June 2007
HttpOnly cookies in .NET 2.0
This is a well known trick that I just wanted to share as it is so crucial in preventing effective XSS attacks in Internet Explorer (and hopefully soon FireFox). Anyway, the method is simple, whack this under the <system.web> section of your web.config file:
C# DataExecutor class available
One of the questions I see most frequently on Freenode's ##csharp irc channel is how to use a MySql Database in .NET. I've therefore provided the class that I use for basic database operations. You can find it at http://www.martineve.com/2007/06/25/c-mysql-dataexecutor-class/. The class supports…
.NETIDS v.0.1.1.0 released
Just a quick note to announce the release of .NETIDS v.0.1.1.0 - a small update that adds some valuable features: Fixed bug of empty Report.Tags object Added options to SecurePage to disable each type of scanning Updated filters Most significantly this means that you can control whether page Output…
C# MySql DataExecutor class
DataExecutor.cs:
CSRF being used in latest IPB vuln – what about PHP web request?
I was interested to see in a XSS/CSRF exploit the following lines:
.NETIDS v.0.1.0.0 released
After much testing/tweaking the first release of .NETIDS is upon us! Featured in this release: automatic String.fromCharcode conversion and detection new and optimized filter rules improved halfwidth/fullwidth encoding detection enhanced UTF7 converter enhanced nullbyte detection page…
.NETIDS can now detect fragmented XSS
Today I made some large commits to the .NETIDS project to enable detection of fragmented XSS attacks. For an example of what a fragmented attacks looks like, have a look at the .NETIDS SmokeTest. The following url illustrates a fragmented XSS attack:
Firefox nested comment fragmented XSS
Following on from a post on sla.ckers it emerges that Firefox has a vulnerability/bug that is very difficult to filter against and allows a fragmented XSS attack. This is best illustrated by the following example:
A bad day for browsers
Today there were 5 flaws for Firefox and IE6/7 unveiled - 2 for IE and 3 for Firefox. Michal Zalewski disclosed 3 at http://seclists.org/fulldisclosure/2007/Jun/0026.html and the other can be found at http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004/.