SlideShare ist ein Scribd-Unternehmen logo
1 von 40
Downloaden Sie, um offline zu lesen
Security
Testing/Debugging
From Rich Helton’s October 2010
C# Web Security
Security Testing
-FXCop
-CAT.NET
-Nunit
-HTMLUnit
-Seleniumin
White Box Testing
 White-Box testing is testing the system based on the internal
perspective of the system.
 In this case, this is also known as Static Analysis.
 These tools can find issues with the source code before the code is
actually executed.
 A list of tools can be found at
http://en.wikipedia.org/wiki/List_of_tools_for_static_code_anal
ysis
CAT.NET
(A plugin that can be added from the Windows SDK)
 CAT.NET can be used with Visual Studio to analyze the current
solution, here is a Visual Studio 2008 popup after selecting Tools-
>CAT.NET Analysis Tool from the menu:
CAT.NET
(After pushing the Excel report button)
FXCop
 CAT.NET rules can can be run in FXCop instead of Visual Studio.
 FXCop examines the assemblies and object code and not the
source. It can be downloaded as part of the Windows SDK.
NUNIT
 White-Box testing is testing the system based on the internal
perspective of the system.
 See www.nunit.org
 These tools can find issues with the source code before the code is
actually executed.
 A list of tools can be found at
http://en.wikipedia.org/wiki/List_of_tools_for_static_code_anal
ysis
NUNIT
Headless Browser
 Headless Browser Automation
 Can replicate a real world browser.
 Can automate the test.
 Provides low-level control over the HTML and HTTP.
 Reference http://blog.stevensanderson.com/2010/03/30/using-
htmlunit-on-net-for-headless-browser-automation/
HTMLUnit steps
 Download HTMLUnit http://sourceforge.net/projects/htmlunit/
 Download IKVM http://sourceforge.net/projects/ikvm/files/
 Create the HTMLUnit DLL:
 Run “ikvmc –out:htmlunit-2.7.dll *.jar”
 Include the htmlunit, IKVM.OpenJDK, and nunit dll’s in the
external assemblies.
 Can automate the test.
 Provides low-level control over the HTML and HTTP.
 Reference http://blog.stevensanderson.com/2010/03/30/using-
htmlunit-on-net-for-headless-browser-automation/
What about the HTML?
 HTTPUnit is great for HTTP Requests and Responses, but what if I
want to parse the HTML code directly from the Web Server and
examine the HTML before doing any work.
 HTMLUnit allows a “getPage()” routine to examine the HTML
source code.
 This allows the walking through of “HREF”, images, and others pieces of the
HTML code before executing on the item.
 Selenium IDE is another Open Source concept that is a Integrated
Development Environment running on top of the FireFox browser
as a plugin.
 This allows a recording of the browser actions that can be played back execute
buttons being pushed and actions inside the browser.
 Assertions can be executed on the HTML pages itself for checking specific
information.
 The test itself can be exported into Junit Java code to execute in Java.
HtmlUnit on C#
HtmlUnit on C# (Nunit Test)
(Under Construction page)
HtmlUnit on C# (Nunit Test)
(Page not found)
Selenium IDE
 Selenium IDE is another Open Source concept that is a Integrated
Development Environment running on top of the FireFox browser
as a plugin.
 Supports load testing.
 This allows a recording of the browser actions that can be played
back execute buttons being pushed and actions inside the browser.
 Assertions can be executed on the HTML pages itself for checking
specific information.
 The test itself can be exported into Java, .NET, Perl, Ruby, etc, and
then code to execute the tests in that language.
Selenium IDE Test
Does the framework matter?
 JWebUnit wraps both HTMLUnit and Selenium so that code can
be written for either framework using a unified framwork.
 This way code can once in a single framework and executed using
multiple HTML frameworks. http://jwebunit.sourceforge.net/
Security Debugging
-Logging
-Exceptions
-Log4Net
-NLog
-Error Pages
Has my system been compromised?
 Logging and Error handling is one of the most important concept
in Security.
 When an incident happens, the first questions are always “How
did they get in?” and “What data was compromised?”.
 The least favorite answer is usually “No one knows.”
 With efficient logging of authorization, access to secure
information, and any anomalous interaction with the system, a
proper recovery of the system is usually insured.
 The logs should be store into a different system in case the Web
system is ever compromised, one where the Web system sends
them but never asks for them back.
 Logging is a fundamental API that comes with the Java and .NET
languages.
