Here’s an excerpt:

Madison Square Garden can seat 20,000 people for a concert. This blog was viewed about 68,000 times in 2011. If it were a concert at Madison Square Garden, it would take about 3 sold-out performances for that many people to see it.

Click here to see the complete report.

After 2.5 years, I again started the development in Asp.NET. I developed a site and deployed it on IIS7. As I uploaded the site and access it from browser, I found an error that was saying that

HTTP Error 500.24 – Internal Server Error

An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode

After some googling, I found the solution of this error. This error needs one line of configuration that should be added in Web.Config file. This is

<system.webServer>
        <validation validateIntegratedModeConfiguration=”false” />

</system.webServer>

Hopefully, this article help you.

Regards,

Rana Faisal Munir

Today, I want to start the writing on the ethical hacking. But before going to further in the Ethical Hacking Course, I introduced myself once again. I am Rana Faisal Munir, working on Semantic based Web Application Firewall at SEECS-NUST, Islamabad as a Web Application Security Researcher. My research work is to analyze the web application attacks, and how effectively we can detect them.  During my study on the web application attacks, I also practically launched these attacks manually or by using different tools. I also used my skills for penetration testing.

I start this series of tutorial to share my experience with you guys, so that you can used my knowledge to test your site for potential vulnerabilities and how you can fix them to make your site secure.

In this Ethical Hacking course, we will cover the following topics

1. Understanding of Web Application as an Attacker Point of View
2. Information Gathering
3. Cross Site Scripting Attack
1. Reflected
2. Stored
4. SQL Injection Attack
5. Local and Remote File Inclusion
6. Shell Uploading
7. Cross Site Request Forgery Attack
8. Parameter Manipulation
9. Session Fixation
10. Brute Force Attack
11. AJAX Testing
12. Use of Intermediate Proxy
13. Use of Vulnerabilities Scanners
14. Use of Exploitation Tools [Metasploit]

Regards

Rana Faisal Munir

After a long time, Now I again start the writing. I stopped writing because I start MS from NUST. That’s why I leave the .NET development and start working on Web Application Security as my Research Thesis.

Today, I am writing on the SEECS Open House. I visited it and according to my research interest, visit the different student projects.  I SAW many security related projects, some of them are

• Web Application Scanner for Web 2.0 Attacks
• Detecting Application Layer DDoS
• Rootkit Development and Detection
• Botnet Developement

I liked these projects and appreciate students efforts. But today I want to discuss a project that catch my attention. It is about Botnet, student developed his own BOTNET server and then through a trojan, infect the clients machine. Then he can control all machines from the Server. The trojan hide its process, but the things that I like most, it hides the traffic that he used to communicate with server. User can use any sniffer like wireshark to see the traffic, but he did not sniff the traffic of botnet.  This is uniqueness that student shows in his Final Year Project.

The best industry project of SEECS open house is not related to Security . but I liked the student presentation and their innovative work.

Regards

Rana Faisal Munir

Today I come with a pretty cool problem or say requirement that our client demand from us. He want, when a user sign out from our site then he will redirect to home page and if he try the back button then the back page should not opened. Because that page is secure page and we have to disable the back button.

I search it and found a good solution.

When we request any page from server, browser maintains its cache in local system. When user press back button the cached page opened in front of user.

Its mean we have to disable the cache functionality for our session pages. So for this you have to insert this code into “Page_Load” event of the session page or to master page that is used for secure pages.

Response.Buffer= true;
Response.ExpiresAbsolute=DateTime.Now.AddDays(-1d);
Response.Expires =-1500;
Response.CacheControl = “no-cache”;
if(Session["SessionId"] == null)
{
Response.Redirect (“Home.aspx”);
}
}

This code just disable the cache for current page and save this page in buffer.

And buffer is maintained in memory so when user logout the buffer will
destroy and no backup copy of that page available to view.

So its mean we successfully disable the back button.

Regards

Rana Faisal Munir

Sorry for delay. This delay because of that I again start the education after 1 year of web development.  But now I again start the development and want to share something new that I did for my BOSS.

Requirements:

We have to make HR (Human Resource) components for some organization. Our client demanded that his client can entered multiple degrees. In start we only have text boxes for only one degree but when user press add another we must add other fields dynamically and maintain the contents of old degrees and change the buttons to remove for them and for new add and empty fields appeared.

Solution:

We have two solutions to solve this problem.

One is to use JavaScript [ But I hate it ]

So I use repeater and DataSet to gain the same functionality that our client wanted.

