or document.location.href etc..these can be exploited using this technique.

For more info abt XSS:

http://www.webappsec.org/projects/articles/071105.shtml

http://crypto.stanford.edu/cs155/CSS.pdf

http://www.owasp.org/index.php/Category:OWASP_Project

 

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

Managing Identity


Excellent white paper on “.NET Developer's Guide to Identity“ . This white paper by Keith Brown explains different authentication ,authorization mechanisms, talks abt federated identity,ADFS, security in WCF ..and lot more..This is a kind a boon for developers ..as all material is available at single place !!

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

InfoCard !!


MS Windows Cardspace Home -

http://msdn.microsoft.com/winfx/reference/infocard/default.aspx

Infocard blog(s):

http://blogs.msdn.com/andyhar/archive/2005/11/22/495649.aspx

Articles:

..will fill up the post as I read more info.. !!

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

Security Enhancements in .NET framework 2.0


Following are some of the materials explaing security enhancements in .NET framework 2.0

http://blogs.msdn.com/shawnfa/archive/2005/08/24/455581.aspx

http://msdn.microsoft.com/msdnmag/issues/06/00/SecurityBriefs/default.aspx

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGPractices0001.asp

Security Practises in ASP.NET 2.0

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGPractices0001.asp

 

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

Basic questions for Security Code Review


Following are the main areas to look for security code review:

  1. SQL injection
  2. CSS
  3. Data Access
  4. Input/Data Validation
  5. Authentication
  6. Authorization
  7. Sensitive data
  8. Unsafe code
  9. Unmanaged code
  10. Hard-coded secrets
  11. Poor error handling
  12. Web.config
  13. CAS
  14. Cryptography
  15. Undocumented public interfaces
  16. Thread Racing problems

For details look into Security Engineering Explained by MS Patterns and Practises !!

 

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

One-click attack:How to prevent them?


One click attack normally occurs when attacker creates  a prefilled web page(.htm or .aspx) with view state. The view state is generated from a previously created page. ex. shopping cart page with say 50 items. The attacker then lures unsususpecting user to browse the page and causing the page to be sent to server where view state is valid.

To prevent this kind of attack in .NET, use Page.ViewStateUserKey in Page_Init event with unique value per user such as username or configured in web.config.

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

Friday, August 11, 2006

Thursday, July 06, 2006

Referring 1.1 framework compiled DLLs in 2.0 Application and vice-versa


We can refer the 1.1 framework compiled dlls in Web applications developed in 2.0 without any extra effort. However we can not refer the 2.0 compiled dlls in 1.1 framework application the reason is well illustrated in the thread at ASP.NET Migration forum which says : using COM Interop it won't work because even if it uses COM for "interoperating" it still needs the .NET Framework to run. Since you cannot load 2 versions of the .NET Framework in the same process it will end up running against .NET 1.1 and fail.

However this thread  says  there is a workaround to refer 2.0 compiled dlls in 1.1 framework application using MSBuild ..!! 

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

Wednesday, July 05, 2006

Contract-first Service development


Here is a very nice article describing COM, code-first, contract-first service development by Aaron.

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

VS 2005 Security features and Tools


http://msdn.microsoft.com/security/vs2005security/default.aspx - Lists and provides all security features and tools in VS 2005.
  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

Thursday, July 06, 2006

Master pages - heart of Website


With the introduction of Master pages in 2.0, we can now design the page which contains contents repeated on each page -like menus, navigation, logos. We can also combine the functionality used by all web pages at single place and derive all our pages from this master page...

Here is an excellent article on master pages by Scott Allen - providing tips,tricks and traps.

Microsoft also  provided 4 design templates based on the category. You can find them here.

  • Share This Post:
  • Share on Twitter
  • Share on Facebook
  • Share on Technorati

Wednesday, June 28, 2006

 

 

Copyright © Parmeshwar Arewar