Logging the C# way….
using System;
using System.Diagnostics;
class EventLogExample
{
static void Main(string[] args)
{
string sSource = "my warning message";
string sLog = "Application";
string sEvent = "Sample Event";
if (!EventLog.SourceExists(sSource))
EventLog.CreateEventSource(sSource, sLog);
EventLog.WriteEntry(sSource, sEvent);
EventLog.WriteEntry(sSource, sEvent,
EventLogEntryType.Warning, 234);
}
}
The C# Logger output….
Exception Handling
 Exception handling has helped debugging immensely. It allows a
programmer to code for anomalies and handle a bizarre
behavior.
 There are 3 components of handling an exception, and they are
the “try”, “catch” and “finally” blocks.
 The “try” block will throw an exception from normal code, the
“catch” block will catch the exception and handle it, and the
“finally” block will process the cleanup afterwards.
 The “catch” block can log the anomaly, stop the program, or
process it in a hundred different ways.
 You can write your own custom exception classes to trace specific
pieces of code.
C# Exception Handling code….
class TestException{
static void Main(string[] args){
StreamReader myReader = null;
try{
// constructor will throw FileNotFoundException
myReader = new StreamReader("IamNotHere.txt");
}catch (FileNotFoundException e){
Console.WriteLine("FileNotFoundException was {0}", e.Message);
}catch (IOException e){
Console.WriteLine("IOException was {0}" + e.Message);
}finally{
if (myReader != null){
try{
myReader.Close();
}catch (IOException e){
Console.WriteLine("IOException was {0}" + e.Message);}}}}}
Output-> FileNotFoundException was Could not find file ‘C:IamNotHere.txt'.
Log4net
 The previous logging and exception handling example has many
hard coded pieces. Log4Net offers more de-coupling by being
separated as highly configurable framework.
 http://logging.apache.org/log4net/
 Even though the basic CLR logging framework can accept
changes on destination through its Handler in the
“logging.properties”, Log4Net offers more advanced features in
its XML use of its Appender class.
 Log4Net supports XML configuration and a text configuration in
log4Net.properties.
 Log4Net supports Appenders that will append the logs to
databases, emails, files, etc.
http://logging.apache.org/log4net/release/config-examples.html
Log4Net ASP.NET code
Log4j Console output
Adding an Appender #1
 Let’s read the XML Appender from app.config.
 Change the BasicConfigurator to XmlConfigurator:
Adding an Appender #2
 Add app.config for "c:Loglog.txt”:
Adding an Appender Running
 Reading "c:Loglog.txt”:
NLog
 Nlog is similar to Log4Net. The difference is that Log4Net is a
.Net version of Log4J and is a framework. NLog is a plugin to
Visual Studio with templates.
 http://nlog-project.org/
NLog
 Adding log configuration with Visual 2010 plugin:
NLog
 When debugging from VS2010, the default logging directory
maps to C:Program FilesCommon FilesMicrosoft
SharedDevServer10.0 .
 This Nlog.config will append the logger in to a file named after
the classname, i.e Webapplication1._Default.txt:
Nlog code
 From the WebApplication1 Class, Default.aspx.cs code:
Nlog log file
 Printing the Webapplication1._Default.txt:
Error Pages
 Default Error pages may display unintentional information. For
instance, some error pages may display database information in
an exception.
 An error page giving details, like a database or table name, may
be more than enough to give an attacker enough information
launch an attack at the website.
 To correct bad error handling in pages, Tomcat, Struts and other
Web engines will allow default configurations to throw a specific
error page for any unknown exceptions. For instance, many Web
Application Firewalls (WAFs) will generate a error page 500
“Internal Server Error” for blocking an attack.
Hackme Books
(Bad error handling)
Send something more generic
(based on business input)
Web Error pages….
Many web sites use the default error pages that show the user
exceptions and even exceptions into the database. The database
exceptions have a tendency to display table names and invalid SQL
statements that can be used for further probing.
To send all errors to a custom Error page, the web.config file for IIS:
<customErrors mode="On"
defaultRedirect="errors/ErrorPage.aspx">
</customErrors>
Custom Errors in ASP.NET
 A good resource on the issue is
http://www.codeproject.com/KB/aspnet/customerrorsinaspnet.as
px
 The idea is to redirect the error to a generic error.html page by the
web.config configuration.
Send something more generic
(based on business input)