We have a page on which we add repeater

Page Name: Default.aspx

<%@ Page Language=”C#” AutoEventWireup=”true” CodeFile=”Default.aspx.cs” Inherits=”_Default” %>

<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Transitional//EN” “http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd”>

<html xmlns=”http://www.w3.org/1999/xhtml” >
<head runat=”server”>
<title>Untitled Page</title>
</head>
<body>
<form id=”form1″ runat=”server”>
<div>
<asp:Repeater ID=”Repeater1″ runat=”server” OnItemCommand=”Repeater1_ItemCommand” OnItemDataBound=”Repeater1_ItemDataBound”>
<HeaderTemplate>
<table>
<tr>
<th>Book Title</th>
<th>Book ISBN</th>
</tr>

</HeaderTemplate>
<ItemTemplate>
<tr>
<td>
<asp:TextBox ID=”txtBookTitle” runat=”server” Text=’<%# DataBinder.Eval(Container.DataItem, “Title”) %>’></asp:TextBox>
</td>
<td>
<asp:TextBox ID=”txtISBN” runat=”server” Text=’<%# DataBinder.Eval(Container.DataItem, “Isbn”) %>’></asp:TextBox>
</td>
<td>
<asp:Button ID=”btnAddAnother” runat=”server” Text=’<%# DataBinder.Eval(Container.DataItem, “Button”) %>’ CommandName=’<%# DataBinder.Eval(Container.DataItem, “Button”) %>’ />
</td>
</tr>
</ItemTemplate>
<FooterTemplate>
</table>
</FooterTemplate>
</asp:Repeater>
</div>
</form>
</body>
</html>

In ITEMTEMPLATE of repeater we add the text boxes and a button, we also set the text for text boxes to maintain their  values. For button set the command and text because I want to change this in “Remove” when new one is added.

Now on the backend coding page we have to write this code

Page Name: Default.aspx.cs

using System;
using System.Data;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;

public partial class _Default : System.Web.UI.Page
{
DataSet dsDummy =  null; //dummy dataset use for repeater
DataTable tbDummy = null; //dummy table for dataset
protected void Page_Load(object sender, EventArgs e)
{
// Intitalization
dsDummy = new DataSet();
tbDummy = new DataTable();
//Only first time of page load
if (!Page.IsPostBack)
{

AddColumns();

//Add dummy row to table
tbDummy.Rows.Add(“”,”",”Add”);

BindWithRepeater();
}
}

On Page load we add our required columns and set the row to empty as u see and then bind this to repeater. So in initially we add only one row so only one row of text boxes is appeared.

protected void Repeater1_ItemCommand(object source, RepeaterCommandEventArgs e)
{
int Total = Repeater1.Items.Count; //get total items in repeater
if (e.CommandName == “Add”)
{
Total = Total + 1; //increase 1 because of add

AddColumns();

foreach (RepeaterItem item in Repeater1.Items)
{
//getting the values of user entered fields
string title = ((TextBox)item.FindControl(“txtBookTitle”)).Text;
string isbn = ((TextBox)item.FindControl(“txtISBN”)).Text;
Button btnAdd = ((Button)item.FindControl(“btnAddAnother”));

//now change button text to remove, and save user entered values in table
tbDummy.Rows.Add(title, isbn, “Remove”);

}

//Add dummy row, because we need to increase
tbDummy.Rows.Add(“”, “”, “Add”);

BindWithRepeater();
}
else if (e.CommandName == “Remove”)
{
Total = Total – 1;
tbDummy.Columns.Add(“Title”);
tbDummy.Columns.Add(“Isbn”);
tbDummy.Columns.Add(“Button”);

foreach (RepeaterItem item in Repeater1.Items)
{
Button btnAdd = ((Button)item.FindControl(“btnAddAnother”));
if (btnAdd != e.CommandSource) //the current row on which user click will removed
{
string title = ((TextBox)item.FindControl(“txtBookTitle”)).Text;
string isbn = ((TextBox)item.FindControl(“txtISBN”)).Text;

if (btnAdd.Text == “Remove”)
{
tbDummy.Rows.Add(title, isbn, “Remove”);
}
else
{
tbDummy.Rows.Add(title, isbn, “Add”);
}
}

}

BindWithRepeater();
}
}

In ItemCommand, we have to tackle both Add and Remove functionality. So we did this by checking command. And you see when We add the row to table we add the previous entry by getting it from repeater and adding only one for new.

Similarly when we remove we have to check that the button that is clicked. So we check this by a condition compare with sender if not equal then we add it in table and just not adding that one on which user click remove. So by doing this we automatically remove the one row.

private void AddColumns()
{
//Add 3 dummy coloumn, this can be increase on our need basis
tbDummy.Columns.Add(“Title”);
tbDummy.Columns.Add(“Isbn”);
tbDummy.Columns.Add(“Button”);
}

private void BindWithRepeater()
{
//add this table to dataset
dsDummy.Tables.Add(tbDummy);

//bind this dataset to repeater
Repeater1.DataSource = dsDummy;
Repeater1.DataBind();
}
protected void Repeater1_ItemDataBound(object sender, RepeaterItemEventArgs e)
{

}
}

That’s it. This is not much good programming practice But I think good to do thing quickly under work load and tight deadline.

Now one request, Just Pray for ME

Regards

Rana Faisal Munir

In this post I come a solution of a problem that I face in my last web application. In my application I need to generate linkbutton dynamically and add them in place holder that is inside an updatepanel. But problem is that after adding the control when I click on link button, it give me full postback. Mean no ajax is implemented.

