Uploaded byNiall Merrigan
Defensive programming 101
This document contains various resources for ASP.NET and IIS security including links to documents on web session management security, the OWASP Top 10, ASP.NET security guidance, tools for detecting vulnerabilities like MSCASI and AntiXSS, advice from SDL on SQL injection, and the ASafaWeb site. It also includes links to guidance and tools for securing IIS like security guidance documents, the IIS Lockdown tool, and URLScan. The document concludes with a list of image credits and contact details.
Defensive programming 101
- 37. ASP.NET Resources • Websession management security - http://www.isecpartners.com/files/web-session-management.pdf • OWASP Top 10 by Troy Hunt - http://www.troyhunt.com/2011/12/free- ebook-owasp-top-10-for-net.html • ASP.NET Security Guidance - http://wiki.asp.net/page.aspx/48/security- guidelines-and-recommendations/ • MSCASI tool - http://support.microsoft.com/kb/954476 • AntiXSS Toolkit - http://wpl.codeplex.com/ • ASP.NET Security Guidance - http://blogs.msdn.com/b/nunoc/archive/2006/03/04/543631.aspx • Advice from SDL - http://blogs.msdn.com/b/sdl/archive/2008/05/15/giving-sql-injection- the-respect-it-deserves.aspx • ASafaWeb - http://www.asafeweb.com
- 38. IIS Resources • SecurityGuidance for IIS - http://technet.microsoft.com/en- us/library/dd450371.aspx • IIS Lockdown tool - http://technet.microsoft.com/en- us/library/dd450372(v=ws.10).aspx • URLScan – http://www.iis.net/learn/extensions/working-with- urlscan • IIS Configuring security - http://learn.iis.net/page.aspx/88/configuring-security/ • IIS Security Tools - http://www.iis.net/community/Security
- 39. Image Credits • highscore- http://www.flickr.com/photos/83476873@N0 0/4116381 • G is for Goggles - http://www.flickr.com/photos/60648084@N0 0/2349550374
- 40. Image credits • http://www.flickr.com/photos/darwinbell/412631864/sizes/l/in/photostream/ •http://www.flickr.com/photos/splorp/59231687/sizes/l/in/photostream/ • http://www.flickr.com/photos/wecand/5103599890/sizes/l/in/photostream/ • http://www.flickr.com/photos/darwinbell/2382912185/sizes/z/in/photostream/ • http://www.flickr.com/photos/95565118@N00/922632392 • http://www.flickr.com/photos/49968232@N00/4789356849 • http://www.flickr.com/photos/20195637@N00/2322127250 • http://www.flickr.com/photos/lwr/305130907/sizes/z/in/photostream/ • http://www.flickr.com/photos/baboon/4116381/sizes/z/in/photostream/ • http://www.flickr.com/photos/mrlederhosen/4283136097/sizes/l/in/photostream/ • http://www.flickr.com/photos/30799995@N00/4348942883 • http://www.flickr.com/photos/proimos/4199675334/sizes/z/in/photostream/ • http://www.flickr.com/photos/ianvisits/4000931824/sizes/z/in/photostream/ • http://www.flickr.com/photos/21446836@N00/3117966481 • http://www.flickr.com/photos/41754875@N00/1996389857 • http://www.flickr.com/photos/baboon/2057927/sizes/z/in/photostream/ • http://www.flickr.com/photos/baboon/2057927/sizes/z/in/photostream/ • http://www.flickr.com/photos/limowreck666/223731385/sizes/z/in/photostream/ • http://www.flickr.com/photos/72429059@N00/2982093881 • http://www.flickr.com/photos/qusic/3370510628/sizes/z/in/photostream/ • http://www.flickr.com/photos/ubookworm/71288675/sizes/z/in/photostream/ • http://www.flickr.com/photos/8395041@N02/2505803867
- 41. Contact • Twitter: @nmerrigan •Blog: http://www.certsandprogs.com • Email – via blog ResourcesContact Details Twitter
Editor's Notes
- #4 I am Irish
- #5 But I live in Norway. I am an IT Architect with Laerdalmedical
- #6 Programmers arethe problem. Theyare not nativelysecurityconcious as it takes longer to write and they dont want to break theircode by testing for securityflaws
- #11 Mainly applies to web apps. Leaving admin info systems on the server to be accessedYou can use Google to find this infoYou can find password files, office data files (PST) etcOld files are possible especially you rename in the same directory. Then possible to download source code from your site.Sample: intitle:index.of outlook pstAlso leaving trace output with <trace enabled=“true” and localOnly=“false”> .. Allows access to trace.axd
- #14 Following issue #10Usernames and passwords should be encrypted.Sensitive data should be in encryptedDont write your own Crypto protocols. Can also use google code to find these (especially if you leave personal ones there!!!)http://google.com/codesearch?hl=en&lr=&q=sa+connectionstring+file%3Aweb.config&sbtn=Search
- #17 One of the easiest ways to get caughtVulnerability is not in your code but on the systemEspecially painful on web serversGoogle can be used to find vulnerable web serversRequires you most of the time to pester the local sys admin
- #19 Shouldn’t be the only thing that sanitizes your inputConsider you have a javascript function to see if the number is validUser views source page and sends you the variablesDo validation on both sides to be sure, but definately server side at least.