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Dot net assembly
Dot net assemblyDot net assembly
Dot net assembly
 
Async js
Async jsAsync js
Async js
 
JVM Under The Hood WDI.pdf
JVM Under The Hood WDI.pdfJVM Under The Hood WDI.pdf
JVM Under The Hood WDI.pdf
 
MongoDB + Java + Spring Data
MongoDB + Java + Spring DataMongoDB + Java + Spring Data
MongoDB + Java + Spring Data
 
C# for C++ programmers
C# for C++ programmersC# for C++ programmers
C# for C++ programmers
 
Angularjs PPT
Angularjs PPTAngularjs PPT
Angularjs PPT
 
Jdbc (database in java)
Jdbc (database in java)Jdbc (database in java)
Jdbc (database in java)
 
Introduction to Garbage Collection
Introduction to Garbage CollectionIntroduction to Garbage Collection
Introduction to Garbage Collection
 
Web controls
Web controlsWeb controls
Web controls
 
Multithreading In Java
Multithreading In JavaMultithreading In Java
Multithreading In Java
 
Aspect Oriented Programming
Aspect Oriented ProgrammingAspect Oriented Programming
Aspect Oriented Programming
 
Java Building Blocks
Java Building BlocksJava Building Blocks
Java Building Blocks
 
Java swing
Java swingJava swing
Java swing
 
Polymorphism
PolymorphismPolymorphism
Polymorphism
 
Java basic tutorial by sanjeevini india
Java basic tutorial by sanjeevini indiaJava basic tutorial by sanjeevini india
Java basic tutorial by sanjeevini india
 
Web Development with Python and Django
Web Development with Python and DjangoWeb Development with Python and Django
Web Development with Python and Django
 
QTP VB Script Trainings
QTP VB Script TrainingsQTP VB Script Trainings
QTP VB Script Trainings
 
Php string function
Php string function Php string function
Php string function
 
Java I/O
Java I/OJava I/O
Java I/O
 
.NET and C# Introduction
.NET and C# Introduction.NET and C# Introduction
.NET and C# Introduction
 

Ähnlich wie C# Security Testing and Debugging

Java Web Security Class
Java Web Security ClassJava Web Security Class
Java Web Security ClassRich Helton
 
Using HttpWatch Plug-in with Selenium Automation in Java
Using HttpWatch Plug-in with Selenium Automation in JavaUsing HttpWatch Plug-in with Selenium Automation in Java
Using HttpWatch Plug-in with Selenium Automation in JavaSandeep Tol
 
Exploit ie using scriptable active x controls version English
Exploit ie using scriptable active x controls version EnglishExploit ie using scriptable active x controls version English
Exploit ie using scriptable active x controls version Englishchen yuki
 
Production Debugging at Code Camp Philly
Production Debugging at Code Camp PhillyProduction Debugging at Code Camp Philly
Production Debugging at Code Camp PhillyBrian Lyttle
 
Automated JavaScript Deobfuscation - PacSec 2007
Automated JavaScript Deobfuscation - PacSec 2007Automated JavaScript Deobfuscation - PacSec 2007
Automated JavaScript Deobfuscation - PacSec 2007Stephan Chenette
 
Siebel Open UI Debugging (Siebel Open UI Training, Part 7)
Siebel Open UI Debugging (Siebel Open UI Training, Part 7)Siebel Open UI Debugging (Siebel Open UI Training, Part 7)
Siebel Open UI Debugging (Siebel Open UI Training, Part 7)Tech OneStop
 
UI Automation_White_CodedUI common problems and tricks
UI Automation_White_CodedUI common problems and tricksUI Automation_White_CodedUI common problems and tricks
UI Automation_White_CodedUI common problems and tricksTsimafei Avilin
 
