How to Configure WPL v1.0 SRE

RV here… With the release of Web Protection Library v1.0 (WPL) Security Runtime Engine (SRE) has been significantly updated. It now includes a SQL Injection Detection module which can detect certain attack vectors. It also include re-designed configuration editor which enables you to easily configure SRE. The following easy steps let you configure your application…


Web Protection Library – CTP Release Coming Soon

RV here… Over the last couple of months we have been actively developing the next version of Anti-XSS library and Security Runtime Engine (SRE). We have added new mitigations that go way beyond the original Cross Site Scripting (XSS) protections of the Anti-XSS Library hence the change in name to the Web Protection Library or…


Encoding Cascading Style Sheet Strings

RV here… Cascading Style Sheets provide developers ways to change the UI theme of a website and this provides many opportunities for malicious users to change the UI if the application uses dynamic data inside style tags or in HTML style attributes. Additionally keywords like expression can be used to run java script resulting in…


LDAP Injection and Mitigation

RV here… The Lightweight Directory Access Protocol (LDAP) API provides a mechanism for connecting to, searching, and modifying internet directories. A LDAP (Lightweight Directory Access Protocol) injection attack exploits vulnerabilities in input validation to run arbitrary LDAP statements against information directories. It can occur when your application uses input to construct dynamic LDAP statements to…


SSL Redirect – Http Module

Vineet  Batta here again… Some time back one of our applications was released into production and since the application data was HBI  we were required to protect data both in a rest and a transit. For transit we enabled SSL, that is the link to get to the application will require https://[websiteName] instead of http….


Anti-XSS Library 3.0 RTM

RV here… Anti-XSS library 3.0 is now RTM!!! MSDN download center is updated with the new binaries. Here is a overview of the changes in 3.0 release. New features in this version of the Microsoft Anti-Cross Site Scripting Library include: An expanded white list that supports more languages Performance improvements Performance data sheets (in the…


Web Protection Library (WPL) – A Brief Introduction

RV here… I wanted to share with you some tidbits on our new project called Web Protection Library (WPL) which contains libraries to protect web applications from common vulnerabilities and attacks. Our goal is to offer comprehensive web application protection with minimal configuration. With the release of Anti-XSS 3.0 we offered Cross Site Scripting attack…