This document discusses various tools and techniques for security testing and debugging web applications developed in C#. It provides information on static analysis tools like FxCop and CAT.NET that can analyze source code. It also covers automated testing tools like NUnit, HTMLUnit, and Selenium that can test web applications without using a real browser. The document demonstrates how to integrate these tools into testing workflows and addresses related topics like logging, exception handling, and custom error pages.

1. Security
Testing/Debugging
From Rich Helton’s October 2010
C# Web Security

2. Security Testing
-FXCop
-CAT.NET
-Nunit
-HTMLUnit
-Seleniumin

3. White Box Testing
 White-Box testing is testing the system based on the internal
perspective of the system.
 In this case, this is also known as Static Analysis.
 These tools can find issues with the source code before the code is
actually executed.
 A list of tools can be found at
http://en.wikipedia.org/wiki/List_of_tools_for_static_code_anal
ysis

4. CAT.NET
(A plugin that can be added from the Windows SDK)
 CAT.NET can be used with Visual Studio to analyze the current
solution, here is a Visual Studio 2008 popup after selecting Tools-
>CAT.NET Analysis Tool from the menu:

5. CAT.NET
(After pushing the Excel report button)

6. FXCop
 CAT.NET rules can can be run in FXCop instead of Visual Studio.
 FXCop examines the assemblies and object code and not the
source. It can be downloaded as part of the Windows SDK.

7. NUNIT
 White-Box testing is testing the system based on the internal
perspective of the system.
 See www.nunit.org
 These tools can find issues with the source code before the code is
actually executed.
 A list of tools can be found at
http://en.wikipedia.org/wiki/List_of_tools_for_static_code_anal
ysis

8. NUNIT

9. Headless Browser
 Headless Browser Automation
 Can replicate a real world browser.
 Can automate the test.
 Provides low-level control over the HTML and HTTP.
 Reference http://blog.stevensanderson.com/2010/03/30/using-
htmlunit-on-net-for-headless-browser-automation/

10. HTMLUnit steps
 Download HTMLUnit http://sourceforge.net/projects/htmlunit/
 Download IKVM http://sourceforge.net/projects/ikvm/files/
 Create the HTMLUnit DLL:
 Run “ikvmc –out:htmlunit-2.7.dll *.jar”
 Include the htmlunit, IKVM.OpenJDK, and nunit dll’s in the
external assemblies.
 Can automate the test.
 Provides low-level control over the HTML and HTTP.
 Reference http://blog.stevensanderson.com/2010/03/30/using-
htmlunit-on-net-for-headless-browser-automation/

11. What about the HTML?
 HTTPUnit is great for HTTP Requests and Responses, but what if I
want to parse the HTML code directly from the Web Server and
examine the HTML before doing any work.
 HTMLUnit allows a “getPage()” routine to examine the HTML
source code.
 This allows the walking through of “HREF”, images, and others pieces of the
HTML code before executing on the item.
 Selenium IDE is another Open Source concept that is a Integrated
Development Environment running on top of the FireFox browser
as a plugin.
 This allows a recording of the browser actions that can be played back execute
buttons being pushed and actions inside the browser.
 Assertions can be executed on the HTML pages itself for checking specific
information.
 The test itself can be exported into Junit Java code to execute in Java.

12. HtmlUnit on C#

13. HtmlUnit on C# (Nunit Test)
(Under Construction page)

14. HtmlUnit on C# (Nunit Test)
(Page not found)

15. Selenium IDE
 Selenium IDE is another Open Source concept that is a Integrated
Development Environment running on top of the FireFox browser
as a plugin.
 Supports load testing.
 This allows a recording of the browser actions that can be played
back execute buttons being pushed and actions inside the browser.
 Assertions can be executed on the HTML pages itself for checking
specific information.
 The test itself can be exported into Java, .NET, Perl, Ruby, etc, and
then code to execute the tests in that language.

16. Selenium IDE Test

17. Does the framework matter?
 JWebUnit wraps both HTMLUnit and Selenium so that code can
be written for either framework using a unified framwork.
 This way code can once in a single framework and executed using
multiple HTML frameworks. http://jwebunit.sourceforge.net/

18. Security Debugging
-Logging
-Exceptions
-Log4Net
-NLog
-Error Pages

19. Has my system been compromised?
 Logging and Error handling is one of the most important concept
in Security.
 When an incident happens, the first questions are always “How
did they get in?” and “What data was compromised?”.
 The least favorite answer is usually “No one knows.”
 With efficient logging of authorization, access to secure
information, and any anomalous interaction with the system, a
proper recovery of the system is usually insured.
 The logs should be store into a different system in case the Web
system is ever compromised, one where the Web system sends
them but never asks for them back.
 Logging is a fundamental API that comes with the Java and .NET
languages.