Exploit Frameworks
Exploit FrameworksExploit Frameworks
Exploit Frameworksphanleson
 
Thug: a new low-interaction honeyclient
Thug: a new low-interaction honeyclientThug: a new low-interaction honeyclient
Thug: a new low-interaction honeyclientAngelo Dell'Aera
 
.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques.NET Debugging Tips and Techniques
.NET Debugging Tips and TechniquesBala Subra
 
.Net Debugging Techniques
.Net Debugging Techniques.Net Debugging Techniques
.Net Debugging TechniquesBala Subra
 
Selenium Automation in Java Using HttpWatch Plug-in
 Selenium Automation in Java Using HttpWatch Plug-in  Selenium Automation in Java Using HttpWatch Plug-in
Selenium Automation in Java Using HttpWatch Plug-in Sandeep Tol
 
tybsc it asp.net full unit 1,2,3,4,5,6 notes
tybsc it asp.net full unit 1,2,3,4,5,6 notestybsc it asp.net full unit 1,2,3,4,5,6 notes
tybsc it asp.net full unit 1,2,3,4,5,6 notesWE-IT TUTORIALS
 
Innoplexia DevTools to Crawl Webpages
Innoplexia DevTools to Crawl WebpagesInnoplexia DevTools to Crawl Webpages
Innoplexia DevTools to Crawl Webpagesd0x
 
Embedded Systems Programming Steps
Embedded Systems Programming StepsEmbedded Systems Programming Steps
Embedded Systems Programming StepsAmy Nelson
 
.NET TECHNOLOGIES
.NET TECHNOLOGIES.NET TECHNOLOGIES
.NET TECHNOLOGIESProf Ansari
 
PVS-Studio vs Chromium. 3-rd Check
PVS-Studio vs Chromium. 3-rd CheckPVS-Studio vs Chromium. 3-rd Check
PVS-Studio vs Chromium. 3-rd CheckAndrey Karpov
 
Ef Poco And Unit Testing
Ef Poco And Unit TestingEf Poco And Unit Testing
Ef Poco And Unit TestingJames Phillips
 

Ähnlich wie C# Security Testing and Debugging (20)

Java Web Security Class
Java Web Security ClassJava Web Security Class
Java Web Security Class
 
Using HttpWatch Plug-in with Selenium Automation in Java
Using HttpWatch Plug-in with Selenium Automation in JavaUsing HttpWatch Plug-in with Selenium Automation in Java
Using HttpWatch Plug-in with Selenium Automation in Java
 
Exploit ie using scriptable active x controls version English
Exploit ie using scriptable active x controls version EnglishExploit ie using scriptable active x controls version English
Exploit ie using scriptable active x controls version English
 
Production Debugging at Code Camp Philly
Production Debugging at Code Camp PhillyProduction Debugging at Code Camp Philly
Production Debugging at Code Camp Philly
 
Automated JavaScript Deobfuscation - PacSec 2007
Automated JavaScript Deobfuscation - PacSec 2007Automated JavaScript Deobfuscation - PacSec 2007
Automated JavaScript Deobfuscation - PacSec 2007
 
Siebel Open UI Debugging (Siebel Open UI Training, Part 7)
Siebel Open UI Debugging (Siebel Open UI Training, Part 7)Siebel Open UI Debugging (Siebel Open UI Training, Part 7)
Siebel Open UI Debugging (Siebel Open UI Training, Part 7)
 
UI Automation_White_CodedUI common problems and tricks
UI Automation_White_CodedUI common problems and tricksUI Automation_White_CodedUI common problems and tricks
UI Automation_White_CodedUI common problems and tricks
 
Exploit Frameworks
Exploit FrameworksExploit Frameworks
Exploit Frameworks
 
Thug: a new low-interaction honeyclient
Thug: a new low-interaction honeyclientThug: a new low-interaction honeyclient
Thug: a new low-interaction honeyclient
 
.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques.NET Debugging Tips and Techniques
.NET Debugging Tips and Techniques
 
.Net Debugging Techniques
.Net Debugging Techniques.Net Debugging Techniques
.Net Debugging Techniques
 
