Sensitive Server Data Info Leakage

Server Error (dots in URL)

Issue description: Asp.net Server error [Unable to redirect to custom error page] when three dots (…) placed after directory name in url, Custom error page will not work if below attribute is set to false. www.yourwebsite.com\somefolder\ ... By default in asp.net application will be configured relaxedUrlToFileSystemMapping = " false, which means each http request will be validated by ‘Server OS file path validation component’. So when we pass (.) or (..) in URL first it will be validated by this component then the valid request will be passed to IIS. By setting relaxedUrlToFileSystemMapping = " true " it will bypass the ‘Server OS file path validation’, so all the http request will directly reach to IIS. Same scenario has been explained in below figure. Mitigation: ...

Visual Studio 2010 Error HRESULT E_FAIL has been returned from a call to a COM component.

I was using Visual Studio 2010. I was debugging a web application and an exception happened and VS 2010 froze. I ended the VS 2010 in the task manager and when I went back to developing, I found on every form for every ASP.net control I get: Error Creating Control - Error HRESULT E_FAIL has been returned from a call to a COM component. Also I am unable to edit the form or add anything from the toolbox. Solution: This error comes because of Caching of Visual Studio Delete the Cache. You can delete the project cache at "Program Files\Microsoft Visual Studio 10.0\Common7\IDE\ProjectTemplatesCache", then run "devenv /setup" to build the cache again to see if it helps.

Product/Application/ Software Security Testing

Product/Application/ Software Security Testing Application Security testing is the process to find security issues or security vulnerability in the application using automated and manual security scanner tools and share the identified issues or risk with development or application team. Process will remain mostly same in all the different types of application security scan. Before initiating security scan, its always good to identify the boundary and scope of your security testing. Below are the few example of which we can consider as Application or software. ( Scope for Application Security Testing) Web Application, Portal. Web API. Desktop Software / Thick Client. Mobile Application. Web Services. Plug in, Add-On The goal of application security is to secure the application and prevent the unwanted damaged. The process of performing security scan or audit is know as ASA (Application Security Assessment). Generally there are three types of ASA, SAST, DAST...

Everyday Learning

Search This Blog