Monthly Archives: March 2005

From april to june I will do a roadshow together with Compuware’s Kurt Aigner focusing on application security/quality assurance in the development cycle. We will kick off with a more general talk about secure development best-practices and threat modelling and after that … Continue reading →

Two new posts on the excellent blog of Shawn Farkas talk about how to securely impersonate, and that a simple try/finally will not do it. extremely recommended. UPDATEShawn shows a more elegant solution (besides that he uses vb.net :) leveraging anonymous … Continue reading →

I wrote a lot about Authorization Manager in the past, and i really believe that this piece of technology is extremely useful to virtualize your authorization decisions in complex applications. Everytime I demo AzMan to customers or students, they really like the … Continue reading →

to get an overview  

Are you using Code Access Security? Keith Brown asks this question on his blog – comment on his entry and your experiences may be incorporated in future articles on the msdn security / smart client developer area. Be sure to … Continue reading →

fellow DMer pierre has a blog now. subscribed.  

dasBlog stores log files in known subdirectories of the blog site, e.g. http://www.site.com/logs/2005-01-20.events.log or http://www.site.com/logs/2005-01-20.events.zip With a default installation (as provided by the installation instructions) these files can be downloaded anonymously and can leak information about your site. Workaroundremove read ACLs … Continue reading →

Cross-Site Scripting Vulnerability in Newtelligence DasBlog Community Edition Author:Dominick Baier <dbaier@ernw.de> 1. Summary:A XSS (Cross-Site-Scripting) Vulnerability in DasBlog’s Event Viewer allows to inject and execute code on the client’s machine. This allows an attacker to transfer the ASP.NET authentication cookie to … Continue reading →

Craig McMurtry posted some sample code for an Authorization Manager Role Provider and a ADAM Membership Provider for ASP.NET 2.0 interesting!