Solved

ASP.NET: Hacking

Posted on 2009-04-13
6
230 Views
Last Modified: 2012-05-06
Hi,
At First I want to asure the reader of this thread that I do not have bad intentions. I am willing to learn for better protection of my programs. I read enough material on security and many threats around the net but I practically don't know how they work and I would like to know about the "field" side of the things. Can some one tell me where I can get documentation about how to make a memory overrun on an ASP.NET page for instance? How can to desable and work around Javascript? Or any other mere attack?
0
Comment
Question by:karakav
  • 3
  • 3
6 Comments
 
LVL 15

Expert Comment

by:oobayly
Comment Utility
You shouldn't have to worry about buffer overflows as .Net is managed code. Unless of course you've got unsafe code on your website:
http://stackoverflow.com/questions/156445/is-buffer-overflowoverrun-possible-in-completely-managed-aspnet-c-web-applicati

As long as you validate all user input on the server (don't rely on client-side validation) and make sure that any client input that is written back on a page is santised there shouldn't be any major issues.
In fact as of v.2, ASP.Net will by default throw an exception if the user attempts to post data which looks like html.

Finally, if you're using a database backend, make sure you validate all inputs, and use parameters in the queries, not inlining the values in the SQL queries.
0
 
LVL 4

Author Comment

by:karakav
Comment Utility
I had that whether you set the maximum number of characters a field cannot bypass, there is always a way to bypass that.
0
 
LVL 15

Expert Comment

by:oobayly
Comment Utility
If you mean by specifying the maxlength attribute for a text input form element, yes it can be ignored, and you have to test the length of the value passed. However this isn't the same as a buffer overflow.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 4

Author Comment

by:karakav
Comment Utility
What so ever may concern was about general security issues of ASP.NET  and how they can be avoided. And for that, I need to produce them so that after correctling them I can myself notice that they cannot occur anymore.
0
 
LVL 15

Accepted Solution

by:
oobayly earned 500 total points
Comment Utility
In that case you're going to have to look through all the vulnerabilities known, ie on Secunia and write exploits from the information given.
The problem is that unless you're a security guru, you'll encounter a lot of difficulty doing this. Basically, we (as developers) have to rely on the fact that Microsoft will release patches for vulnerabilities in their poducts. If they don't release an update we have to live with that.
Of course you can go the open source route, and audit the code yourself.

The point is that even if you do find vulnerabilities, how are you going fix them? You're talking about the IIS stack and the .Net Framework here. Not your own code.

Think about it this way, when you get on an aeroplane, you don't test it yourself to ensure it safe. You have to believe on the manufacturer and the airline assurances that it's safe. If you don't believe them, then don't fly.
0
 
LVL 4

Author Closing Comment

by:karakav
Comment Utility
Yeah, this is a nice arguement. Thanks
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

In Part 1 (http://www.experts-exchange.com/Programming/Languages/Scripting/JavaScript/A_7849-Hex-Maze.html) we covered the hexagonal maze basics -- how the cells are represented in a JavaScript array and how the maze is displayed.  In this part, we'…
The task A number given should be formatted for easy reading by separating digits into triads. Format must be made inline via JavaScript, i.e., frameworks / functions are not welcome. So let’s take a number like this “12345678.91¿ and format i…
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)
The viewer will learn the basics of jQuery including how to code hide show and toggles. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now