Selenium Automation in Java Using HttpWatch Plug-in
 Selenium Automation in Java Using HttpWatch Plug-in  Selenium Automation in Java Using HttpWatch Plug-in
Selenium Automation in Java Using HttpWatch Plug-in
 
tybsc it asp.net full unit 1,2,3,4,5,6 notes
tybsc it asp.net full unit 1,2,3,4,5,6 notestybsc it asp.net full unit 1,2,3,4,5,6 notes
tybsc it asp.net full unit 1,2,3,4,5,6 notes
 
C6713 Unit 5
C6713 Unit 5C6713 Unit 5
C6713 Unit 5
 
Innoplexia DevTools to Crawl Webpages
Innoplexia DevTools to Crawl WebpagesInnoplexia DevTools to Crawl Webpages
Innoplexia DevTools to Crawl Webpages
 
Embedded Systems Programming Steps
Embedded Systems Programming StepsEmbedded Systems Programming Steps
Embedded Systems Programming Steps
 
.NET TECHNOLOGIES
.NET TECHNOLOGIES.NET TECHNOLOGIES
.NET TECHNOLOGIES
 
PVS-Studio vs Chromium. 3-rd Check
PVS-Studio vs Chromium. 3-rd CheckPVS-Studio vs Chromium. 3-rd Check
PVS-Studio vs Chromium. 3-rd Check
 
Php
PhpPhp
Php
 
Ef Poco And Unit Testing
Ef Poco And Unit TestingEf Poco And Unit Testing
Ef Poco And Unit Testing
 

Mehr von Rich Helton

Java for Mainframers
Java for MainframersJava for Mainframers
Java for MainframersRich Helton
 
I pad uicatalog_lesson02
I pad uicatalog_lesson02I pad uicatalog_lesson02
I pad uicatalog_lesson02Rich Helton
 
Mongo db rev001.
Mongo db rev001.Mongo db rev001.
Mongo db rev001.Rich Helton
 
NServicebus WCF Integration 101
NServicebus WCF Integration 101NServicebus WCF Integration 101
NServicebus WCF Integration 101Rich Helton
 
AspMVC4 start101
AspMVC4 start101AspMVC4 start101
AspMVC4 start101Rich Helton
 
Entity frameworks101
Entity frameworks101Entity frameworks101
Entity frameworks101Rich Helton
 
Tumbleweed intro
Tumbleweed introTumbleweed intro
Tumbleweed introRich Helton
 
Salesforce Intro
Salesforce IntroSalesforce Intro
Salesforce IntroRich Helton
 
LEARNING  iPAD STORYBOARDS IN OBJ-­‐C LESSON 1
LEARNING	 iPAD STORYBOARDS IN OBJ-­‐C LESSON 1LEARNING	 iPAD STORYBOARDS IN OBJ-­‐C LESSON 1
LEARNING  iPAD STORYBOARDS IN OBJ-­‐C LESSON 1Rich Helton
 
Learning C# iPad Programming
Learning C# iPad ProgrammingLearning C# iPad Programming
Learning C# iPad ProgrammingRich Helton
 
First Steps in Android
First Steps in AndroidFirst Steps in Android
First Steps in AndroidRich Helton
 
Python For Droid
Python For DroidPython For Droid
Python For DroidRich Helton
 
Spring Roo Rev005
Spring Roo Rev005Spring Roo Rev005
Spring Roo Rev005Rich Helton
 
Overview of CSharp MVC3 and EF4
Overview of CSharp MVC3 and EF4Overview of CSharp MVC3 and EF4
Overview of CSharp MVC3 and EF4Rich Helton
 
C#Web Sec Oct27 2010 Final
C#Web Sec Oct27 2010 FinalC#Web Sec Oct27 2010 Final
C#Web Sec Oct27 2010 FinalRich Helton
 

Mehr von Rich Helton (20)

Java for Mainframers
Java for MainframersJava for Mainframers
Java for Mainframers
 
I pad uicatalog_lesson02
I pad uicatalog_lesson02I pad uicatalog_lesson02
I pad uicatalog_lesson02
 
Mongo db rev001.
Mongo db rev001.Mongo db rev001.
Mongo db rev001.
 
