DotNetKicks.com : Stories kicked by jeffesp

ASP.NET and the Padding Oracle Attack: Wrap-up

Mon, 20 Sep 2010 18:00:52 GMT

Based on the news that was released at the time, it appeared that this vulnerability was just an issue AES. It turns out that this was false and that that this attack works against ANY BLOCK CIPHER meaning 3DES was also vulnerable. This wrap-up links to some mitigation techniques and also discusses how to protect against padding oracle attacks using Digital Signatures.

Vulnerability in .NET AES puts ASP.NET Web Sites at Risk

Tue, 14 Sep 2010 12:45:52 GMT

ASP.NET web applications that leverage Forms Authentication, ASP.NET Membership Providers, ASP.NET Role Providers, and/or ViewState encryption are vulnerable to data exposure and potentially tampering. This vulnerability can lead to the .NET MachineKey being discovered by attackers. This post briefly details the issue and provides a simple temporary mitigation technique.

Security Vulnerability Analysis for Fiddler

Sat, 23 May 2009 07:12:31 GMT

Fiddler Plugins for Site Spider, Fuzzer, XSS/CSRF vulnerability detection, SQL Injection detection, Session Tampering, Information Leakage detection, etc. A ViewState decoder proof-of-concept has been completed. Looking for contributors as well.

Security Vulnerability of the Week #1: SQL Injection

Wed, 04 Mar 2009 00:01:13 GMT

This article begins a semi-regular series that will explores the most common vulnerabilities and the mind-set of the developers that create them and also explore how to deal with them. The first post in the series takes a look at the OWASP top number 2 vulnerability, Injection (specifically SQL Injection) - which has been a known and solved problem for over 10+ years, yet for some reason, it's still as common as ever.

Pocket DnDns Release

Fri, 05 Dec 2008 11:14:38 GMT

DnDns, a .NET DNS resolver library completely implemented in managed code ported to the Compact Framework. Pocket DnDns also comes with a basic GUI application that allows a variety of DNS Lookups of various record types from your Compact Framework supported portable devices. Source Code is also available under the New BSD License.

Asp.Net AJAX Client Side Templated Data Bound Control

Wed, 20 Aug 2008 02:18:15 GMT

A server control that allows you to specify header, item, and footer templates for a basic data list that will be bound on the client based on either a given web service method, or on a data-source provided client side. The templates are rendered server-side before being passed to the client behavior which allows you to use other server-side controls in the development of the templates.

DnSmtp - A .NET SMTP Client Library in C#

Tue, 24 Jun 2008 21:29:36 GMT

DnSmtp is a fully management SMTP client library written in C#. It provides two delivery methods - Relay and Direct. In relay delivery mode, it will relay messages through your local SMTP server. In direct delivery mode or it will resolve the MX record of the recipient's email address and connect to the recipients server directly and drop the mail message.

DnDns - A .NET DNS Client Library (Resolver)

Mon, 04 Feb 2008 21:46:02 GMT

A DNS protocol library written completely in managed code. Supports common DNS records types like A, CNAME, MX, SRV, and more.

TableAdapterManager in ADO.NET Orcas

Tue, 01 May 2007 22:16:01 GMT

A description of the new TableAdapterManager for DataSets in Visual Studio Orcas, as well as a data-access framework that enables similar function now.

Implementing SmartCard Authentication with ASP.NET

Wed, 25 Apr 2007 14:46:01 GMT

This is my 9 page follow-up article on how to implement non-Active Directory Integrated Smart Card Authentication with ASP.NET using Http Modules.

Community Server 2007 Beta 2, Now Available!

Mon, 26 Mar 2007 11:46:01 GMT

Rob Howard announces availability of Community Server 2007 Beta 2

Escaping Tables With CSS

Wed, 06 Dec 2006 22:31:02 GMT

While this isn't totally .NET related, I think that the crowd here will be able to relate to this dilemma. We're .NET developers who do HTML and CSS, and this is a common problem that we've all run into.

The Case for Emacs

Tue, 05 Dec 2006 18:01:01 GMT

Why gaining proficiency in Emacs can make you a better, more versatile developer.

Finding the Current and Last Page Numbers of a Crystal Report in ASP.

Fri, 16 Jun 2006 16:21:01 GMT

I had the hardest time finding a good and relatively efficient way to do this, so when I found it, I wanted to share it with everyone. Read on if you've run into this problem before.

Wilco.SyntaxHighlighter: must download control

Tue, 06 Jun 2006 09:33:01 GMT

Free source code for a SyntaxHighlighter. Worth taking a look for sure, and possibly even downloading and using.

TDD By Example - Money

Thu, 25 May 2006 07:17:01 GMT

Learn how to use TDD to drive out a simple scenario. Creating a custom type to encapsulate money. If you find yourself using decimals a lot to represent money in your application, then get started building a first class type that encapsulates the rules for you. In the process, learn how using TDD can help you drive out the functionality in small testable pieces.

Hydrus DataSetToolkit Application

Tue, 23 May 2006 22:01:01 GMT

With the DataSetToolkit you can interact dynamically with your application datasource without ever writing a single SQL query. The DataSetToolkit includes a unique command generator which inspects your DataSet to generate dynamic select queries. You can customize any query via included WhereConstraint objects, or extend the object model to create your own. With the DataSetToolkit you also no longer need to maintain a DataAdapter for every table, but can use the MultiTableDataAdapter to fill or update any table in your DataSet. You choose the DBMS provider, and the DataSetToolkit does the rest.

Script# Prototype

Tue, 23 May 2006 23:09:01 GMT

"Script# brings the C# developer experience (programming and tooling) to Javascript/Ajax world." This has huge potential. It would be nice to see this become an open source project on codeplex.

SQL Prompt - Intellisense for SQL Server

Tue, 23 May 2006 14:05:01 GMT

Code completion and intellisense for SQL Server Query Analyzer free until September 1st 2006. No time bombs and no restrictions.

SQL Programming Intellisense with RedGate's SQL Prompt

Sat, 20 May 2006 15:13:01 GMT

From Dan Wahlin : "RedGate (a company with some awesome SQL Server products) is releasing a tool called SQL Prompt that looks phenomenal from what I've seen to this point. It allows developers to get intellisense as they develop SQL queries within Query Analyzer, SQL Server 2005 Management Studio, Visual Studio 2005, Visual Studio .NET 2003, SQL Server 2000 Enterprise Manager and UltraEdit32. I haven't had a chance to try the beta out a whole lot yet but it looks like the final release will be May 22nd and I'm pretty excited about it since I've always wanted intellisense in these tools as I create different types of queries. Did I mention that they're releasing it for free? :-)"

Avoiding Cursors with Superclass-Subclass Tables

Thu, 18 May 2006 16:36:49 GMT

When you're dealing with complex table structures, sometimes you need a trick or two to deal with them efficiently. Here's a technique I discovered to insert rows into superclass-subclass tables without using cursors.

Microsoft release CodePlex

Tue, 16 May 2006 19:45:00 GMT

You can use CodePlex to create new projects to share with your fellow developers around the world, join others who have already started their own project, or simply use the applications on this site and provide feedback.

Consolas as the New IDE Font of Choice

Thu, 13 Apr 2006 12:34:12 GMT

Download Vista's New Fonts