How to Configure WPL v1.0 SRE

RV here… With the release of Web Protection Library v1.0 (WPL) Security Runtime Engine (SRE) has been significantly updated. It now includes a SQL Injection Detection module which can detect certain attack vectors. It also include re-designed configuration editor which enables you to easily configure SRE. The following easy steps let you configure your application…


Double Hop Windows Authentication with IIS Hosted WCF Service

Hello, Randy Evans here.  I am a principal developer on the Information Security Tools Team.  In a recent project, we had a intranet web site that called an IIS hosted WCF service.  The WCF service, in turn, called a SQL Server Reporting Services (SSRS) web service. We wanted to utilize the authorization mechanisms of SSRS….


How to: Restart a Remote Server Using Command Prompt

Syed Aslam Basha here. I am a tester on the Information Security Tools team. In our team am responsible for setting up and maintaining test servers. At times the servers are remotely located and doesn’t respond and you need to restart them. You can contact helpdesk which would involve some time. I found an easy…


How To Publish an ASP.NET Website from a Command Line

Syed Aslam Basha here. I am a tester on the Information Security Tools team. To test the tools which we develop on the team, at times I need to build a website and publish it. I use a simple way of publishing websites from the command line that saves me a LOT of time so…


Sharing Master Pages in Multiple Projects

Hi Anil Chintala here. I am working on a requirement for a Portal, which is to share the look and feel of the portal by multiple web applications seamlessly and without any rework. I started doing some prototyping work and writing up some scenarios we would like to consider for the requirement. For the sake…


Application Health Monitoring (in ASP.NET 2.0 and above)

Vineet Batta here, A little known but excellent features of ASP.NET is it’s ability to give support teams the ability to monitor the health of ASP.NET applications. In this article I will dwell on out of box features. No custom classes or code to be written. All the configuration setting for enabling Health monitoring (HM)…


SSL Redirect – Http Module

Vineet  Batta here again… Some time back one of our applications was released into production and since the application data was HBI  we were required to protect data both in a rest and a transit. For transit we enabled SSL, that is the link to get to the application will require https://[websiteName] instead of http….


Self-Service Identity and Access Management Solution (Easy ID)

Raju Bhan here, I am a PM on the Information Security Tools team   If you haven’t had a chance to go through my last blog about ensuring identity consistency, please check it out here since Easy ID is an extension of that. Easy ID was created to make email addresses at Microsoft more customer…


Web Protection Library (WPL) – A Brief Introduction

RV here… I wanted to share with you some tidbits on our new project called Web Protection Library (WPL) which contains libraries to protect web applications from common vulnerabilities and attacks. Our goal is to offer comprehensive web application protection with minimal configuration. With the release of Anti-XSS 3.0 we offered Cross Site Scripting attack…


What’s Coming from the Information Security Tools Team

Mark Curphey here (Follow me using @curphey on Twitter). June is a busy time of year around MSFT. For most teams you have a pretty good idea about your budget for the next year (July – July) and the end of year performance review cycle kicks in. You spend most of your time in retrospective…