DotNetKicks.com : Stories kicked by jmbledsoe

Vulnerability in .NET AES puts ASP.NET Web Sites at Risk

Tue, 14 Sep 2010 12:45:52 GMT

ASP.NET web applications that leverage Forms Authentication, ASP.NET Membership Providers, ASP.NET Role Providers, and/or ViewState encryption are vulnerable to data exposure and potentially tampering. This vulnerability can lead to the .NET MachineKey being discovered by attackers. This post briefly details the issue and provides a simple temporary mitigation technique.

Smart Card Authentication Module Update - added Support for Membership

Mon, 03 May 2010 20:15:51 GMT

This is a follow-on update on how to implement non-Active Directory Integrated Smart Card / Client Certificate Authentication with ASP.NET using Http Modules. This long overdue version adds support for ASP.NET Membership, Roles, and Profiles.

Session Attacks and ASP.NET - Part 2

Wed, 24 Jun 2009 17:00:00 GMT

In Session Attacks and ASP.NET - Part 1, I introduced one type of attack against the session called Session Fixation as well as ASP.NET's session architecture and authentication architecture. In this second post, I'll delve into a couple specific attack scenarios, cover risk reduction, and countermeasures specific to ASP.NET for protecting against session attacks in ASP.NET

Session Attacks and ASP.NET - Part 1

Thu, 18 Jun 2009 15:30:01 GMT

I've spent some time recently looking for updated information regarding session attacks as they apply to ASP.NET and am still not completely satisfied with how Microsoft has decided to implement session management in ASP.NET 2.0+. Part 1 explores ASP.NET session management, authentication, and session attacks against ASP.NET with a comparison of how ASP.NET stacks up against mitigation techniques against these attacks.

Security Vulnerability of the Week #1: SQL Injection

Wed, 04 Mar 2009 00:01:13 GMT

This article begins a semi-regular series that will explores the most common vulnerabilities and the mind-set of the developers that create them and also explore how to deal with them. The first post in the series takes a look at the OWASP top number 2 vulnerability, Injection (specifically SQL Injection) - which has been a known and solved problem for over 10+ years, yet for some reason, it's still as common as ever.

Pocket DnDns Release

Fri, 05 Dec 2008 11:14:38 GMT

DnDns, a .NET DNS resolver library completely implemented in managed code ported to the Compact Framework. Pocket DnDns also comes with a basic GUI application that allows a variety of DNS Lookups of various record types from your Compact Framework supported portable devices. Source Code is also available under the New BSD License.

Asp.Net AJAX Client Side Templated Data Bound Control

Wed, 20 Aug 2008 02:18:15 GMT

A server control that allows you to specify header, item, and footer templates for a basic data list that will be bound on the client based on either a given web service method, or on a data-source provided client side. The templates are rendered server-side before being passed to the client behavior which allows you to use other server-side controls in the development of the templates.

DnDns - A .NET DNS Client Library (Resolver)

Mon, 04 Feb 2008 21:46:02 GMT

A DNS protocol library written completely in managed code. Supports common DNS records types like A, CNAME, MX, SRV, and more.

Exploring the secrets of intermediate materialization

Fri, 01 Feb 2008 19:09:01 GMT

Looks like a good trick for tuning certain SQL queries.

.NET Framework Library Source Code now available

Thu, 17 Jan 2008 06:46:02 GMT

Scott Guthrie announces that the .NET framework source code can now accessed in Visual Studio

K2 Underground Launches!

Mon, 04 Jun 2007 18:30:13 GMT

SourceCode Technology Holdings has launched an upgrade to their community site called 'K2 Underground' as the next version of their K2.net product codenamed K2 [blackpearl] nears completion.

TableAdapterManager in ADO.NET Orcas

Tue, 01 May 2007 22:16:01 GMT

A description of the new TableAdapterManager for DataSets in Visual Studio Orcas, as well as a data-access framework that enables similar function now.

ADO.NET Entity Framework cut from .NET 3.5/Orcas

Mon, 30 Apr 2007 23:46:02 GMT

As Frans Bouma reports, it appears that the ADO.NET EF is being cut from orcas and moved to 2008 as an orcas update...

Implementing SmartCard Authentication with ASP.NET

Wed, 25 Apr 2007 14:46:01 GMT

This is my 9 page follow-up article on how to implement non-Active Directory Integrated Smart Card Authentication with ASP.NET using Http Modules.

Overview of WCF/SOA

Thu, 05 Apr 2007 13:16:01 GMT

An introduction to and overview of SOA, the WS-* specifications, and how WCF makes them accessable to .NET developers. Material is rooted in Juval Lowy's presentations at SD West 2007.

Teamprise now free to Codeplex users

Tue, 27 Mar 2007 06:31:01 GMT

Teamprise, a TFS client package for OSS users (Eclipse and other IDEs on Mac/Linux/&c) is now free for users who host their projects on Codeplex.

Overview of Customizing Community Server

Tue, 27 Feb 2007 15:01:01 GMT

A good introduction to the architecture of Community Server and how it can be customized.

ASP.NET AJAX(ATLAS) RC Released

Fri, 15 Dec 2006 16:31:02 GMT

A direct link to the new release of ASP.NET AJAX(ATLAS) RC

Escaping Tables With CSS

Wed, 06 Dec 2006 22:31:02 GMT

While this isn't totally .NET related, I think that the crowd here will be able to relate to this dilemma. We're .NET developers who do HTML and CSS, and this is a common problem that we've all run into.

"Atlas" 1.0 Naming and Roadmap

Tue, 12 Sep 2006 12:31:02 GMT

"Atlas" 1.0 Naming and Roadmap

Asynchronous Pages in ASP.NET 2.0

Fri, 08 Sep 2006 00:31:02 GMT

Improve scalability on your asp.net applications ...

Add Windows Live Alerts to your blog

Thu, 07 Sep 2006 15:31:03 GMT

Some of my readers have been asking me how I've added the Windows Live Alerts functionality to this blog. I simply love this feature and I hope that it will spread to some of the blogs I read daily. It allows me to get notified about blog updates in a non-intrusive way through Messenger without having to subscribe to the RSS feeds. I already have to many RSS subscriptions.

Masterpages hate logic, throw interfaces at them

Thu, 31 Aug 2006 23:01:01 GMT

Wyatt Barnett explains a good way to keep your logic and presentation independent.

arrays of methods in C#

Fri, 01 Sep 2006 05:01:01 GMT

a technique that can reduce your code when you have a pattern of 2..n values where for each value you want to execute a different method with the same signature

Asynchronous command execution in .NET 2.0

Thu, 31 Aug 2006 11:01:01 GMT

Asynchronous execution of commands was one of great new features in ADO.NET 2.0. The ability to execute commands that take long time to execute asynchronously is very helpful for developers.