Security threats associated with exposed server side error details

Security threats associated with exposed server side error details

This topic may be categorized under penetration testing and hacking for a website. According to Open Web Application Security Project (2014), there are many SQL Injection exploitation techniques that utilize detailed error messages from the database driver. Further in depth testing and code review may help determine possible vulnerabilities and minimize the risk.

Improper error handling is not only unpleasant for the end user, but also serves as a starting point for the hackers to define strategy by exposing high level and low level software components deployed to build an application. It may include how the website is logically built up from top to bottom along with database schema. If an expert attackers knows exactly the building blocks and DB schema of an application, he is half done stealing the confidential information you may be hiding from anonymous users.

All the software bundles provide developers with basic building blocks which may be used to do robust error handling. For example:

·         Apache is a common HTTP server for serving HTML and PHP web pages. By default, Apache shows the server version, products installed and OS system in the HTTP error responses. Responses to the errors can be configured and customized globally, per site or per directory in the apache2.conf using the ErrorDocument directive. In case of error, Apache can be configured to output hardcoded error message, a customized message, redirect to external or internal page using ErrorDocument directive. Administrators may configure AllowOverride using .htaccess file. For allowing ErrorDocument you need to set AllowOverride to All. ServerTokens and ServerSignature may be configured to hide server specific information in http errors.

·         Generally Microsoft technologies based web applications are deployed on Internet Information Services (IIS). In a typical .Net web application, developers may suppress the unhandled errors being exposed to users by custom error page. A .Net web application which shows yellow screen of error is built by novice team of developers. In some of the applications, error handling is taken very seriously using custom exception handling http modules. Along with custom error page a unique identifier is sent as a hidden variable to the client side, which end user may be easily instructed to share with support team. This unique identifier is generated by the custom http error handling module, and saved along with error information in multiple possible ways. Some the applications I have seen use third party frameworks like Elmah and Log4net for robust logging in flat text files and error database. A detailed low level application design defines what information is required by end user to do correction in input data and what else is to be hidden by the error handling modules assigning a tracking unique identifier.

Next time, when you are in development phase of a web application, remember that your responsibility to handle errors does not end with a try catch finally. There must be low level details specified and planned for well ahead. Some hacker on the other corner of this world is waiting for you to shirk work.

References

Apache Software Foundation. (2015, December 10). Log4net (Version 2.0.5) [Computer software]. Retrieved from https://www.nuget.org/packages/log4net/

Aziz, A. (2012, April 13). ELMAH (Version 1.2.2) [Computer software]. Retrieved from https://www.nuget.org/packages/elmah/

Open Web Application Security Project. (2014, August 8). Improper Error Handling. Retrieved February 23, 2016, from https://www.owasp.org/index.php/Improper_Error_Handling

Penn Computing. (2016, February 26). SWAT Top Ten: Improper Error handling. Retrieved February 26, 2016, from http://www.upenn.edu/computing/security/swat/SWAT_Top_Ten_A7.php

The Apache Software Foundation. (2016). Apache Core Features. Retrieved February 26, 2016, from http://httpd.apache.org/docs/2.2/mod/core.html

Analyze loopholes in SharePoint Security Framework

Annotated References

Dokic, D., Zrakic, M. D., Bogdanovic, Z., & Labus, A. (2015). Application of SharePoint Portal Technologies in public enterprises. Revija za univerzalno odličnost [Journal of Universal Excellence], 4(1), A11-A25. Retrieved from http://www.fos.unm.si/media/pdf/RUO/2015-4-1/Application_of_sharepoint_portal_technologies_in_public_enterprises.pdf

This paper deals with application of portal technologies for enhanced content management, document management, and collaboration within public enterprises. The goal is to achieve efficient exchange of information on all hierarchical levels, as well as mechanisms of reporting and performance measurements, such as business intelligence and key performance indicators, taking into account concepts of scalability, availability, ubiquity and pervasiveness. A case study of application within the public enterprise Post of Serbia is used to achieve the goal. The results of analysis show that application of Information and Communication Technologies (ICT) necessarily leads to transformation of business processes that are based on flow of paper documents. In addition, application of ICT leads to standardization, changes in organization structure, and change management.

 SharePoint as an ICT needs major organizational level contribution from participants and there is no unified approach available as of date, which could be implemented to streamline process, in order for a smooth transition. When it comes to surface that this transformation is way too expensive than expected and relatively unsecure, generally it’s too late. There should be a formal study published, to identify these risk factors.

