May 22
.NET "Unsafe" Security Issues — Part 1
The Microsoft .NET Framework provides the developer with a number of advanced features such as P/Invoke and unsafe code blocks. This article will take a look at unsafe code blocks and some of the security issues that should be looked for when reviewing or writing such code.
First off, what is the unsafe keyword and how can it be used? Glad you asked, unsafe allows for the use of pointers in .NET code. This includes pointers to managed objects such as arrays and strings. To use the unsafe keyword the assembly or executable must be compiled with a special flag allowing for unsafe code blocks. The resulting assembly/executable will not be verifiable by the CLR.
Modification of Immutable Types
With power comes the temptation to modify immutable types such as strings. Resist this urge as the CLR does a number of internal optimizations for known immutable types like strings. Modification of these immutable types can and will cause instability in the CLR, and have interesting ramifications. For example, some versions of the CLR keep only a single copy of strings. So if I created three strings, all with the value "Hello World", I would really only have three references to the same string. This is okay since the string object is immutable. However, if I take a pointer to the string and change its contents I will end up changing the contents of all three strings!!
Managed Pointers and Pinning
The .NET memory manager can move values and object instances around in memory as needed. So, if we are going to get a pointer to such a memory region we need to tell the memory manager not to move that memory on us. Enter object pinning. Pinning tells the CLR not to move something until it is unpinned. A typical bug in unsafe code is when a managed pointer is held on to and used after it’s reference has been unpinned. This is a hard bug to detect as the program may run fine most of time and the crashes that occur may not be obviously linked to the unsafe code.
In the C# managed language, pinning typically occurs using the "fixed" block. This makes it easier to spot issues. I recommend avoiding other methods of pinning variables as they can be harder to review.
Good Dick download Queen of the Damned dvdrip The managed extensions to C++ also provide what feels like "lower level" control over variable pinning. This is typically harder to review, but then if you are writing in MC++ you should already know what your about :)
Buffer Overflows and other Pointer Issues
With the unsafe keyword and pointer math come all the standard security issues those C/C++ developers need to worry about. There is a real possibility of causing buffer overflows that result in exploitable conditions in .NET applications. Buffer manipulation should be reviewed just like C/C++ for possible overflows.
And so ends part 1 of this article. Please feel free to comment on this post with questions and comments.
No commentsMay 22
OWASP AppSec 08 Belgium
Head of State rip ????????? ????? ????? 
I’m currently running around Europe dropping in on a few security conferences. Wednesday and Thursday have me in Ghent, Belgium at the OWASP AppSec 08 conference. I’ll be jumping onstage Thursday morning to talk about two of my OWASP projects (see below).
First time in Belgium, and I must say the Cherry Lambic is nice and it feels like a slower pace then the Netherlands with similar architecture.
OWASP Encoding Project (Reform)
OWASP .NET WebService Validation ??????????? ????? ???? ??????? ???????
Machined Reborn Fighting with Anger hd Two Mules for Sister Sara full movie
Night at the Museum 2: Battle of the Smithsonian buy
1 commentMay 19
Preventing XSS with Correct Output Encoding
Encoding output to prevent cross site scripting (XSS) is old news to most in the web security community, but it’s still an area that is done incorrectly, or with out thought to future issues that might arise. Additionally, with the explosion of AJAX based applications there is a lack of encoding tools that target JavaScript or provide an implementation for JavaScript.
30 Days of Night movie full Stepmom video
Standard framework utilities for encoding output (Server.HtmlEncode, etc) only encode the most basic set of characters needed, &, <, >, and ". In a perfect world this would be enough, but in the day and age of browser bugs, broken Unicode libraries, and lenient HTML interpretation that can lead to occasional sloppy coding more is needed to protect our applications. Enter the Reform encoding library.
Of specific mention is correct context aware output encoding. The context could be "html body", "html attribute", "css", "javascript", etc. It’s important to understand how your data will get treated to know how it needs to be encoded. It’s because of context issues that one must encode on output of data instead of input. Unfortunately there are no shortcuts :)
The Refrom encoding library, also known as the OWASP Encoding Project, provides conservative functions for performing different types of encoding’s that are needed in today’s web applications in a large variety of languages. Currently there is support for: Java, C, Python, Perl, PHP, Ruby, JavaScript, ASP.NET, and Classic ASP. All of the Reform functions are internationalization safe, are easy to use, and prevent all known types of XSS issues when used correctly.
What is encoded?
- Everything but: A-Z, a-z, 0-9, space [ ], comma [,], and period [.]
- Unicode is always encoded
The Slumber Party Massacre movie download
Asterix and the Vikings full movie
The following functions are provided: download no man s land the rise of reeker
- HtmlEncode — Encode data for display in a block of HTML or HTML attribute.
- JsEncode — Encode data into a JavaScript literal
- VbsEncode — Encode data into a VBScript string literal
Microsoft’s AntiXss Library
An alternative to Reform is the Microsoft AntiXss Library. Both libraries are functionally equivalent and in fact were designed by the same people.
Pufnstuf hd Reform can be downloaded from here.
2 commentsMay 19
Peach 2.1 BETA2.A
Silly bug got into the 2.1 release that caused the <Number> type to stop working (oops!), fixed and a new release pushed up.
Pokemon: Mewtwo Returns trailer
????? ??????? ?????? ???????? ????? ??????
Charlie Wilsons War movie download
Nightstalker One Tough Bastard
No comments
May 14
Peach 2.1 BETA2 Released
Two Rode Together movies The latest in the Peach 2 series has been posted. This release includes many bug fixes, features, improvements, and supercedes 2.0 as the recommended version to use.
- Unittests to improve stability and reliability
- Improved COM support including properties
- Improved state machine
- Fuzz network clients easily by listening for connections, not just creating them
- Remote publishers allow sending data through a Peach Agent to a remote host
- Improved Linux and OS X support via debugger.UnixGdb monitor (uses beta pygdb module)
- Deterministic fuzzing will perform test count calculation in separate thread to speed fuzzing
- Improved documentation. See the Peach 2 Tutorial which is quickly becoming the Peach 2 Guide :)
Nights in Rodanthe movie download
download open season divx Beauty and the Beast movie
No comments
Jan 25
Peach 2.1 BETA1 Released!
I’m just about to jet up to CanSecWest this is it full movie , and though I would toss up a beta of Peach 2.1. Peach 2.1 includes a new state machine which allows modeling the state of a protocol at a high level. This makes complex fuzzer creation much easier. Additionally, call based fuzzers such as COM are much easier to fuzz.
PS- If your up at CanSecWest be sure to check out my talk on Peach Friday morning.
No comments