September 6th, 2008 Anthony Towry
ProCheckUp has just published a new ValidateRequest XSS bypass paper. I unfortunately have not had time to verify the information in the paper, but everything I've read appears to be in line with information Micheal Eddington had published earlier this year.
Microsoft has some interesting goodies (patches) coming out this next Tuesday regarding .Net, IE and friends. Related? Maybe.
There's recently been a nice discussion going taking place on the penetration-testing mailing list regarding breaking asp.net applications. There are several ways to introduce XSS vulnerabilities into a asp.net application as developer, but it certainly is one of the more secure web development frameworks. The danger comes in relying on the framework to know what is acceptable and what isn't. ValidateRequest makes a good try, but as this paper states, it's not a complete solution even for the most generic pages.
Use the Anti-XSS library devs!
Posted in Security, Web development | No Comments »
April 25th, 2008 Anthony Towry
Michael Eddington recently posted some interesting information regarding the differences in request validation being used in ASP.NET 1.1 vs. ASP.NET 2.0. In addition to the information he's posting, which are good things to know, I think this should raise a point.
I can't stress this enough, do not rely on framework built-ins for your security. It's easy for developers to get going down the road of relying on framework features. Don't do it. Remember to practice defense in depth and do your own IO validation and encoding in addition to whatever your framework of choice offers.
Thanks Michael.
Posted in Programming, Security, Web development | No Comments »
March 26th, 2008 Anthony Towry
If you haven't heard already, Scott Guthrie has posted some exciting news to his blog regarding the ASP.NET MVC framework. The general geek population now has access to current releases of the code allowing the bravest of developers to build it up, play with it and debug it.
It may be a while before we see serious uptake of this framework, but I could use the lead time.
Posted in Programming, Web development | No Comments »
