Excellent white paper on “.NET Developer's Guide to Identity“ . This white paper by Keith Brown explains different authentication ,authorization mechanisms, talks abt federated identity,ADFS, security in WCF ..and lot more..This is a kind a boon for developers ..as all material is available at single place !!
Posted On Sunday, September 03, 2006 12:36 PM | Feedback (0)
MS Windows Cardspace Home -
http://msdn.microsoft.com/winfx/reference/infocard/default.aspx
Infocard blog(s):
http://blogs.msdn.com/andyhar/archive/2005/11/22/495649.aspx
Articles:
..will fill up the post as I read more info.. !!
Posted On Sunday, September 03, 2006 11:55 AM | Feedback (0)
Following are some of the materials explaing security enhancements in .NET framework 2.0
http://blogs.msdn.com/shawnfa/archive/2005/08/24/455581.aspx
http://msdn.microsoft.com/msdnmag/issues/06/00/SecurityBriefs/default.aspx
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGPractices0001.asp
Security Practises in ASP.NET 2.0
Posted On Sunday, September 03, 2006 10:31 AM | Feedback (0)
Following are the main areas to look for security code review:
For details look into Security Engineering Explained by MS Patterns and Practises !!
Posted On Sunday, September 03, 2006 10:20 AM | Feedback (0)
One click attack normally occurs when attacker creates a prefilled web page(.htm or .aspx) with view state. The view state is generated from a previously created page. ex. shopping cart page with say 50 items. The attacker then lures unsususpecting user to browse the page and causing the page to be sent to server where view state is valid.
To prevent this kind of attack in .NET, use Page.ViewStateUserKey in Page_Init event with unique value per user such as username or configured in web.config.
Posted On Sunday, September 03, 2006 10:09 AM | Feedback (0)
We have heard of Cross-Site Scripting attack....basically two types of cross site scripting is normally explained everywhere.. Non-Persistent XSS - which normally occurs when the input is directly echoed on the browser which causes the script in the input to execute. This script can steal the cookie using document.cookie and may post the values to attacker's site. Persistent XSS occurs when the input (from querystring, form variables) is stored in the database and later retrieved to display it on webpage causing the script to execute.
If we can use document.cookie so why not we use document object itself !! DOM based attack works on this principle..If our code uses document.url or document.location.href etc..these can be exploited using this technique.
For more info abt XSS:
http://www.webappsec.org/projects/articles/071105.shtml
http://crypto.stanford.edu/cs155/CSS.pdf
http://www.owasp.org/index.php/Category:OWASP_Project
Posted On Sunday, September 03, 2006 9:53 AM | Feedback (0)