Browse by Tags

• Code Inspection
• Development Phase
• Fuzzing
• Implementation
• Security
• Tools
• WCF

Security Code Review – String Search Patterns For Finding Input Validation Vulnerabilities

Well defined set of search patterns helps significantly reduce time (cost) when performing security code inspections. This post focuses on input validation vulnerabilities commonly found in ASP.NET web applications. SQL Injection and Cross Site Scripting Read More...

Posted 11 July 08 02:24 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

Quickly Find And Fix Cross Site Scripting (XSS) Vulnerabilities In Your ASP.NET Application.

Want to quickly check your ASP.NET Web application for Cross Site Scripting (XSS) vulnerability ? It is pretty easy with the knowledge and tools you already have. This post describes how to quickly find and fix most of XSS vulnerabilities in your code. Read More...

Posted 17 March 08 03:56 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

Security Code Inspection - Eternal Search For SQL Injection

Here are couple of techniques I used for searching hints of SQL Injections in .Net apps. The basic approach is described here http://msdn2.microsoft.com/en-us/library/ms998399.aspx . It is basically split into two major parts - preliminary scan and the Read More...

Posted 31 March 07 09:04 by alikl | 6 Comments   
Filed under Input Validation, Test Phase, Security, Code Inspection, Development Phase

XSS? - Do not Make Me Laugh, We Use WinForms

Reposted from XSS? - Do not Make Me Laugh, We Use WinForms I find myself sometimes (actually too many times...) in situation explaining people of impact of Cross Site Scripting (attack) attacks as a result of importer encoding of user input (vulnerability) Read More...

Posted 25 March 07 10:16 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Development Phase, Implementation

Good Chance For Canonicalization Attack When Using Path.Combine()

In my previous post, .Net Assembly Spoof Attack , I've described potential DLL hijacking/spoof attack when using reflection for dynamically loaded assemblies. Today I was reviewing some project where I stumbled on exactly such case. One thing that caught Read More...

Posted 15 March 07 11:31 by alikl | 0 Comments   
Filed under Input Validation, Test Phase, Security, Code Inspection, Development Phase

How To Hack WCF - New Technology, Old Hacking Tricks

First of I'd like to thank Guy for his excellent screencast - very convenient, so thanks. Specifically I liked introductory screencast for WCF which can be found here: http://blogs.microsoft.co.il/blogs/bursteg/pages/WCF-Introduction-Demo-_2800_ScreenCast_2900_.aspx Read More...

Posted 04 March 07 08:11 by alikl | 12 Comments   
Filed under WCF, Input Validation, Test Phase, Fuzzing, Security

Search

This Blog

• Home
• Email