Browse by Tags

• AJAX
• Code Inspection
• Development Phase
• Fuzzing
• Implementation
• Security
• Test Phase
• Tools
• WCF

Security Code Review – String Search Patterns For Finding Input Validation Vulnerabilities

Well defined set of search patterns helps significantly reduce time (cost) when performing security code inspections. This post focuses on input validation vulnerabilities commonly found in ASP.NET web applications. SQL Injection and Cross Site Scripting Read More...

Posted 11 July 08 02:24 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

WCF Security - Input/Data Validation Using Schemas

WCF offers very flexible approach of Input and Data Validation based on XML Schemas. The approach is flexible since the validation rules are expressed in form of XML schema and can be changed at any time without recompiling the solution. I followed the Read More...

Posted 25 May 08 03:52 by alikl | 1 Comments   
Filed under WCF, Input Validation, Security, Development Phase, Implementation

WCF Security - Input/Data Validation Sample Visual Studio Project

Input and Data Validation is one of the core security principles . WCF is no exception . To get most out of WCF in secure way one must implement proper Input and Data Validation. I was following instructions on How To – Perform Input Validation Read More...

Posted 25 May 08 12:17 by alikl | 1 Comments   
Filed under WCF, Input Validation, Security, Development Phase, Implementation

Quickly Find And Fix Cross Site Scripting (XSS) Vulnerabilities In Your ASP.NET Application.

Want to quickly check your ASP.NET Web application for Cross Site Scripting (XSS) vulnerability ? It is pretty easy with the knowledge and tools you already have. This post describes how to quickly find and fix most of XSS vulnerabilities in your code. Read More...

Posted 17 March 08 03:56 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

AJAX Security - Client Side Validation Is For Usability Only, Not For Security

“As to methods there may be a million and then some, but principles are few. The man who grasps principles can successfully select his own methods. The man who tries methods, ignoring principles, is sure to have trouble.” Ralph Waldo Emerson AJAX is another Read More...

Posted 03 October 07 01:29 by alikl | 6 Comments   
Filed under Input Validation, Security, Development Phase, AJAX

Creating a Parameterized Query In Visual Studio

Creating parameterized queries is one of the major countermeasures to SQL Injection attacks (not the ultimate but major). I always did it in old fashion way - using code only and I am ashamed I never utilize advanced productivity features of Visual Studio. Read More...

Posted 28 May 07 05:10 by alikl | 1 Comments   
Filed under Input Validation, Security, Implementation

Security Code Inspection - Eternal Search For SQL Injection

Here are couple of techniques I used for searching hints of SQL Injections in .Net apps. The basic approach is described here http://msdn2.microsoft.com/en-us/library/ms998399.aspx . It is basically split into two major parts - preliminary scan and the Read More...

Posted 31 March 07 09:04 by alikl | 6 Comments   
Filed under Input Validation, Test Phase, Security, Code Inspection, Development Phase

XSS? - Do not Make Me Laugh, We Use WinForms

Reposted from XSS? - Do not Make Me Laugh, We Use WinForms I find myself sometimes (actually too many times...) in situation explaining people of impact of Cross Site Scripting (attack) attacks as a result of importer encoding of user input (vulnerability) Read More...

Posted 25 March 07 10:16 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Development Phase, Implementation

Good Chance For Canonicalization Attack When Using Path.Combine()

In my previous post, .Net Assembly Spoof Attack , I've described potential DLL hijacking/spoof attack when using reflection for dynamically loaded assemblies. Today I was reviewing some project where I stumbled on exactly such case. One thing that caught Read More...

Posted 15 March 07 11:31 by alikl | 0 Comments   
Filed under Input Validation, Test Phase, Security, Code Inspection, Development Phase

How To Hack WCF - New Technology, Old Hacking Tricks

First of I'd like to thank Guy for his excellent screencast - very convenient, so thanks. Specifically I liked introductory screencast for WCF which can be found here: http://blogs.microsoft.co.il/blogs/bursteg/pages/WCF-Introduction-Demo-_2800_ScreenCast_2900_.aspx Read More...

Posted 04 March 07 08:11 by alikl | 12 Comments   
Filed under WCF, Input Validation, Test Phase, Fuzzing, Security

Search

This Blog

• Home
• Email