.NET Numeric Overflow
Filed under: Security
When programming with Microsoft .Net, there is not as much concern for overflow vulnerabilities. With the managed runtime, buffer overflows are handled for the most part. However, there is still the possibility for numeric overflows. A numeric overflow exists when arithmetic is performed on two values causing the result to roll past the max or ...
Bypassing ValidateRequest
Filed under: Security
Back in August 2009 (https://jardinesoftware.net/2009/08/27/validaterequest-property-xss/) I wrote about the Validate Request functionality and how it doesn’t do a good job of protecting against Cross Site Scripting in an attribute context. In this post, I am going to explain another technique that can be used to bypass the Validate Request filter in an html ...
ASP.Net 4: Change the Default Encoder
Filed under: Development, Security
In ASP.Net 4.0, Microsoft added the ability to override the default encoder. This is specifically focused on the HTMLEncode, HTMLAttributeEncode, and URLEncode functionality. These functions are used, in the eyes of security, to help mitigate cross-site scripting (XSS). The problem with the built in .Net routines is that they are built on a black-list methodology, ...
Follow Us
