White Papers

Bypassing ASP .NET "ValidateRequest" for Script Injection Attacks

Overview The Microsoft .NET framework comes with a request validation feature, configurable by the ValidateRequest setting. ValidateRequest has been a feature of ASP.NET since version 1.1. This feature consists of a series of filters, designed to prevent classic web input validation attacks such as HTML injection and XSS (Crosssite Scripting). This paper introduces script injection payloads that bypass ASP .NET web validation filters and also details the trial-and-error procedure that was followed to reverse-engineer such filters by analyzing .NET debug errors. It is worth noting that the techniques included in this paper are meant to be used when ValidateRequest is enabled, which is the default setting of ASP .NET. ValidateRequest can be enabled or disabled on a per-page basis or as an application-wide configuration.

Download White Paper

By downloading you agree to our Terms and Conditions. These include information regarding use of your personal data.

Publisher
ProCheckUp
File Format
PDF
Date Published
Jan 31, 2009
Format
White Papers
Topics
Application Development, ASPs

Similiar White Papers

MSDN Webcast: geekSpeak: Asynchronous Programming Demystified With Gerald Walsh (Level 200)

MSDN Webcast: geekSpeak: Asynchronous Programming Demystified With Gerald Walsh (Level 200)

The presenter of this webcast, Microsoft MVP, provides insight into the patterns, models, objects, and practices of deve

Publisher: Microsoft Tips  |  Tags: applications, management

Developing ASP Components,: Server-Side XML Through VB ASP Components

Developing ASP Components,: Server-Side XML Through VB ASP Components

ASP application developers are not immune to the lure of XML, yet there is confusion about how XML can be used with a se

Publisher: O'Reilly Media  |  Tags: asp, developers

MSDN Webcast: geekSpeak: ASP.NET Dynamic Data With Rachel Appel (Level 200)

MSDN Webcast: geekSpeak: ASP.NET Dynamic Data With Rachel Appel (Level 200)

The geekSpeak webcast series brings the industry experts in a "talk-radio" format hosted by developer evangelists from M

Publisher: Microsoft

Determining the ROI of Web Application Acceleration Managed Services

Determining the ROI of Web Application Acceleration Managed Services

Web-based applications are virtually critical to business operations today. An understanding of the costs and benefits

Publisher: Akamai Technologies  |  Tags: applications, idc, managed services, tco

MSDN Webcast: ASP.NET Soup to Nuts: Web Application Design and Architecture (Level 200)

MSDN Webcast: ASP.NET Soup to Nuts: Web Application Design and Architecture (Level 200)

This webcast explores the design and architecture of a Web application built for scalability, reliability, and maintaina

Publisher: Microsoft