NServicebus WCF Integration 101
NServicebus WCF Integration 101NServicebus WCF Integration 101
NServicebus WCF Integration 101
 
AspMVC4 start101
AspMVC4 start101AspMVC4 start101
AspMVC4 start101
 
Entity frameworks101
Entity frameworks101Entity frameworks101
Entity frameworks101
 
Tumbleweed intro
Tumbleweed introTumbleweed intro
Tumbleweed intro
 
Azure rev002
Azure rev002Azure rev002
Azure rev002
 
Salesforce Intro
Salesforce IntroSalesforce Intro
Salesforce Intro
 
LEARNING  iPAD STORYBOARDS IN OBJ-­‐C LESSON 1
LEARNING	 iPAD STORYBOARDS IN OBJ-­‐C LESSON 1LEARNING	 iPAD STORYBOARDS IN OBJ-­‐C LESSON 1
LEARNING  iPAD STORYBOARDS IN OBJ-­‐C LESSON 1
 
Learning C# iPad Programming
Learning C# iPad ProgrammingLearning C# iPad Programming
Learning C# iPad Programming
 
First Steps in Android
First Steps in AndroidFirst Steps in Android
First Steps in Android
 
NServiceBus
NServiceBusNServiceBus
NServiceBus
 
Python For Droid
Python For DroidPython For Droid
Python For Droid
 
Spring Roo Rev005
Spring Roo Rev005Spring Roo Rev005
Spring Roo Rev005
 
Python Final
Python FinalPython Final
Python Final
 
Overview of CSharp MVC3 and EF4
Overview of CSharp MVC3 and EF4Overview of CSharp MVC3 and EF4
Overview of CSharp MVC3 and EF4
 
Adobe Flex4
Adobe Flex4 Adobe Flex4
Adobe Flex4
 
C#Web Sec Oct27 2010 Final
C#Web Sec Oct27 2010 FinalC#Web Sec Oct27 2010 Final
C#Web Sec Oct27 2010 Final
 
Jira Rev002
Jira Rev002Jira Rev002
Jira Rev002
 

Kürzlich hochgeladen

COMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a WebsiteCOMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a Websitedgelyza
 
Linked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesLinked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesDavid Newbury
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Will Schroeder
 
Do we need a new standard for visualizing the invisible?
Do we need a new standard for visualizing the invisible?Do we need a new standard for visualizing the invisible?
Do we need a new standard for visualizing the invisible?SANGHEE SHIN
 
Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024SkyPlanner
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopBachir Benyammi
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8DianaGray10
 
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1DianaGray10
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintMahmoud Rabie
 
Designing A Time bound resource download URL
Designing A Time bound resource download URLDesigning A Time bound resource download URL
Designing A Time bound resource download URLRuncy Oommen
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesThousandEyes
 
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServicePicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServiceRenan Moreira de Oliveira
 
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAshyamraj55
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024D Cloud Solutions
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1DianaGray10
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Commit University
 
UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6DianaGray10
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...DianaGray10
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureEric D. Schabell
 

Kürzlich hochgeladen (20)

COMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a WebsiteCOMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a Website
 
Linked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesLinked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond Ontologies
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
 
Do we need a new standard for visualizing the invisible?
Do we need a new standard for visualizing the invisible?Do we need a new standard for visualizing the invisible?
Do we need a new standard for visualizing the invisible?
 
Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 Workshop
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8
 
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership Blueprint
 
Designing A Time bound resource download URL
Designing A Time bound resource download URLDesigning A Time bound resource download URL
Designing A Time bound resource download URL
 
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyesHow to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
How to Effectively Monitor SD-WAN and SASE Environments with ThousandEyes
 
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer ServicePicPay - GenAI Finance Assistant - ChatGPT for Customer Service
PicPay - GenAI Finance Assistant - ChatGPT for Customer Service
 
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024
 
Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1Secure your environment with UiPath and CyberArk technologies - Session 1
Secure your environment with UiPath and CyberArk technologies - Session 1
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)
 
UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6UiPath Studio Web workshop series - Day 6
UiPath Studio Web workshop series - Day 6
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
Connector Corner: Extending LLM automation use cases with UiPath GenAI connec...
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability Adventure
 