I found a very simple solution for this.

Step 1: How To Generate LinkButton Dynamically

Here is code
LinkButton lnkAnyName = new LinkButton();

lnkAnyName .Text = “Any Title”;

lnkAnyName .Click += new EventHandler(lnkAnyName_Click);

PlaceHolderName.Controls.Add(lnkAnyName );

This code add the link button but when you click on itm it post back the page.

Step 2: Perform LinkButton Action Asynchronously

Here I again write the above code but with one change

LinkButton lnkAnyName = new LinkButton();

lnkAnyName .Text = “Any Title”;

lnkAnyName .ID= “Any Unique Id”; //This is that we are missing here

lnkAnyName .Click += new EventHandler(lnkAnyName_Click);

PlaceHolderName.Controls.Add(lnkAnyName );

Now check your link button, It will not post back. You solve the issue.

Please remember one thing, your place holder must be inside Update Panel.

Thanks

Pray For Me

This is very simple class that I used to generate thumbnail of images. You just pass it file name. It generate the thumbnail from file and store it in thumbnail folder. You can change width and height. And path of original image and thumbnail image. Better way is to store path in web.config file and access here.

using System;
using System.Data;
using System.Configuration;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Drawing;

/// <summary>
/// Summary description for Thumbnail
/// </summary>
public class Thumbnail
{
private int Width = 100;
private int Height = 100;
string ThumbFolderPath = “~/Contents/Thumb/”;
string OriginalFolderPath = “~/Contents/Images/”;

public Thumbnail()
{
//
// TODO: Add constructor logic here
//
}

public bool GenerateThumbnail(string fileName)
{
try
{
//Get The Image From File
System.Drawing.Image OriginalImage = System.Drawing.Image.FromFile(HttpContext.Current.Server.MapPath(OriginalFolderPath + fileName));
//Create ITs Thumbnail
System.Drawing.Image ThumbImage = OriginalImage.GetThumbnailImage(Width, Height, null, new System.IntPtr());
//Store It in Thumbnail Folder
ThumbImage.Save(HttpContext.Current.Server.MapPath(ThumbFolderPath + fileName));

return true;
}
catch
{
return false;
}
}
}

Thanks

Rana Faisal Munir

Asp.Net Developer

Relax Solutions

Step1
//Add this on page load
if(!Page.IsPostBack)
{
Page.ClientScript.RegisterClien

Today I will present this article about how to rewrite our URL. Mean how to make our URL user friendly or Search like friendly.

Suppose you have a video site On which you have category for videos. Let suppose we want to display all videos when user click on a categories link. We have a page DisplayVideo.aspx which accept category id and display all its videos. The url look like http://localhost/MyWeb/DisplayVideo.aspx?CategoryId=1

But it is not user friendly and difficult to remember this url. So to make this user friendly, may you want like this http://localhost/MyWeb/Category/CatName, To accomplished this we user URL rewriting.

First of all we use an open source URL rewriting engine. This can help us to do this in just 5 minute.

For that we have to follow these steps

1- Download The library

http://www.urlrewriting.net/en/Download.aspx, open this url and download the required dll.

2- Add this in You website bin folder

Now extract the dll and add it in bin folder using Add reference option.

3- Make These changes in web.config files

Add this in <configsections> tag

<!–For URL Rewriting Start–>
<section name=”urlrewritingnet” restartOnExternalChanges=”true” requirePermission =”false” type=”UrlRewritingNet.Configuration.UrlRewriteSection,UrlRewritingNet.UrlRewriter” />
<!–For URL Rewriting End–>

In <httpmodule> add this tag

<add name=”UrlRewriteModule” type=”UrlRewritingNet.Web.UrlRewriteModule, UrlRewritingNet.UrlRewriter” />

Now this is important part of our configuration, here we apply rule to rewrite our url

<!–For URL Start–>
<urlrewritingnet rewriteOnlyVirtualUrls=”true” contextItemsPrefix=”QueryString” defaultPage = “default.aspx”   xmlns=”http://www.urlrewriting.net/schemas/config/2006/07″ >

<rewrites>
<add name=”RuleForCats”  virtualUrl=”~/category/(.*)”
rewriteUrlParameter=”ExcludeFromClientQueryString”
destinationUrl=”~/DisplayVideo.aspx?categoryName=$1″
ignoreCase=”true” />
</rewrites>

</urlrewritingnet>
<!–For URL End–>

Now let see what happening here, when user request that page http://localhost/Catgeory/Music

To handle it we write ~/DisplayVideo.aspx?CategoryName=Music, mean now our DisplayVideo.aspx page gets the CategoryName. We programmatically get its id and show all videos.

But now you will see how it is easy. User type this http://localhost/Category/Entertainment and got all videos of Entertainment categories.

Thats it we complete URL Rewriting in just 5 minute.

Need you Pray

Thanks