Application Security Audit of an .NET Web Application?

Anyone have suggestions for security auditing of an .NET Web Application?

I'm interested in all options. I'd like to be able to have something agnostically probe my application for security risks.

EDIT:

To clarify, the system has been designed with security in mind. The environment has been setup with security in mind. I want an independent measure of security, other than - 'yeah it's secure'... The cost of having someone audit 1M+ lines of code is probably more expensive than the development. It looks like there really isn't a good automated/inexpensive approach to this yet. Thanks for your suggestions.

The point of an audit would be to independently verify the security that was implemented by the team.

BTW - there are several automated hack/probe tools to probe applications/web servers, but i'm a bit concerned about whether they are worms or not...

From stackoverflow

• One of the first things that I have started to do with our internal application is use a tool such as Fortify that does a security analysis of your code base.

  Otherwise, you might consider enlisting the services of a third-party company that specializes in security to have them test your application

• Anyone in your situation has the following options available:

  1. Code Review,
  2. Static Analysis of the code base using a tool,
  3. Dynamic Analysis of the application at run time.

  Mitchel has already pointed out the use of Fortify. In fact, Fortify has two products to cover the areas of static and dynamic analysis - SCA (static analysis tool, to be used in development) and PTA (that performs analysis of the application as test cases are executed during testing).

  However, no tool is perfect and you can end up with false positives (fragments of your code base although not vulnerable will be flagged) and false negatives. Only a code review could solve such problems. Code reviews are expensive - not everyone in your organization would be capable of reviewing code with the eyes of a security expert.

  To begin, with one can start with OWASP. Understanding the principles behind security is highly recommended before studying the OWASP Development Guide (3.0 is in draft; 2.0 can be considered stable). Finally, you can prepare to perform the first scan of your code base.

• Testing and static analysis is a very poor way to find security vulnerabilities, and is really a method of last resort if you haven't thought of security throughout the design and implementation process.

  The problem is that you are now trying to enumerate all of the ways your application could fail, and deny those (by patching), rather than trying to specify what your application should do, and prevent everything that isn't that (by defensive programming). Since your application probably has infinite ways to go wrong and only a few things that it is meant to do, you should take an approach of 'deny by default' and allow only the good stuff.

  Put it another way, it's easier and more effective to build in controls to prevent whole classes of typical vulnerabilities (for examples, see OWASP as mentioned in other answers) no matter how they may arise, than it is to go looking for which specific screwup some version of your code has. You should be trying to evidence the presence of good controls (which can be done), rather than the absence of bad stuff (which can't).

  If you get somebody to review your design and security requirements (what exactly are you trying to protect against?), with full access to code and all details, that will be more valuable than some kind of black box test. Because if your design is wrong then it won't matter how well you implemented it.

• Best Thing to do:

  • Hiring a security guy for source code analysis
  • Second best thing to do hiring a security guy / pentesting company for black-box analysis

  Following tools will help :

  • Static Analysis Tools Fortify / Ounce Labs - Code Review
  • Consider solutions such as HP WebInspects's secure object (VS.NET addon)
  • Buying a blackbox application scanner such as Appscan, WebInspect, Hailstorm, Acunetix

  Hiring some security specialist is so much better idea (will cost more though) because they won't only find injection and technical issues where an automated tool might find, they will also find all logical issues as well.

• We have used Telus to conduct Pen Testing for us a few times and have been impressed with the results.

• May I recommend you contact Artec Group, Security Compass and Veracode and check out their offerings...

Stored Procedure, can you help me?

Below is my stored procedure. I want use stored procedure select all row of date from tbl_member and insert 2 table. But it's not work. Some one can help me?

