A presentation by Joshua Bradley, DNN developer, on the subject of developing more secure modules for DNN (formerly DotNetNuke) and Evoq CMS. While DNN, and .Net in general, are very good at protecting you from the biggest security attacks, they can't protect you from writing bad code. With security in web development getting increasingly more important it is good to take a moment and make sure you're not shooting yourself in the foot with your module development. This talk will go over XSS (Cross-Site scripting), CSRF (Cross-Site Request Forgery), and SQLi (SQL Injection), to make sure that you are not opening yourself up to potential vulnerabilities when developing your modules.

1. @DNNConDon’t forget to include #DNNCon in your tweets!
Are There Security Flaws in Your
Modules?
Joshua Bradley / Web Developer
Engage Software
@JRBradley1

2. @DNNConDon’t forget to include #DNNCon in your tweets!
THANKS TO ALL OF OUR GENEROUS
SPONSORS!

3. @DNNConDon’t forget to include #DNNCon in your tweets!
Agenda
• Introduction
• Cross Site Scripting
• SQL Injection
• Cross Site Request Forgery
• Insecure Direct Object
References
• Q & A

4. @DNNConDon’t forget to include #DNNCon in your tweets!
Goal
For Developers
-To think about possible security
vulnerabilities while developing your
modules.
For Everyone
-Be able to recognize potential
vulnerabilities when testing websites.

5. @DNNConDon’t forget to include #DNNCon in your tweets!
Introduction

6. @DNNConDon’t forget to include #DNNCon in your tweets!
Cross Site Scripting

7. @DNNConDon’t forget to include #DNNCon in your tweets!
Reflective XSS

8. @DNNConDon’t forget to include #DNNCon in your tweets!
Reflective XSS
Example

9. @DNNConDon’t forget to include #DNNCon in your tweets!
Stored XSS

10. @DNNConDon’t forget to include #DNNCon in your tweets!
Stored XSS
Example

11. @DNNConDon’t forget to include #DNNCon in your tweets!
XSS Summary
• Html Encode when not needing
HTML
• Use Anti XSS library when
needing to accept HTML from
user input.

12. @DNNConDon’t forget to include #DNNCon in your tweets!
SQL Injection

13. @DNNConDon’t forget to include #DNNCon in your tweets!
SQLi
Example

14. @DNNConDon’t forget to include #DNNCon in your tweets!
SQLi Summary
• Never do string concatenation
with SQL.
• Use an ORM or Parameterized
Stored Procedure.

15. @DNNConDon’t forget to include #DNNCon in your tweets!
Cross Site Request Forgery

16. @DNNConDon’t forget to include #DNNCon in your tweets!
CSRF
Example

17. @DNNConDon’t forget to include #DNNCon in your tweets!
CSRF Summary
• Use HttpPost
• ValidateAntiForgery
• Never Allow Access from any
host

18. @DNNConDon’t forget to include #DNNCon in your tweets!
Insecure Direct Object References

19. @DNNConDon’t forget to include #DNNCon in your tweets!
IDOR
Example

20. @DNNConDon’t forget to include #DNNCon in your tweets!
IDOR Summary
• Use built in Folder and File
Manager.
• Avoid using user input when
selecting file.

21. @DNNConDon’t forget to include #DNNCon in your tweets!
Available on GitHub & Slideshare
• http://www.engagesoftware.com/blog

22. @DNNConDon’t forget to include #DNNCon in your tweets!
Questions
@JRBradley1

23. @DNNConDon’t forget to include #DNNCon in your tweets!
Resources
• https://www.owasp.org/index.php/OW
• http://www.dnnsoftware.com/wi
ki/analysis-of-dotnetnuke-
compliance-against-owasp-top-
10-2013

24. @DNNConDon’t forget to include #DNNCon in your tweets!
Resources
• http://www.troyhunt.com/2012/12/sto
• https://www.owasp.org/index.php/Ma
• http://www.jwaffinityit.com/Portals/28

25. @DNNConDon’t forget to include #DNNCon in your tweets!
Resources
• https://msdn.microsoft.com/en-us/libr
aspx
• https://
weblog.west-wind.com/posts/2012/Ju
• http://
www.computerweekly.com/tip/C
ross-site-request-forgery-
Lessons-from-a-CSRF-attack-
example

26. @DNNConDon’t forget to include #DNNCon in your tweets!
Resources
• http://resources.infosecinstitute
.com/dumping-a-database-
using-sql-injection/
• https://www.sql-
programmers.com/sql-
injection.aspx
• https://msdn.microsoft.com/en-
us/library/bb386929.aspx
• https://msdn.microsoft.com/en-
us/library/cc716760.aspx

27. @DNNConDon’t forget to include #DNNCon in your tweets!
Resources
• http://www.troyhunt.com/2013/
07/everything-you-wanted-to-
know-about-sql.html
• https://github.com/malcomvett
er/WidgetSender