C# Security Testing and Debugging

  • 1. Security Testing/Debugging From Rich Helton’s October 2010 C# Web Security
  • 3. White Box Testing  White-Box testing is testing the system based on the internal perspective of the system.  In this case, this is also known as Static Analysis.  These tools can find issues with the source code before the code is actually executed.  A list of tools can be found at http://en.wikipedia.org/wiki/List_of_tools_for_static_code_anal ysis
  • 4. CAT.NET (A plugin that can be added from the Windows SDK)  CAT.NET can be used with Visual Studio to analyze the current solution, here is a Visual Studio 2008 popup after selecting Tools- >CAT.NET Analysis Tool from the menu:
  • 5. CAT.NET (After pushing the Excel report button)
  • 6. FXCop  CAT.NET rules can can be run in FXCop instead of Visual Studio.  FXCop examines the assemblies and object code and not the source. It can be downloaded as part of the Windows SDK.
  • 7. NUNIT  White-Box testing is testing the system based on the internal perspective of the system.  See www.nunit.org  These tools can find issues with the source code before the code is actually executed.  A list of tools can be found at http://en.wikipedia.org/wiki/List_of_tools_for_static_code_anal ysis
  • 9. Headless Browser  Headless Browser Automation  Can replicate a real world browser.  Can automate the test.  Provides low-level control over the HTML and HTTP.  Reference http://blog.stevensanderson.com/2010/03/30/using- htmlunit-on-net-for-headless-browser-automation/
  • 10. HTMLUnit steps  Download HTMLUnit http://sourceforge.net/projects/htmlunit/  Download IKVM http://sourceforge.net/projects/ikvm/files/  Create the HTMLUnit DLL:  Run “ikvmc –out:htmlunit-2.7.dll *.jar”  Include the htmlunit, IKVM.OpenJDK, and nunit dll’s in the external assemblies.  Can automate the test.  Provides low-level control over the HTML and HTTP.  Reference http://blog.stevensanderson.com/2010/03/30/using- htmlunit-on-net-for-headless-browser-automation/
  • 11. What about the HTML?  HTTPUnit is great for HTTP Requests and Responses, but what if I want to parse the HTML code directly from the Web Server and examine the HTML before doing any work.  HTMLUnit allows a “getPage()” routine to examine the HTML source code.  This allows the walking through of “HREF”, images, and others pieces of the HTML code before executing on the item.  Selenium IDE is another Open Source concept that is a Integrated Development Environment running on top of the FireFox browser as a plugin.  This allows a recording of the browser actions that can be played back execute buttons being pushed and actions inside the browser.  Assertions can be executed on the HTML pages itself for checking specific information.  The test itself can be exported into Junit Java code to execute in Java.
  • 13. HtmlUnit on C# (Nunit Test) (Under Construction page)
  • 14. HtmlUnit on C# (Nunit Test) (Page not found)
  • 15. Selenium IDE  Selenium IDE is another Open Source concept that is a Integrated Development Environment running on top of the FireFox browser as a plugin.  Supports load testing.  This allows a recording of the browser actions that can be played back execute buttons being pushed and actions inside the browser.  Assertions can be executed on the HTML pages itself for checking specific information.  The test itself can be exported into Java, .NET, Perl, Ruby, etc, and then code to execute the tests in that language.
  • 17. Does the framework matter?  JWebUnit wraps both HTMLUnit and Selenium so that code can be written for either framework using a unified framwork.  This way code can once in a single framework and executed using multiple HTML frameworks. http://jwebunit.sourceforge.net/
  • 19. Has my system been compromised?  Logging and Error handling is one of the most important concept in Security.  When an incident happens, the first questions are always “How did they get in?” and “What data was compromised?”.  The least favorite answer is usually “No one knows.”  With efficient logging of authorization, access to secure information, and any anomalous interaction with the system, a proper recovery of the system is usually insured.  The logs should be store into a different system in case the Web system is ever compromised, one where the Web system sends them but never asks for them back.  Logging is a fundamental API that comes with the Java and .NET languages.