Create PROCEDURE sp_test
AS
BEGIN
    SET NOCOUNT ON;

    Declare @A Varchar(255), @B Varchar(255), @C Varchar(255), @D int

    Declare Table_Cursor Cursor 
    For select A, B, C from tbl_Member Open Table_Cursor 
        Fetch Next From Table_Cursor 
        Into @A, @B, @C While(@@Fetch_Status=0)

    Begin Exec(
        'insert into NewMember (A, B, C, D) values (@A, @B, @C, @D)
        set @D = @@IDENTITY
        Insert into MemberId (Mid) VALUES(@D)   
    )
    Fetch Next From Table_Cursor Into @A, @B, @C End Close Table_Cursor
    Deallocate Table_Cursor
END
GO

From stackoverflow

• The first thing I can see here is that you are using a cursor when you don't need to. You can rewrite the first query as:

  INSERT INTO NewMember(A, B, C, D)
  SELECT A, B, C, D
  FROM tbl_member
  

  Then, I would have an INSERT trigger against NewMember that inserted the identity column.

  create trigger myInsertTrigger
  on newmember
  for insert
  as
  insert into memberid(mid)
  select <<identity_column>> from inserted
  

  BTW - it's a bad idea to use @@IDENTITY to get the identity of an insert. Use the SCOPE_IDENTITY function instead.

• Please pay particular attention to what Pete said about @@identity. The reason it is bad to ever use @@identity is that if a trigger is ever added to the table that inserts to another table with an identity, that is the identity that is returned not the one you just inserted. This can lead to massive data integrity problems that may not be caufght for months.

  Even if you kept the cursor (which I do not recommend, cursors are a very bad way to do inserts as they are very slow compared to the set-based solution that Pete gave), your code could not do the insert to the first table if column D is the identity column (which I would guess it is since you later try to assign D to the identity value). That is because you are trying to put a value into a column that cannot accept a value as it is autogenerated. If D is the identity then do not use it inthe insert at all, just define the columns you need to insert into. This would be true of Pete's solution as well, if D is in fact your identity column.

How much input validation should I be doing on my python functions/methods?

I'm interested in how much up front validation people do in the Python they write.

Here are a few examples of simple functions:

def factorial(num):
    """Computes the factorial of num."""

def isPalindrome(inputStr):
    """Tests to see if inputStr is the same backwards and forwards."""

def sum(nums):
    """Same as the built-in sum()... computes the sum of all the numbers passed in."""

How thoroughly do you check the input values before beginning computation, and how do you do your checking? Do you throw some kind of proprietary exception if input is faulty (BadInputException defined in the same module, for example)? Do you just start your calculation and figure it will throw an exception at some point if bad data was passed in ("asd" to factorial, for example)?

When the passed in value is supposed to be a container do you check not only the container but all the values inside it?

What about situations like factorial, where what's passed in might be convertible to an int (e.g. a float) but you might lose precision when doing so?

From stackoverflow

• I basically try to convert the variable to what it should be and pass up or throw the appropriate exception if that fails.

  def factorial(num):
      """Computes the factorial of num."""
      try:
          num = int(num)
      except ValueError, e:
          print e
      else:
          ...
  

  S.Lott : I prefer not to print anything. Either leave the exception alone or raise something else. print's get confusing.

• It rather depends on what I'm writing, and how the output gets there. Python doesn't have the public/private protections of other OO-languages. Instead there are conventions. For example, external code should only call object methods that are not prefixed by an underscore.

  Therefore, if I'm writing a module, I'd validate anything that is not generated from my own code, i.e. any calls to publicly-accessible methods/functions. Sometimes, if I know the validation is expensive, I make it togglable with a kwarg:

  def publicly_accessible_function(arg1, validate=False):
    if validate:
      do_validation(arg1)
     do_work
  

  Internal methods can do validation via the assert statement, which can be disabled altogether when the code goes out of development and into production.

• I'm trying to write docstring stating what type of parameter is expected and accepted, and I'm not checking it explicitly in my functions.

  If someone wants to use my function with any other type its his responsibility to check if his type emulates one I accept well enough. Maybe your factorial can be used with some custom long-like type to obtain something you wouldn't think of? Or maybe your sum can be used to concatenate strings? Why should you disallow it by type checking? It's not C, anyway.

• I assert what's absolutely essential.

  Important: What's absolutely essential. Some people over-test things.

  def factorial(num):
      assert int(num)
      assert num > 0
  

  Isn't completely correct. long is also a legal possibility.

  def factorial(num):
      assert type(num) in ( int, long )
      assert num > 0
  

  Is better, but still not perfect. Many Python types (like rational numbers, or number-like objects) can also work in a good factorial function. It's hard to assert that an object has basic integer-like properties without being too specific and eliminating future unthought-of classes from consideration.