- #20 Validate all inputs at the server even if client validatedUse a central validation sourceUse white lists rather than blacklistsEscape special charactersValidate against RFC rulesValidate XML against the schema
- #22 You should never show a detailed error message on a production web site.Use CustomErrors in the web.configEither RemoteOnly or OnAgain also turn off Trace and set Debug=“false”
- #23 SQL connection using SA or SysAdm level permissionsRequiring Administrator permissions on the web server!!!!!Requiring Admin privileges for a windows app
- #25 Consider default.aspx?download=filestore/file.exe using BinaryWriteChange the download variableNow default.aspx? download=web.configPage will display the incorrect file and give ideas about what way the machine is configured and possibly access to a lot more.
- #26 Validate your inputChecking for ../ usually wont work due to URLEncodeStrong checking of inputPlacing web apps on separate partitions to system filesCorrect permissionsWeb server fully patchedUsing scanner tools to validate the web server IIS LockdownURL Scan
- #28 HTML & Script Injection3 Main typesDOMNon PersistantPersistantNon persistant is the most common, and persistant is the most dangerous.Certain CMS are vuln, as well as pages taking input and displaying that input back.Other variations include HTTP response splitting, HTTP header injection, remote file inclusionParticularly nastyMore common with scripting languages such as ASP and PHPAllows you to insert your own file to be runNot as relevant to .NET but still can cause a problemExamplehttp://server/file.aspx?redir=page.aspxhttp://server/file.aspx?redir=http://badplace/haha.aspx?Imagine that with a login and similar look of your own site
- #29 Make cookies only accessible to server side code<httpCookies httpOnlyCookies="true">Use cookie based session state to stop session hijacking<sessionState cookieless="UseCookies">Where possible use SSL for authentication cookiesUse unique forms name when using multiple sites with forms auth.Use HtmlEncode to disable special charsMake sure on redirect its only going to where you expect it to be goingSanitize your inputMind your cookies and evaluate web.configs above the web app for vulns
- #33 Allowing straight input to your databaseConsider SELECT * FROM tbl WHERE (Email=‘RequestData’) AND (PASSWORD=’OtherData’)Now consider the inputs ” ‘ OR ‘1’=‘1’ ”SELECT * FROM tbl WHERE (Email=‘’ OR ‘1’=‘1’) AND (PASSWORD=’’ OR ‘1’=‘1’)Worse UPDATE tbl WHERE ID=RequestDataRequestData = 1;DELETE FROM tbl;Worst!RequestData = 1;DROP tbl;Sanitize your inputDont blindly allow access to the database from the front endUse only the permissions required for the optionConsider two level database accessReaderWriterWith SQL Server reduce your permissions to execute only if you are using stored procs
- #36 Trusting your users!!!Sanitize your inputIf you don’t check it, be prepared to deal with the consequences. See issues 2 & 3!Famous examples: Amazon & Komplett