Mahdi Taghizadeh I'm who I'm!

15Dec/0822

Microsoft Released Anti-XSS 3.0 Beta and CAT.NET CTP

Recently Microsoft released a beta edition of Anti-XSS library V3.0. Here’s a list of some new features which were added in this release:

  • An expanded white list that supports more languages
  • Performance improvements
  • Performance data sheets (in the online help)
  • Support for Shift_JIS encoding for mobile browsers
  • A sample application
  • Security Runtime Engine (SRE) HTTP module

Also as you can read on Microsoft Connected Information Security Group blog they have also released a CTP version of CAT.NET (Microsoft Code Analysis Tool .NET) which is a managed code static analysis tool for finding security vulnerabilities such as Cross Site Scripting - SQL Injection - Process Command Injection - File Canonicalization - Exception Information, etc.

Downloads:

kick it on DotNetKicks.com

11Dec/0812

Receive your free 1-year license for McAfee Virus Scan Plus 2009

McAfee, the famous security products vendor, offers a %100 discount on McAfee Virus Scan Plus 2009 + 1 year free subscription (a $40 value). To receive your own free license just go here and enter VSPPROMOCF as coupon code and click on checkout; now you have a $0 shopping card!

Offer is valid through December 31, 2008. You can download your copy for Windows 2000, Windows XP and Windows Vista.

+ [via Labnol]

+ It seems that free Anti Virus offers is going to be expanded after Microsoft announced free Anti Virus offer in near future!

5Jul/081

Find Your Web site SQL Injection Vulnerabilities Using Scrawlr

One of the basic but important security issues in web development that you should pay attention to is SQL Injection. Recently HP released a free tool called Scrawlr to test such vulnerabilities.

This tool checks your pages using a simple crawler or Google query and find any SQL Injection problems. This tool can only check issues on GET parameters.

You can check up to 1500 URL in each web site using this free tool.

Download: https://download.spidynamics.com/Products/scrawlr/

1Jul/081

How to use ASP.NET Membership in a Console Application

It’s so easy to use powerful ASP.NET Membership, Role and Profile provider in a Windows or Console application. Only one key point remains here; you should add an app.config file to your Console or Windows application and include these nodes in that:

<?xml version='1.0' encoding='utf-8'?>
<configuration>
    <connectionStrings>
        <add name="SQLConnString" connectionString="SERVER=(local);DATABASE=SampleApp;UID=sa;PWD=123"/>
    </connectionStrings>
    <system.web>

        <membership defaultProvider="SampleAppMembershipProvider">
            <providers>
                <add name="SampleAppMembershipProvider"
                     connectionStringName="SQLConnString"
                      applicationName="SampleAppMembership"
                      enablePasswordReset="true"
                      enablePasswordRetrieval="false"
                      passwordFormat="Hashed"
                      maxInvalidPasswordAttempts="100"
                      minRequiredPasswordLength="5"
                      minRequiredNonalphanumericCharacters="0"
                      requiresQuestionAndAnswer="false"
                      requiresUniqueEmail="true"
                      passwordAttemptWindow="5"
                      passwordStrengthRegularExpression=""
                      type="System.Web.Security.SqlMembershipProvider" />
            </providers>
        </membership>

        <profile defaultProvider="SampleAppProfileProvider">
            <providers>
                <add name="SampleAppProfileProvider"
                type="System.Web.Profile.SqlProfileProvider"
                connectionStringName="SQLConnString"/>
            </providers>
            <properties>
                <add name="FirstName" type="System.String" />
                <add name="LastName" type="System.String" />
                <add name="Email" type="System.String" />
                <add name="Website" type="System.String" />
                <add name="Address" type="System.String" />
                <add name="Note" type="System.String" />
                <add name="Phone" type="System.String" />
                <add name="Fax" type="System.String" />
                <add name="Feature" type="System.Int32" />
            </properties>
        </profile>

        <roleManager enabled="true" cacheRolesInCookie="true" defaultProvider="SampleAppSqlRoleProvider"                  cookieName=".ASPXSampleAppROLES" cookiePath="/" cookieTimeout="30" cookieRequireSSL="false"                  cookieSlidingExpiration="true" createPersistentCookie="false" cookieProtection="All">
            <providers>
                <clear/>
                <add name="SampleAppSqlRoleProvider" type="System.Web.Security.SqlRoleProvider,                       System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"                       connectionStringName="SQLConnString" applicationName="SampleAppRoles"/>
            </providers>
        </roleManager>
    </system.web>
</configuration>
15Oct/076

reCAPTCHA: Free CAPTCHA Solution For Your Website

Recently (and specially after Web 2.0 revolution) many websites started to use more complicated CAPTCHA solutions on their websites in order to prevent spam and bot attacks. There are many free solutions and tools for users and developers to implement CAPTCHA technology in their applications. There are also many ASP.NET controls and components for this approach but many of them are so simple to hijack or don't offer features that these days we see on professional websites (some features like reload function, voice, etc.).

A few days ago I found a link to reCAPTCHA on Yahoo!. reCAPTCHA is a free (but professional) tool for basic users and also developers. To use this service you should first signup, receive an API Key for your website (you can receive as many as you need) and use one of easy-to-install plugnins provided. And good news for ASP.NET developers is that you can download and use a server side control and enjoy reCAPTCHA with two lines of code! The API Key guarantees your website and prevents attackers collect answers from visitors and use them. There are three different themes to choose.

If you want to use reCAPTCHA on a Web 2.0 website you can use AJAX API just by adding this line of code to you html or webform file:

I strongly suggest you download and test this tool in your web applications.

Quick Links: reCAPTCHA.net | Live Demo | Why reCAPTCHA | Signup | reCAPTCHA.NET Control | Email Protection With reCAPTCHA

1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44|45|46|47|48|49|50|51|52|53|54|55|56|57|58|59|60|61|62|63|64|65|66|67|68|69|70|71|72|73|74|75|76|77|78|79|80|81|82|83|84|85|86|87|88|89|90|91|92|93|94|95|96|97|98|99|100|101|102|103|104|105|106|107|108|109|110|111|112|113|114|115|116|117|118|119|120|121|122|123|124|125|126|127|128|129|130|131|132|133|134|135|136|137|138|139|140|141|142|143|144|145|146|147|148|149|150|151|152|153|154|155|156|157|158|159|160|161|162|163|164|165|166|167|168|169|170|171|172|173|174|175|176|177|178|179|180|181|182|183|184|185|186|187|188|189|190|191|192|193|194|195|196|197|198|199|200|201|202|203|204|205|206|207|208|209|210|211|212|213| viagra sale in india in chemists sustituto de viagra pay with paypal for viagara viagra te koop in nederland levitra india generic average age for viagra viagra stories little blue pill yahoo the best viagra with no prescription vaginal viagra suppositories side effects ordering viagra online xxx pill viagra for man order viagra viagra online viagra from canada generic viagra shipped to the usa overnight infinimax viagra buy viagra without a prescription viagra with dapoxetine overnight deliveryAccutane Online Doxycycline online Buy Cheap Lexapro Online No Prescription Prednisone Online Buy Accutane No Prescription