ASP.NET: Hacking

Hi,
At First I want to asure the reader of this thread that I do not have bad intentions. I am willing to learn for better protection of my programs. I read enough material on security and many threats around the net but I practically don't know how they work and I would like to know about the "field" side of the things. Can some one tell me where I can get documentation about how to make a memory overrun on an ASP.NET page for instance? How can to desable and work around Javascript? Or any other mere attack?
LVL 4
karakavAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
oobaylyConnect With a Mentor Commented:
In that case you're going to have to look through all the vulnerabilities known, ie on Secunia and write exploits from the information given.
The problem is that unless you're a security guru, you'll encounter a lot of difficulty doing this. Basically, we (as developers) have to rely on the fact that Microsoft will release patches for vulnerabilities in their poducts. If they don't release an update we have to live with that.
Of course you can go the open source route, and audit the code yourself.

The point is that even if you do find vulnerabilities, how are you going fix them? You're talking about the IIS stack and the .Net Framework here. Not your own code.

Think about it this way, when you get on an aeroplane, you don't test it yourself to ensure it safe. You have to believe on the manufacturer and the airline assurances that it's safe. If you don't believe them, then don't fly.
0
 
oobaylyCommented:
You shouldn't have to worry about buffer overflows as .Net is managed code. Unless of course you've got unsafe code on your website:
http://stackoverflow.com/questions/156445/is-buffer-overflowoverrun-possible-in-completely-managed-aspnet-c-web-applicati

As long as you validate all user input on the server (don't rely on client-side validation) and make sure that any client input that is written back on a page is santised there shouldn't be any major issues.
In fact as of v.2, ASP.Net will by default throw an exception if the user attempts to post data which looks like html.

Finally, if you're using a database backend, make sure you validate all inputs, and use parameters in the queries, not inlining the values in the SQL queries.
0
 
karakavAuthor Commented:
I had that whether you set the maximum number of characters a field cannot bypass, there is always a way to bypass that.
0
The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

 
oobaylyCommented:
If you mean by specifying the maxlength attribute for a text input form element, yes it can be ignored, and you have to test the length of the value passed. However this isn't the same as a buffer overflow.
0
 
karakavAuthor Commented:
What so ever may concern was about general security issues of ASP.NET  and how they can be avoided. And for that, I need to produce them so that after correctling them I can myself notice that they cannot occur anymore.
0
 
karakavAuthor Commented:
Yeah, this is a nice arguement. Thanks
0
All Courses

From novice to tech pro — start learning today.