Jali, M. Z., Furnell, S. M., & Dowland, P. S. (2010). Assessing image-based authentication techniques in a web-based environment. Information Management & Computer Security, 18(1), 43-53. doi:10.1108/09685221011035250

The authors analyzed usability of two image-based authentication methods when used in the web-based environment - clicking secret points within a single image (click-based) and remembering a set of images in the correct sequence (choice-based). For direct comparison of usability same set of forty participants (thirty-three males and seven females) were given paper and web based tasks and based on user feedback, these two techniques were evaluated. The results suggest that click based authentication is more secure and choice-based authentication has better scores in terms of usability. Although participants rated the choice-based method as weak, it was still their preferred alternative for replacing passwords. This result suggests that participants preferred "convenience", albeit with an awareness of the "security" risks.

With SharePoint 2013 claim based authentication, it might be possible to insert multiple security layers enveloped under same set of services. Username and password combination along with click-based/choice-based user verification is something we need today. It’s worth a million dollar to conduct usability & technical feasibility study of suggested approach.

Nastase, P., & Eni, L. C. (2015). Developing an online collaborative system within the domain of financial auditing. Amfiteatru Economic, 17(39), 823-835. Retrieved from http://econpapers.repec.org/article/aesamfeco/v_3a39_3ay_3a2015_3ai_3a17_3ap_3a823.htm

The paper discusses technical design for online availability of audit records using SharePoint. The online audit records here means information required by both financial auditors and the employees of the Chamber of Financial Auditors of Romania. This technical design evaluation involved feasibility study and later implementation using Microsoft SQL Server 2008 R2, SharePoint Server 2010, SharePoint Designer 2010 and various implementation features: external content types, external lists, business data web parts etc. Two research methods highlighted in this paper are: the first one is empiric, based on formulating a questionnaire and the interpretation of the results, while the second is the analysis of the implementation process by using a step-by-step approach. The online audit database stores information about the results of previous audits, the opinions issued as result of audits, the results of online electronic inspections, audit firms, audited entities, risks identified etc. The conclusion was that the online database, which is updated through Internet, is feasible to implement in SharePoint, for multiple audit stakeholders including financial auditors who can sell their financial audit services benefiting from the transparency that the system provides.

This article, even though elaborates well the technical design and feasibility of SharePoint and related tools for reporting purposes and signifies use cases where business connectivity services may be leveraged. One of the most important concerns is untouched here: dynamic nature of reports (if required) based on business rules for multiple users using same platform. This must be addressed in a separate paper, considering the fact that when a solution is implemented it must cater future needs and at the same time this flexibility should not open new security loopholes.

Send bulk email using gmail or any other server

1. Visit https://www.google.com/settings/security/lesssecureapps  and enable access for less secure apps for some time

2. Verify that your machine where powershell is available , latest version of .Net Framework is installed.

3.  Verify that in powershell you have "Send-MailMessage" available .

(in powershell window type  :---- Get-Command Send-MailMessage )

4.   Export your gmail/ any other email account contacts as csv  . Say it has name of contact column as "name"  and email as "email"

5. Create the sample html you want to send , say some dummy html

6. Here is a sample ps1 using  "Send-MailMessage" with gmail

sample script

7. Give your sleep time in powershell script  with respect to  Gmail send message limits https://support.google.com/a/answer/166852?hl=en  and https://support.google.com/a/answer/175121?hl=en

8. don't forget to disable less secure apps @ https://www.google.com/settings/security/lesssecureapps   after you are done .

null id in entry (don't flush the Session after an exception occurs)

Sample Exception :  ( This example is using postgresql 9.3)

null id in YourModelNamespace.Model entry (don't flush the Session after an exception occurs)
NHibernate.AssertionFailure was caught
HResult=-2146232832
Message=null id in YourModelNamespace.Model  entry (don't flush the Session after an exception occurs)
Source=NHibernate
StackTrace:
at NHibernate.Event.Default.DefaultFlushEntityEventListener.CheckId(Object obj, IEntityPersister persister, Object id, EntityMode entityMode)
at NHibernate.Event.Default.DefaultFlushEntityEventListener.GetValues(Object entity, EntityEntry entry, EntityMode entityMode, Boolean mightBeDirty, ISessionImplementor session)
at NHibernate.Event.Default.DefaultFlushEntityEventListener.OnFlushEntity(FlushEntityEvent event)
at NHibernate.Event.Default.AbstractFlushingEventListener.FlushEntities(FlushEvent event)
at NHibernate.Event.Default.AbstractFlushingEventListener.FlushEverythingToExecutions(FlushEvent event)
at NHibernate.Event.Default.DefaultFlushEventListener.OnFlush(FlushEvent event)
at NHibernate.Impl.SessionImpl.Flush()
at NHibernate.Transaction.AdoTransaction.Commit()
at YourNamespace.UnitOfWork.NHibernateUnitOfWork.Dispose(Boolean disposing) in c:\Users\..........\UnitOfWork\NHibernateUnitOfWork.cs:line 78
at YourNamespace.UnitOfWork.NHibernateUnitOfWork.Dispose() in c:\Users\..............\UnitOfWork\NHibernateUnitOfWork.cs:line 36
at sourcenamespace.class.method(input parameters ) in c:\Users\hemant\.......\mycalss.cs:line 82
at wrapper.cs in c:\Users\hemant\.....\api\someController.cs:line 134
InnerException:

