Parmeshwar's Space !!

CodeFileBaseClass attribute in Page Class (.aspx)

While goining through code,saw this interesting stuff..basically used to specify the typename of a base class and its associated code-behind class. Check this on MSDN .

posted @ Wednesday, November 29, 2006 5:21 PM | Feedback (0)

DOM based XSS attack

We have heard of Cross-Site Scripting attack....basically two types of cross site scripting is normally explained everywhere.. Non-Persistent CSS - which normally occurs when the input is directly echoed on the browser which causes the script in the input to execute. This script can steal the cookie using document.cookie and may post the values to attacker's site. Persistent CSS occurs when the input (from querystring, form variables) is stored in the database and later retrieved to display it on webpage causing the script to execute.

If we can use document.cookie so why not we use document object itself !! DOM based attack works on this principle..If our code uses document.url or document.location.href etc..these can be exploited using this technique.

In .NET,  we can use requestValidate=True as page directive to prevent from such kind of attack. However this can also be bypassed, so also use HtmlEncode, UrlEncode to tightly filter input and write output urls. Also, a great library called IOSEC is available which goes further to filter malicious input.

For more info abt CSS:

http://www.webappsec.org/projects/articles/071105.shtml

http://crypto.stanford.edu/cs155/CSS.pdf

http://www.owasp.org/index.php/Category:OWASP_Project

posted @ Sunday, September 03, 2006 9:53 AM | Feedback (0)

My first post !!

posted @ Wednesday, June 28, 2006 11:38 AM | Feedback (1)

Managing Identity

Excellent white paper on “.NET Developer's Guide to Identity“ . This white paper by Keith Brown explains different authentication ,authorization mechanisms, talks abt federated identity,ADFS, security in WCF ..and lot more..This is a kind a boon for developers ..as all material is available at single place !!

posted @ Sunday, September 03, 2006 12:36 PM | Feedback (0)

InfoCard !!

MS Windows Cardspace Home -

http://msdn.microsoft.com/winfx/reference/infocard/default.aspx

Infocard blog(s):

http://blogs.msdn.com/andyhar/archive/2005/11/22/495649.aspx

Articles:

• First look at InfoCard

..will fill up the post as I read more info.. !!

posted @ Sunday, September 03, 2006 11:55 AM | Feedback (0)

Security Enhancements in .NET framework 2.0

Following are some of the materials explaing security enhancements in .NET framework 2.0

http://blogs.msdn.com/shawnfa/archive/2005/08/24/455581.aspx

http://msdn.microsoft.com/msdnmag/issues/06/00/SecurityBriefs/default.aspx

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGPractices0001.asp

Security Practises in ASP.NET 2.0

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAGPractices0001.asp

posted @ Sunday, September 03, 2006 10:31 AM | Feedback (0)

Basic questions for Security Code Review

Following are the main areas to look for security code review:

1. SQL injection
2. CSS
3. Data Access
4. Input/Data Validation
5. Authentication
6. Authorization
7. Sensitive data
8. Unsafe code
9. Unmanaged code
10. Hard-coded secrets
11. Poor error handling
12. Web.config
13. CAS
14. Cryptography
15. Undocumented public interfaces
16. Thread Racing problems

For details look into Security Engineering Explained by MS Patterns and Practises !!

posted @ Sunday, September 03, 2006 10:20 AM | Feedback (0)

One-click attack:How to prevent them?

One click attack normally occurs when attacker creates  a prefilled web page(.htm or .aspx) with view state. The view state is generated from a previously created page. ex. shopping cart page with say 50 items. The attacker then lures unsususpecting user to browse the page and causing the page to be sent to server where view state is valid.

To prevent this kind of attack in .NET, use Page.ViewStateUserKey in Page_Init event with unique value per user such as username or configured in web.config.

posted @ Sunday, September 03, 2006 10:09 AM | Feedback (3)

Some nice articles on Security

• How to Think about  Security - By James A. Whittaker and Richard Ford

• A Process for performing Security Code Review - By Michael Howard

• Security in WCF - By Keith Brown

posted @ Friday, August 11, 2006 6:02 PM | Feedback (1)

Referring 1.1 framework compiled DLLs in 2.0 Application and vice-versa

We can refer the 1.1 framework compiled dlls in Web applications developed in 2.0 without any extra effort. However we can not refer the 2.0 compiled dlls in 1.1 framework application the reason is well illustrated in the thread at ASP.NET Migration forum which says : using COM Interop it won't work because even if it uses COM for "interoperating" it still needs the .NET Framework to run. Since you cannot load 2 versions of the .NET Framework in the same process it will end up running against .NET 1.1 and fail.

However this thread  says  there is a workaround to refer 2.0 compiled dlls in 1.1 framework application using MSBuild ..!! 

posted @ Thursday, July 06, 2006 3:39 PM | Feedback (0)

Contract-first Service development

Here is a very nice article describing COM, code-first, contract-first service development by Aaron.

posted @ Wednesday, July 05, 2006 9:44 AM | Feedback (0)

VS 2005 Security features and Tools

posted @ Wednesday, July 05, 2006 1:05 PM | Feedback (0)

Master pages - heart of Website

With the introduction of Master pages in 2.0, we can now design the page which contains contents repeated on each page -like menus, navigation, logos. We can also combine the functionality used by all web pages at single place and derive all our pages from this master page...

Here is an excellent article on master pages by Scott Allen - providing tips,tricks and traps.

Microsoft also  provided 4 design templates based on the category. You can find them here.

posted @ Thursday, July 06, 2006 1:08 PM | Feedback (1)

Bug Bash 2006 contest for Indian Students !!

posted @ Wednesday, June 28, 2006 5:38 PM | Feedback (4)