  I never define unique exceptions for individual functions. I define a unique exception for a significant module or package. Usually, however, just an Error class or something similar. That way the application says except somelibrary.Error,e: which is about all you need to know. Fine-grained exceptions get fussy and silly.

  I've never done this, but I can see places where it might be necessary.

  assert all( type(i) in (int,long) for i in someList ) 
  

  Generally, however, the ordinary Python built-in type checks work fine. They find almost all of the exceptional situations that matter almost all the time. When something isn't the right type, Python raises a TypeError that always points at the right line of code.

  BTW. I only add asserts at design time if I'm absolutely certain the function will be abused. I sometimes add assertions later when I have a unit test that fails in an obscure way.

  Nathan : > When something isn't the right type, Python raises a TypeError that always points at the right line of code. This is not strictly true. If your function is performing an operation on some instance data which was set earlier on then it can be very challenging to determine why the value is the wrong type.

  S.Lott : Why it's the wrong type is different from actually **being** the wrong type. If your logic is tortured and complex and you can't spot the places where variables are set, you need to rethink your algorithm. Really. Assignment statements should be obvious. They have `=` and they are -- arguably -- the most important statements because they change the state of your computation. I'm not sure I see what's challenging unless you're having trouble finding the assignment statements.

• For calculations like sum, factorial etc, pythons built-in type checks will do fine. The calculations will end upp calling add, mul etc for the types, and if they break, they will throw the correct exception anyway. By enforcing your own checks, you may invalidate otherwise working input.

• I almost never enforce any kind of a check, unless I think there's a possibility that someone might think they can pass some X which would produce completely crazy results.

  The other time I check is when I accept several types for an argument, for example a function that takes a list, might accept an arbitrary object and just wrap it in a list (if it's not already a list). So in that case I check for the type -not to enforce anything- just because I want the function to be flexible in how it's used.

• Only bother to check if you have a failing unit-test that forces you to.

  Also consider "EAFP"... It's the Python way!

blackberry development, is it as userfriendly as smartphone dev?

Hi,

I have played around with smart phone development (windows ce), and it seemed pretty straight forward using vs.net and having a nice emulator etc.

How is blackberry development? Seeing as it uses JavaME I am guessing learning the SDK/syntax for a .net developer wouldn't be that hard to get going with.

But what about the development IDE, debugging, emulators etc.?

From stackoverflow

• I have very limited experience with the Blackberry, but from what I do have, it is fairly user friendly. Java is fairly similar to C# which you would have probably used for CE development.

  You will probably use Eclipse for the IDE which is good once you get used to it. It will probably frustrate you a bit coming from Visual Studio, but give it a chance.

  As for debugging and emulators, from my limited experience, no problems there. Actually, I find the Blackberry a much nicer platform than any of the CE devices in many ways.

  There is a Visual Studio plugin for Blackberry development too, but it requires that a runtime be installed on the Blackberries that use the programs developed, so it is only really useful for Enterprise apps where you have control over the users' phones.

• I actually just purchased a blackberry for this very reason. You can use the Eclipse IDE and then install the JDE plugin. The JDE plugin includes the blackberry sdk as well as some emulators.

  EDIT - http://na.blackberry.com/eng/developers/javaappdev/

  I encountered a snag a couple weeks ago when I was setting up the environment, however, I found my solution in the blackberry forums. YMMV

• There's also a another Blackberry development environment called "Blackberry MDS studio" It's an alternative to Java. I know for some of my colleagues who are Lotus Notes developers favor this IDE as it's more visual. Personally I prefer the Java one being a Java developer.

• The support community are pretty quick to respond to well-written questions from people who've obviously put some thought into what they are writing. RIM are also quick to release new simulator updates for new phones, which I've had problems with in the past from other manufacturers.

  Richard Campbell : Not in my experience, which is admittedly somewhat dated now. Especially reporting bugs to RIM was useless. The 8700, for example, used to reproducibly reboot if a bluetooth headset was active and you tried to use a udp connection.

• BlackBerry provides a Java Development Environment that has a number of integrated tools (notably coverage, memory usage and profiling) in addition to a syntax highlighting and "smart insertion" editor, compiler and debugger. The BlackBerry code signing tools, JAD and COD generation are also included.

  I found that it was much easier for me to develop code in Eclipse, compile it with Ant (using etaras' RAPC ant tasks, but they seem to be gone -- BlackBerry Ant Tools seem to be a suitable replacement) and use the JDE for debugging/profiling, etc.