 

Possible Reasons / Solutions : 

1.  uninstall  FluentNHibernate  ,  NHibernate ,  Iesi.Collections . install FluentNHibernate   , it will automatically install correct version of NHibernate and Iesi.Collections required . Check if your app.config / web.config have wrong versions of dll's referred , may be under runtime .

2. Generally  in nhiberante mappings you define id field for the table like :

Id(x => x.somecolumn).GeneratedBy.Assigned().Not.Nullable();   // reflection to determine column name so its ok to skip .column here

//or

Id(x => x.SomeColumn).GeneratedBy.Assigned().Column("\"SomeColumn\"").Not.Nullable();

//In the above two cases , your own code is responsible to maintain unique id . So used //Assigned

//or

Id(x => x.SomeColumn).GeneratedBy.Assigned().Column("some_column").Not.Nullable();

//snake_case  so ok to skip  \"

//or

Id(x => x.Id).GeneratedBy.Sequence("\"My_Id_seq\"").Column("\"Id\"");

// in the above case you have a Sequence to generate unique ids / primary key  in db

or else

The idea is after GeneratedBy  make sure you have chosen right option as per your table  e.g.

• Assigned :   lets the application to assign an identifier to the object before Save()  is called. ( with or without Params configuration )


• Foreign  :  uses the identifier of another associated object. Usually used in conjunction  with a one-to-one primary key association.


• HiLo :   uses a hi/lo algorithm to efficiently generate identifiers of any integral type, given a table and column (by default hibernate_unique_key and next_hi respectively) as a source of hi values. The hi/lo algorithm generates identifiers that are unique only for a particular database. Do not use this generator with a user-supplied connection. requires a "special" database table to hold the next available "hi" value


• Identity  :   supports identity columns in DB2, MySQL, MS SQL Server and Sybase. The identifier returned by the database is converted to the property type using Convert.ChangeType. Any integral property type is thus supported.


• Increment :   generates identifiers of any integral type that are unique only when no other process is inserting data into the same table. Do not use in a cluster.


• Sequence :  uses a sequence in DB2, PostgreSQL, Oracle or a generator in Firebird. The identifier returned by the database is converted to the property type using Convert.ChangeType. Any integral property type is thus supported.

See FluentNHibernate.Mapping.IdentityGenerationStrategyBuilder  for more possible options.

 

 

 

 

 

 

An error occurred. Detailed message: An error was raised by libgit2.Category = Net (Error). Response status code does not indicate success:401 (Unauthorized).

An error occurred. Detailed message: An error was raised by libgit2. Category = Net (Error).
Response status code does not indicate success: 401 (Unauthorized).

This is what happened when I changed my password for Git Repository ( with Visual Studio Tools for Git http://visualstudiogallery.msdn.microsoft.com/abafc7d6-dcaa-40f4-8a5e-d6724bdb980c )

Solution :

1. Close all Visual Studio instances


2. Go to Control Panel > Credential Manager


3. Delete the entries related to your repository.(Link )


4. Now whenever you will try to connect to server using Visual studio , it will ask for credentials and recreate these entries in Credential manager.

Should I Pay money to Google Adsense ? Prove using Powershell

Last week I  finalized a new hosting plan . It offers me $100 worth of code for Google adsense and similar programs.  This was the 1st time I saw Google adsense with angle of an advertiser . (Probably when I last time renewed my hosting  also , I got these codes , but never used it . Was not even aware of what it is at that moment )

1st question which comes to me , do they make us fool !!! Does this $ 100 really worth something .  After all brainstorming  my conclusion is : if you are selling a product , invest only in a program  which charges you as per actual product sale .  Never invest in Google adsense and similar programs , who just take responsibility of taking user to your door on web , if they don't promise / convert in to actual sale , don't pay them .

Well, I am not saying something in air . I have valid points to prove it , if you agree with below mentioned , you must admit what I said above :

Muliple Get, Put, Post, Delete under Web API calls to same Controller from Angular JS

In the example mentioned below , you could define multiple PUT to same Web API controller