Browse by Tags

• Auditing and Logging
• Authentication
• Code Inspection
• Deployment Inspection
• Deployment Phase
• Development Phase
• Information Gathering
• Input Validation
• Practices
• Sensitive Data
• Test Phase
• WCF

Security Code Review – String Search Patterns For Finding Input Validation Vulnerabilities

Well defined set of search patterns helps significantly reduce time (cost) when performing security code inspections. This post focuses on input validation vulnerabilities commonly found in ASP.NET web applications. SQL Injection and Cross Site Scripting Read More...

Posted 11 July 08 02:24 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

Quickly Find And Fix Cross Site Scripting (XSS) Vulnerabilities In Your ASP.NET Application.

Want to quickly check your ASP.NET Web application for Cross Site Scripting (XSS) vulnerability ? It is pretty easy with the knowledge and tools you already have. This post describes how to quickly find and fix most of XSS vulnerabilities in your code. Read More...

Posted 17 March 08 03:56 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

Security Code Review – Use Visual Studio Bookmarks To Capture Security Findings

How to streamline the process of capturing security flaws during security code review? How to save time and avoid switching between the tools? How to stay focused? In this post I will show my simple technique to capture security flaws using Bookmarks Read More...

Posted 24 January 08 01:38 by alikl | 3 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Practices

Security Tools From Microsoft ACE Team

Mark covers arsenal of security tools available from Microsoft ACE team . The tools are: Threat Analysis & Modeling Enterprise (TAM-E) CAT.NET (Code Analysis Tool) Spider TCM (Assessment and compliance tool) Read More...

Posted 25 October 07 03:35 by alikl | 0 Comments   
Filed under Security, Tools

XSSDetect Public Beta now Available!

XSSDetect public beta is now available for download on MSDN. Overview XSSDetect is a static code analysis tool that helps identify Cross-Site Scripting security flaws found within Web applications. It is able to scan compiled managed assemblies (C#, Visual Read More...

Posted 24 October 07 09:21 by alikl | 1 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Development Phase

Examining WCF Diagnostic Traces Using Service Trace Viewer Tool (SvcTraceViewer.exe)

Service Trace Viewer Tool (SvcTraceViewer.exe) tool comes with Microsoft® Windows® Software Development Kit for Windows Vista™ and .NET Framework 3.0 Runtime Components . It allows to view WCF diagnostics traces in very convenient way. " Using Service Read More...

Posted 23 October 07 02:52 by alikl | 2 Comments   
Filed under WCF, Security, Tools, Deployment Phase, Auditing and Logging

Who Access My File?

In my post File Access Auditing - I Am Not Afraid Of GPO I've digested technet documentation on how to set Active Directory Group Policy Object (AD GP) to enable file access auditing as security measure to prevent repudiation. It is heavy weight techniques Read More...

Posted 03 April 07 07:02 by alikl | 7 Comments   
Filed under Test Phase, Security, Tools, Development Phase, Deployment Phase, Authentication

Security .Net Code Inspection Using Outlook 2007

In my previous post, Code Inspection - First Look For What To Look For , I've described how to look for sensitive data and hints in the compiled assemblies. The other challenge I was looking to solve is boosting my productivity. So with little magic of Read More...

Posted 26 March 07 03:04 by alikl | 8 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Development Phase

Security Deployment Inspection Using Office.

I am a big fun of small time savers to be more productive. JD has the whole category for Effectiveness tag - worth checking on these gems. So I am looking always how to reuse my practices across disciplines I am trying to combine my security engineering Read More...

Posted 22 March 07 08:30 by alikl | 1 Comments   
Filed under Security, Tools, Deployment Phase, Deployment Inspection

Code Inspection - First Look For What To Look For

Reposted from Security Code Inspection - First Look For What To Look For for further reuse on this blog. I found it extremely productive to first look for strings in the code. But what strings to look for? And how to look for the strings? Looking into Read More...

Posted 20 March 07 10:13 by alikl | 8 Comments   
Filed under Test Phase, Security, Information Gathering, Sensitive Data, Tools, Code Inspection, Development Phase

Search

This Blog

• Home
• Email