  I've not used the new RIM Eclipse Plugin.

  The MDS Studio has both Eclipse and Visual Studio based environments. I found it handy for prototyping UIs but rather cumbersome for doing any custom development. BB markets it as "Rapid Application Development", and it has that paradigms strengths and weaknesses.

  I found BlackBerry development to be much like other specialized Java based applications -- if you develop standard J2ME Midlet Apps, you don't need to know much more. If you really want to take advantage of the BlackBerry's unique features, integrate with BB applications, etc., then you need to learn the BlackBerry specific APIs - the javadoc is pretty good, the forums and whitepapers help, but there are few real "overview" documents or papers to tell you how to put it all together.

  Caveat Emptor, YMMV, etc, ad nauseum.

How do I hide the next/today/previous navigation in jQuery DatePicker and turn off animations?

How do I hide the prev/today/next navigation in jQuery DatePicker?

I'm happy with just the Month and Year drop down boxes.

Also how do I disable the animations?

@tvanfosson - I already tried 'hideIfNoPrevNext' but that only works if you don't have a date range that spans two months. The duration option did the trick at turning off the animations though. Cheers.

Thanks
Kev

From stackoverflow

• You can find the options for the DatePicker control at http://docs.jquery.com/UI/Datepicker/datepicker#options. Specifically, I think you want to set hideIfNoPrevNext to true and set duration to ''.

    $('#cal').datepicker( { hideIfNoPrevNext: true, duration: '' } );
  

• You can hide prev/next navigation via css. You can see examples which do it in themes http://marcgrabanski.com/pages/code/jquery-ui-datepicker

  Kev : I eventually worked it out by fiddling with the CSS theme, but thanks for the answer.

• Just hide buttons

  $("div.ui-datepicker-header a.ui-datepicker-prev,div.ui-datepicker-header a.ui-datepicker-next").hide();
  

ASP.NET AJAX No update of screen on partial postback

We have an issue on our page whereby the first time a button posts back (we have ASP.NET ajax to enable partial updates) nothing happens, then on every subsequent click, the information is updated as if the previous event fired.

Here's the code for the page. The events are button clicks fired from within the table. Which is rerendered at the backend.

<asp:ScriptManager EnablePartialRendering="true" ID="scrptMgr1" runat="server">
    </asp:ScriptManager>
    <asp:UpdatePanel runat="server" ID="folderContainer">
        <ContentTemplate>
            <asp:Table id="FolderTable" CssClass="FolderTable" runat="server" CellSpacing="0"></asp:Table>
        </ContentTemplate>
    </asp:UpdatePanel>

Any ideas?

Thanks.

From stackoverflow

• Did you try an HTML table, with or without runat="server" ?

  Do you add or remove controls inside the table in the postback?

  Rob Stevenson-Leggett : Yes we completely rebuild the table within the postback

• Your table is probably being populated too late in the page lifecycle. Try creating the table in PreInit.

  Rob Stevenson-Leggett : I've tried moving it to PreInit and the code goes through fine but now I get a blank page... odd.

  devio : why is this then the accepted answer?

• Inspired by Robert's answer:

  In which event handler do you build your table? If you build it in Page_Load without checking IsPostBack), then the button's click event has not been handled yet.

  You need to build the table in the button click handler.

Sending HTML emails that renders correctly in Notes 7

Does anyone here has any experience on how to send HTML emails that renders correctly on a Lotus Notes Client 7?

My email has a couple of complex CSS files and I tried embedding them on <style> tags, but it doesn't seem to work. The thing is that the email renders perfectly in version 8 and on other email clients.

Any hints or pointers?

Thanks!

From stackoverflow

• Here's a good chart for various email clients. Unfortunately only Notes 6 is covered at this point, but it gives you a starting point.

  http://www.campaignmonitor.com/css/

• Lotus Notes 7 has a terrible HTML engine. Really awful. It's not you.

  Here's some old advice about dealing with it. I also suggest signing up for an email testing service like Litmus. You're never going to fix the problem, if you can't see the problem.

  (In the template I was using, I found the problem was actually in the HTML. It has some sort of bizarre problem with the box model. Wrapping a bunch of elements in DIVs helped)