|
If you want to run ASP.NET
In this paper, we will look
Marcus Mac Innes demonstrates
While ASP.NET 2.0 is
web applications on your
at the structure of a very
how security on a web site
completely backwards
local computer, you must
simple ASP.NET page and how
can be compromised by taking
compatible with ASP.NET 1.1,
have both Internet
that page is rendered in the
advantage of holes within
its new features may require
Information Services (IIS)
visitor's browser. Then we
the application code. These
you to revise parts of your
and ASP.NET installed. IIS
will look at the Page class,
holes can be discovered by
Web applications. This
is necessary for providing
which is the .NET class that
using a series of probes
article provides a detailed
web service and ASP.NET is
all your ASP.NET pages are
which disclose whether or
analysis of how changes in
necessary for providing
based on. After that, we
not vulnerability exists. He
ASP.NET 2.0 will influence
handling of the family of
will review basic compiler
also demonstrated using a
your porting decisions.
ASP.NET web applications
directives that you can
Cross Site Scripting attack
(ASPX, ASMX, etc). IIS is
place on your page. At the
how the Forms Authentication
installed by default for
end of the chapter, we will
cookie could be stolen and
installations of Windows
review a simple Quiz ASP.NET
silently sent to an
2000 and Windows XP. ASP.NET
page that demonstrates the
attacker's website to be
is installed by default
basics of an ASP.NET page.
stored for later use. The
during .NET Framework
key message of the talk is
installation. However, if
to ensure that all user
you attempt to install the
input is validated before
.NET Framework on a Windows
any other processing is
2000 or Windows XP machine
done. This together with
that doesn't have IIS
strict use of secure coding
installed, the .NET
standards would have
Framework installation will
disabled any attacker's
detect that IIS is not
opportunities. Source code
available and thus will not
included.
install ASP.NET component of
the framework. If you
subsequently install IIS at
a later time, you will have
to install ASP.NET
manually.
Likewise, if
you have both IIS and .NET
installed on your computer,
and then later un-install
IIS, this uninstallation
will also uninstall the
ASP.NET component of the
.NET Framework. If you later
re-install IIS, you will
have re-install ASP.NET
manually.
This article
walks you through the
re-installation of ASP.NET
for a computer already
running IIS.
Date: May, 19 2005 Date: Apr, 26 2005 Date: Apr, 07 2005 Date: Jan, 16 2005 |
|
The new security components
Recently, I had a requirement
Recently we had a Website
Explains the authentication
in .NET 2.0 can help you
to put together a website
that was redone from a large
process and how to set up
greatly reduce the amount of
that deals with taking
static site to a dynamically
authentication and
code you need to write in
somewhat elaborate financial
driven site in ASP.Net. The
authorization, create and
order to make your
surveys. While the
original site was heavily
manage roles and apply
applications secure.
questions and answers
indexed by the major spiders
access rules to the ASP.NET.
Security is difficult to get
themselves are good
on the Web, we did not want
right, and it is a good
candidates for being
to lose the reference links
strategy to leverage the
database driven, there were
in the engines and wanted to
code provided by Microsoft
a large number of nuiances
make sure the link clicked
and other security vendors.
ranging from UI items,
on would go to an
To that end, .NET 2.0
business rules, and
appropriate paged in the
provides numerous additional
calculations that just
site. In this article we
types that encapsulate
didn't fit into a database
cover how to create a
functionality already
driven strategy. With this
document mapper so the old
provided in the base Windows
in mind, my initial strategy
URL is redirected to the new
OS., as well a new
was to create version
related page within the new
functionality only available
specific classes and
site.
in .NET 2.0. The
reference them in version
improvements affect public
specific ASP.NET pages. Of
key cryptography, Windows
course, this accomplished
security, remoting, ASP.NET
the initial requirement.
and Code Access Security.
However, whenever a new
Even if you plan to stick
version needs to be
with .NET 1.1 for a while
implemented, I had to copy
and implement your own
all of the ASP.NET pages and
security classes, you might
modify the references to the
want to take inspiration
appropriate version specific
from.NET 2.0 beta.
class name. Refactoring
provides a better
alternative and here's how:
Date: Dec, 10 2004 Date: Oct, 15 2004 Date: Jan, 19 2004 Date: Dec, 13 2006 |