Browse by Tags

• CAS
• Implementation
• Information Gathering
• Input Validation
• Reflection
• Security
• Sensitive Data
• Test Phase
• Tools

XSSDetect Public Beta now Available!

XSSDetect public beta is now available for download on MSDN. Overview XSSDetect is a static code analysis tool that helps identify Cross-Site Scripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Read More...

Posted 24 October 07 09:21 by alikl | 1 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Development Phase

Security Code Inspection - Eternal Search For SQL Injection

Here are couple of techniques I used for searching hints of SQL Injections in .Net apps. The basic approach is described here http://msdn2.microsoft.com/en-us/library/ms998399.aspx . It is basically split into two major parts - preliminary scan and the Read More...

Posted 31 March 07 09:04 by alikl | 6 Comments   
Filed under Input Validation, Test Phase, Security, Code Inspection, Development Phase

Security .Net Code Inspection Using Outlook 2007

In my previous post, Code Inspection - First Look For What To Look For , I've described how to look for sensitive data and hints in the compiled assemblies. The other challenge I was looking to solve is boosting my productivity. So with little magic of Read More...

Posted 26 March 07 03:04 by alikl | 8 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Development Phase

Code Inspection - First Look For What To Look For

Reposted from Security Code Inspection - First Look For What To Look For for further reuse on this blog. I found it extremely productive to first look for strings in the code. But what strings to look for? And how to look for the strings? Looking into Read More...

Posted 20 March 07 10:13 by alikl | 8 Comments   
Filed under Test Phase, Security, Information Gathering, Sensitive Data, Tools, Code Inspection, Development Phase

Good Chance For Canonicalization Attack When Using Path.Combine()

In my previous post, .Net Assembly Spoof Attack , I've described potential DLL hijacking/spoof attack when using reflection for dynamically loaded assemblies. Today I was reviewing some project where I stumbled on exactly such case. One thing that caught Read More...

Posted 15 March 07 11:31 by alikl | 0 Comments   
Filed under Input Validation, Test Phase, Security, Code Inspection, Development Phase

.Net Assembly Spoof Attack

To be honest I am not sure about the name of such attack, but in the nutshell it is attack where the original good code is replaced by bad one with the same interface but very bad implementation - may be Trojan DLL? Anyway... My Australia based teammate Read More...

Posted 12 March 07 08:51 by alikl | 8 Comments   
Filed under Test Phase, Security, Code Inspection, Reflection, Development Phase, CAS, Implementation

Search

This Blog

• Home
• Email