  • 20. Logging the C# way…. using System; using System.Diagnostics; class EventLogExample { static void Main(string[] args) { string sSource = "my warning message"; string sLog = "Application"; string sEvent = "Sample Event"; if (!EventLog.SourceExists(sSource)) EventLog.CreateEventSource(sSource, sLog); EventLog.WriteEntry(sSource, sEvent); EventLog.WriteEntry(sSource, sEvent, EventLogEntryType.Warning, 234); } }
  • 21. The C# Logger output….
  • 22. Exception Handling  Exception handling has helped debugging immensely. It allows a programmer to code for anomalies and handle a bizarre behavior.  There are 3 components of handling an exception, and they are the “try”, “catch” and “finally” blocks.  The “try” block will throw an exception from normal code, the “catch” block will catch the exception and handle it, and the “finally” block will process the cleanup afterwards.  The “catch” block can log the anomaly, stop the program, or process it in a hundred different ways.  You can write your own custom exception classes to trace specific pieces of code.
  • 23. C# Exception Handling code…. class TestException{ static void Main(string[] args){ StreamReader myReader = null; try{ // constructor will throw FileNotFoundException myReader = new StreamReader("IamNotHere.txt"); }catch (FileNotFoundException e){ Console.WriteLine("FileNotFoundException was {0}", e.Message); }catch (IOException e){ Console.WriteLine("IOException was {0}" + e.Message); }finally{ if (myReader != null){ try{ myReader.Close(); }catch (IOException e){ Console.WriteLine("IOException was {0}" + e.Message);}}}}} Output-> FileNotFoundException was Could not find file ‘C:IamNotHere.txt'.
  • 24. Log4net  The previous logging and exception handling example has many hard coded pieces. Log4Net offers more de-coupling by being separated as highly configurable framework.  http://logging.apache.org/log4net/  Even though the basic CLR logging framework can accept changes on destination through its Handler in the “logging.properties”, Log4Net offers more advanced features in its XML use of its Appender class.  Log4Net supports XML configuration and a text configuration in log4Net.properties.  Log4Net supports Appenders that will append the logs to databases, emails, files, etc. http://logging.apache.org/log4net/release/config-examples.html
  • 27. Adding an Appender #1  Let’s read the XML Appender from app.config.  Change the BasicConfigurator to XmlConfigurator:
  • 28. Adding an Appender #2  Add app.config for "c:Loglog.txt”:
  • 29. Adding an Appender Running  Reading "c:Loglog.txt”:
  • 30. NLog  Nlog is similar to Log4Net. The difference is that Log4Net is a .Net version of Log4J and is a framework. NLog is a plugin to Visual Studio with templates.  http://nlog-project.org/
  • 31. NLog  Adding log configuration with Visual 2010 plugin:
  • 32. NLog  When debugging from VS2010, the default logging directory maps to C:Program FilesCommon FilesMicrosoft SharedDevServer10.0 .  This Nlog.config will append the logger in to a file named after the classname, i.e Webapplication1._Default.txt:
  • 33. Nlog code  From the WebApplication1 Class, Default.aspx.cs code:
  • 34. Nlog log file  Printing the Webapplication1._Default.txt:
  • 35. Error Pages  Default Error pages may display unintentional information. For instance, some error pages may display database information in an exception.  An error page giving details, like a database or table name, may be more than enough to give an attacker enough information launch an attack at the website.  To correct bad error handling in pages, Tomcat, Struts and other Web engines will allow default configurations to throw a specific error page for any unknown exceptions. For instance, many Web Application Firewalls (WAFs) will generate a error page 500 “Internal Server Error” for blocking an attack.
  • 37. Send something more generic (based on business input)
  • 38. Web Error pages…. Many web sites use the default error pages that show the user exceptions and even exceptions into the database. The database exceptions have a tendency to display table names and invalid SQL statements that can be used for further probing. To send all errors to a custom Error page, the web.config file for IIS: <customErrors mode="On" defaultRedirect="errors/ErrorPage.aspx"> </customErrors>
  • 39. Custom Errors in ASP.NET  A good resource on the issue is http://www.codeproject.com/KB/aspnet/customerrorsinaspnet.as px  The idea is to redirect the error to a generic error.html page by the web.config configuration.
  • 40. Send something more generic (based on business input)