Web security scanner - Software as service

ZeroDyaScan revolutionize web security by offering an online security scanning service running from the cloud. This service is suitable for any pocket. ZeroDayScan service utilizes a network of servers connected to the backbone to perform security assessments of the websites. Basically a private cloud is used to perform website security assesment.

On every website ZeroDayScan performs thousands of security tests. The system looks for most complicated security vulnerabilities as well as web server misconfiguration. When combined together these security tests give good and accurate results with almost zero false positives.

Zerodayscan - web security scanner - SaaS

Need a good reference for Microsoft SQL Server 2005/2008 hardening?

This paper contains administrative and operational tasks that should be taken in account from security perspective when using Mircosoft SQL Server. The article covers operative instructions and example of code snippets needed for DBA's and Server administrators.
http://www.greensql.com/content/sql-server-security-best-practices

ExternalInterface.call() in ActionScript - can expose Flash applications to XSS attacks

The ExternalInterface class is the External API, an application programming interface that enables straightforward communication between ActionScript and the Flash Player container– for example, an HTML page with JavaScript.
TheExternalInterface.call("functionNameInJavaScript",inputFromUser) function in ActionScript - allows making calls from ActionScript to JavaScript functions.
The first parameter is the name of the function in javascript, and the second one can be one or more parameters that this function receives.

Call to such method would be translated on the embedding page to a javascript code which would look as follows:

try {
    __flash__toXML(functionNameInJavaScript, "the value from inputFromUser"));
  } catch (e) {
    //Do something useful;
  }

If the inputFromUser parameter's value is Hey"people, backslash escaping character will be added automatically and the value will become to be Hey\"people .
However, the function does not escape any stray backslash characters. So input like Hello world!\"+alert('XSS')); } catch(e) {} // can lead to Cross Site Scripting attacks.

This vulnerability was found by lcamtuf and was first posted on his blog.

It is easy to find adobe flash security vulnerabilities

Meet the HP SWFScan - a free tool developed by HP Web Security Research Group, will automatically find security vulnerabilities in applications built on the Flash platform.

• Decompiles applications built on the Adobe Flash platform to extract the ActionScript code and statically analyzes it to identify security issues such as information disclosure.
• Automatic Code Review - Identifies and reports insecure programming and deployment practices and suggests solutions.
• Enables you to audit third party applications without requiring access to the source code.

Download from here

Breaking Web Browsers - Nice method for getting passwords and other user details (by Jeremiah Grossman)

Jeremiah Grossman, Breaking Web Browsers from AppSec USA 2010 on Vimeo.

AES 256 Encryption & Decryption using C# - The short way

More organizations today understand that sensitive information should be stored encrypted in their repositories (Examples: user passwords, credit cards, SSN etc). Also there are regulations and security standards such as the PCI:DSS which requires the encryption of credit card numbers.
Thus, developers in such organizations encounter the issues of encryption frequently and are required to find appropriate solutions. There are a lot of ways to encrypt/decrypt information by using buld-in .NET libraries for encryption.
I decided to present you here the shortest way that i found for doing that.

The following code is an example of the short way to encrypt/decrypt data using AES algorithm.
Please notice that in this example i stored the encryption key in the code, but of course in the real life the key should be stored in a secure repository with appropriate ACL privileges.

using System;
using System.Collections.Generic;
using System.Text;
using System.IO;
using System.Security.Cryptography;

namespace aes3
{
    class aes3
    {
        static void Main(string[] args)
        {

           RijndaelManaged  AesEncryption = new RijndaelManaged();
           string plainStr = "AES me"; // The text that would be encrypted
           AesEncryption.KeySize = 256; // 192, 256
           AesEncryption.BlockSize = 128;
           AesEncryption.Mode = CipherMode.CBC;
           AesEncryption.Padding = PaddingMode.PKCS7;

           // The key should be generated prior and also should be stored in secure repository
            // with appropriate ACL priviledges.
           string keyStr = "cGFzc3dvcmQAAAAAAAAAAA==";
           string ivStr = "cGFzc3dvcmQAAAAAAAAAAA==";
           byte[] ivArr = Convert.FromBase64String(keyStr);
           byte[] keyArr = Convert.FromBase64String(ivStr);
           AesEncryption.IV = ivArr;  
           AesEncryption.Key = keyArr;
    
           // This array will contain the plain text in bytes
           byte[] plainText = ASCIIEncoding.UTF8.GetBytes(plainStr);

           // Creates Symmetric encryption and decryption objects   
           ICryptoTransform crypto = AesEncryption.CreateEncryptor();
           ICryptoTransform decrypto = AesEncryption.CreateDecryptor();
           // The result of the encrypion and decryption
           byte[] cipherText = crypto.TransformFinalBlock(plainText, 0, plainText.Length);
           byte[] decryptedText =  decrypto.TransformFinalBlock(cipherText,0,cipherText.Length);

            Console.Write("The plain text\"{0}\" in the encrypted format is:{1} \n",plainStr,Convert.ToBase64String(cipherText));
            Console.Write("The encrypted text \"{0}\" is decrypted to: {1}",Convert.ToBase64String(cipherText), ASCIIEncoding.UTF8.GetString(decryptedText));
            Console.Read();
        }
    }
}

Avoiding SQL Injection attacks in stored procedures that must be dynamic

No doubt that stored procedures which use dynamic construction of queries by string concatenation technique are vulnerable to SQL injection attacks. In order to prevent the attack, stored procedures should not use such technique and the sql statements should be written as a part of the T-SQL syntax with sql parameters.

However, under certain circumstances the use of dynamic construction is not avoidable.For example in Microsoft SQL Server you cannot write a T-SQL stored procedure which contains parameters such as table or a column name. In this case you must interpolate it into the SQL string using the string concatenation technique.

So what is the solution for this issue?

Very simple, actually there are two ways to do it as follows:
1. Using the quotename() function which was added in sql 7. The function takes two parameters: the first is a string, and the second is a pair of delimiters to wrap the string in. The default for the second parameter is []. Thus, quotename('table_name') returns [table_name]. quotename() takes care of nested delimiters, so if table name like table]_name, quotename() will return [table]]_name]
The following example demonstrates how treat the table_name in order to avoid the SQL Injection attack:

 
ALTER PROCEDURE [DBO].[EmptyTables]
(
@table_name NVARCHAR(30)
)
AS DECLARE @sql NVARCHAR(100)
BEGIN
IF CHARINDEX (']',@table_name,1 ) > 0
                        BEGIN
                                SET @error1='Error'
                                RAISERROR( @error1 ,11,1 );       
                        END
                SET @sql='TRUNCATE TABLE ' + quotename(@table_name)
                EXEC sp_executesql @sql
END

2. Using the [] characters in order to indicate that the table or the column name is an object. In such case if the attacker injects the following query in the table_name paramater as follows: sometable';drop table users --, the database will raise the following error :Cannot find the object "';drop table users --'" because it does not exist or you do not have permissions.
The following example demonstrates how treat the table_name in order to avoid the SQL Injection attack:

 
ALTER PROCEDURE [DBO].[EmptyTables]
(
@table_name NVARCHAR(30)
)
AS DECLARE @sql NVARCHAR(100)
BEGIN
IF CHARINDEX (']',@table_name,1 ) > 0
                        BEGIN
                                SET @error1='Error'
                                RAISERROR( @error1 ,11,1 );       
                        END
                SET @sql='TRUNCATE TABLE [' + @table_name + ']'
                EXEC sp_executesql @sql
END