Browse by Tags

• Authentication
• Authorization
• CAS
• Code Inspection
• Deployment Phase
• Development Phase
• End User
• Fuzzing
• Implementation
• Information Gathering
• Input Validation
• Performance
• Planning Phase
• Practices
• Reflection
• Sensitive Data
• Tools
• WCF

Security Code Review – String Search Patterns For Authorization Vulnerabilities

These are the questions and the search criteria I use to identify authorization vulnerabilities in the code beyond web.config <authorization> node. How does the code protect access to page classes? Attributes Search for PrincipalPermission attributes. Read More...

Posted 24 July 08 10:53 by alikl | 1 Comments   
Filed under Test Phase, Security, Authorization

Security Code Review – String Search Patterns For Authentication Vulnerabilities

This post contains string search patterns that can help identifying authentication vulnerabilities during security code inspection for your ASP.NET application . Most common vulnerability is about insecurely manipulating credentials in the code. The question Read More...

Posted 21 July 08 03:39 by alikl | 0 Comments   
Filed under Test Phase, Security, Authentication

Security Code Review – String Search Patterns For Finding Input Validation Vulnerabilities

Well defined set of search patterns helps significantly reduce time (cost) when performing security code inspections. This post focuses on input validation vulnerabilities commonly found in ASP.NET web applications. SQL Injection and Cross Site Scripting Read More...

Posted 11 July 08 02:24 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

Quickly Find And Fix Cross Site Scripting (XSS) Vulnerabilities In Your ASP.NET Application.

Want to quickly check your ASP.NET Web application for Cross Site Scripting (XSS) vulnerability ? It is pretty easy with the knowledge and tools you already have. This post describes how to quickly find and fix most of XSS vulnerabilities in your code. Read More...

Posted 17 March 08 03:56 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

Security Code Review – Use Visual Studio Bookmarks To Capture Security Findings

How to streamline the process of capturing security flaws during security code review? How to save time and avoid switching between the tools? How to stay focused? In this post I will show my simple technique to capture security flaws using Bookmarks Read More...

Posted 24 January 08 01:38 by alikl | 3 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Practices

Avoid Manipulating Passwords In Memory - It Is Easy To Reveal

Revealing clear text passwords in memory seems to be a trivial task. This post describes how to reveal clear text passwords and what countermeasures to apply. Summary of steps: Install WinDbg Attach to process or open dump file Load SOS .Net extensions Read More...

Posted 08 December 07 05:55 by alikl | 3 Comments   
Filed under Test Phase, Security, Sensitive Data, Authentication, Planning Phase

XSSDetect Public Beta now Available!

XSSDetect public beta is now available for download on MSDN. Overview XSSDetect is a static code analysis tool that helps identify Cross-Site Scripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Read More...

Posted 24 October 07 09:21 by alikl | 1 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Development Phase

T-Shooting Kerberos

I was delivering "Authentication Explained" session for Security User Group. First off - thanks for attending the session! The session was based on "Authentication Explained" workshop . During the session I was demoing the following topics: Identity Flow Read More...

Posted 04 July 07 10:16 by alikl | 2 Comments   
Filed under Test Phase, Security, Implementation, Deployment Phase, Practices, Authentication

Who Access My File?

In my post File Access Auditing - I Am Not Afraid Of GPO I've digested technet documentation on how to set Active Directory Group Policy Object (AD GP) to enable file access auditing as security measure to prevent repudiation. It is heavy weight techniques Read More...

Posted 03 April 07 07:02 by alikl | 7 Comments   
Filed under Test Phase, Security, Tools, Development Phase, Deployment Phase, Authentication

Security Code Inspection - Eternal Search For SQL Injection

Here are couple of techniques I used for searching hints of SQL Injections in .Net apps. The basic approach is described here http://msdn2.microsoft.com/en-us/library/ms998399.aspx . It is basically split into two major parts - preliminary scan and the Read More...

Posted 31 March 07 09:04 by alikl | 6 Comments   
Filed under Input Validation, Test Phase, Security, Code Inspection, Development Phase

Performance Gain - Security Risk

Reposted from Performance Gain - Security Risk Good intention for better performance may lead to flawed design and bring in more security risks. Consider the following ASPX page: Here is why it cannot be accessed: When trying to navigate there you get: Read More...

Posted 27 March 07 03:26 by alikl | 4 Comments   
Filed under Test Phase, Security, Code Inspection, Implementation, Performance

Security .Net Code Inspection Using Outlook 2007

In my previous post, Code Inspection - First Look For What To Look For , I've described how to look for sensitive data and hints in the compiled assemblies. The other challenge I was looking to solve is boosting my productivity. So with little magic of Read More...

Posted 26 March 07 03:04 by alikl | 8 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Development Phase

XSS? - Do not Make Me Laugh, We Use WinForms

Reposted from XSS? - Do not Make Me Laugh, We Use WinForms I find myself sometimes (actually too many times...) in situation explaining people of impact of Cross Site Scripting (attack) attacks as a result of importer encoding of user input (vulnerability) Read More...

Posted 25 March 07 10:16 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Development Phase, Implementation

Code Inspection - First Look For What To Look For

Reposted from Security Code Inspection - First Look For What To Look For for further reuse on this blog. I found it extremely productive to first look for strings in the code. But what strings to look for? And how to look for the strings? Looking into Read More...

Posted 20 March 07 10:13 by alikl | 8 Comments   
Filed under Test Phase, Security, Information Gathering, Sensitive Data, Tools, Code Inspection, Development Phase

Good Chance For Canonicalization Attack When Using Path.Combine()

In my previous post, .Net Assembly Spoof Attack , I've described potential DLL hijacking/spoof attack when using reflection for dynamically loaded assemblies. Today I was reviewing some project where I stumbled on exactly such case. One thing that caught Read More...

Posted 15 March 07 11:31 by alikl | 0 Comments   
Filed under Input Validation, Test Phase, Security, Code Inspection, Development Phase

Search

This Blog

• Home
• Email