20. Logging the C# way….
using System;
using System.Diagnostics;
class EventLogExample
{
static void Main(string[] args)
{
string sSource = "my warning message";
string sLog = "Application";
string sEvent = "Sample Event";
if (!EventLog.SourceExists(sSource))
EventLog.CreateEventSource(sSource, sLog);
EventLog.WriteEntry(sSource, sEvent);
EventLog.WriteEntry(sSource, sEvent,
EventLogEntryType.Warning, 234);
}
}

21. The C# Logger output….

22. Exception Handling
 Exception handling has helped debugging immensely. It allows a
programmer to code for anomalies and handle a bizarre
behavior.
 There are 3 components of handling an exception, and they are
the “try”, “catch” and “finally” blocks.
 The “try” block will throw an exception from normal code, the
“catch” block will catch the exception and handle it, and the
“finally” block will process the cleanup afterwards.
 The “catch” block can log the anomaly, stop the program, or
process it in a hundred different ways.
 You can write your own custom exception classes to trace specific
pieces of code.

23. C# Exception Handling code….
class TestException{
static void Main(string[] args){
StreamReader myReader = null;
try{
// constructor will throw FileNotFoundException
myReader = new StreamReader("IamNotHere.txt");
}catch (FileNotFoundException e){
Console.WriteLine("FileNotFoundException was {0}", e.Message);
}catch (IOException e){
Console.WriteLine("IOException was {0}" + e.Message);
}finally{
if (myReader != null){
try{
myReader.Close();
}catch (IOException e){
Console.WriteLine("IOException was {0}" + e.Message);}}}}}
Output-> FileNotFoundException was Could not find file ‘C:IamNotHere.txt'.

24. Log4net
 The previous logging and exception handling example has many
hard coded pieces. Log4Net offers more de-coupling by being
separated as highly configurable framework.
 http://logging.apache.org/log4net/
 Even though the basic CLR logging framework can accept
changes on destination through its Handler in the
“logging.properties”, Log4Net offers more advanced features in
its XML use of its Appender class.
 Log4Net supports XML configuration and a text configuration in
log4Net.properties.
 Log4Net supports Appenders that will append the logs to
databases, emails, files, etc.
http://logging.apache.org/log4net/release/config-examples.html

25. Log4Net ASP.NET code

26. Log4j Console output

27. Adding an Appender #1
 Let’s read the XML Appender from app.config.
 Change the BasicConfigurator to XmlConfigurator:

28. Adding an Appender #2
 Add app.config for "c:Loglog.txt”:

29. Adding an Appender Running
 Reading "c:Loglog.txt”:

30. NLog
 Nlog is similar to Log4Net. The difference is that Log4Net is a
.Net version of Log4J and is a framework. NLog is a plugin to
Visual Studio with templates.
 http://nlog-project.org/

31. NLog
 Adding log configuration with Visual 2010 plugin:

32. NLog
 When debugging from VS2010, the default logging directory
maps to C:Program FilesCommon FilesMicrosoft
SharedDevServer10.0 .
 This Nlog.config will append the logger in to a file named after
the classname, i.e Webapplication1._Default.txt:

33. Nlog code
 From the WebApplication1 Class, Default.aspx.cs code:

34. Nlog log file
 Printing the Webapplication1._Default.txt:

35. Error Pages
 Default Error pages may display unintentional information. For
instance, some error pages may display database information in
an exception.
 An error page giving details, like a database or table name, may
be more than enough to give an attacker enough information
launch an attack at the website.
 To correct bad error handling in pages, Tomcat, Struts and other
Web engines will allow default configurations to throw a specific
error page for any unknown exceptions. For instance, many Web
Application Firewalls (WAFs) will generate a error page 500
“Internal Server Error” for blocking an attack.

36. Hackme Books
(Bad error handling)

37. Send something more generic
(based on business input)

38. Web Error pages….
Many web sites use the default error pages that show the user
exceptions and even exceptions into the database. The database
exceptions have a tendency to display table names and invalid SQL
statements that can be used for further probing.
To send all errors to a custom Error page, the web.config file for IIS:
<customErrors mode="On"
defaultRedirect="errors/ErrorPage.aspx">
</customErrors>

39. Custom Errors in ASP.NET
 A good resource on the issue is
http://www.codeproject.com/KB/aspnet/customerrorsinaspnet.as
px
 The idea is to redirect the error to a generic error.html page by the
web.config configuration.

40. Send something more generic
(based on business input)