URL Encoding/Decoding Flaw Mechanism in ASP.Net[1.0 - 2.0] Based Web Applications.

View Specific

For Education Purposes Only!

The penetration of web leads to origin of some new artifacts.This in turn helps in understanding the weaknesses and flaws persist in the web applications that lead to origin of exceptions.These exceptions leverage lot of information regarding web application code , debugging parameters , stack traces etc. If these exceptions are not handle in a right way then it results in generation of attack base. The web works in fused way from developer point of view. There are two things that comes to mind

[1] Availability of Services
[2] Services with Secure Parameters.

The stress has been laid more on the availablity by the developers leaving behind the security paradigm. This has really enhanced the attack vector and poor development layout from security point of view. The attackers are always ready to attack where ever they found the weak spot. The point of talk is insecure coding has intensified the attack vector.Even the development languages provide modular inbuilt functions to reduce this effect of insecurity from the web applications but human malfeasance still persists.

The issue of talk is the URL flaw mechanism in ASP.Net based web applications.Even after modular security is applied but still the vector persists.
The most of the web applications are flaw prone due to coding errors.After lot of security concerns , still the developers lacking the art of producing good web applications. According to my analysis some part of developer community understanding the Art of Secure Coding . But on the contrary there are other developers who are not paying attention to this security aspect. Atlast the protections is all yours.

This talk adheres to the URL flaw in ASP.net coding that leads to exception generation.Now I am going to discuss the lack of secure coding leads to error prone web applications from security point of view. The talk is crucial because even after sanitization of secure parameters injections are still occuring.Lets see the handling of URL strings mechanism of ASP.Net. Even ASP.Net provides some system functions to resolve and handle the strings passed but a majority of web applications dont inherit the right layout. Lets see the way implementation of URL's are done.

	The HTTPModule provides specific functions for URL encoding and decoding. It too provides the:
 
	
	[1] HtmlEncode and HtmlDecode functions to handle the HTML requests. 
	[2] UrlEncode and UrlDecode functions to handle the strings passed as a URL to server.

	
	Example:

	
	UrlEncode
	
	%3cscript%3ealert%28%u201cHa%20ha%21%20We%u2019ve%20attacked%20your%20site%21%u201d%29%3c%2fscript%3e
	
	Lets look at the code how these modules are designed. How HtmlEncode is implemented internally.

	
	public static void HtmlEncode(string s, TextWriter output)
	{
	 	char ch1;
	 	char ch2;
	 	int num3;
	  
	 		if (s == null)
	    		return;
	 
			int num1 = s.Length;
	 		int num2 = 0;
	 		while ((num2 < num1)) {
	   		ch1 = s.Chars[num2];
	   		ch2 = ch1;
	   		if (ch2 != '\"') 
	   		{
	     			if (ch2 == '&') goto Label_0064;
	
	    		 switch ((ch2 - '<')) {
	      		 case 0: output.Write("<"); goto Label_00AE;
	      		 case 1: goto Label_0071;
	       		 case 2: output.Write(">"); goto Label_00AE;
	     		}
	    			goto Label_0071;
	  		}
	
	 		output.Write(""");
	 		goto Label_00AE;
	 
			Label_0064:
	 		output.Write("&");
	 		goto Label_00AE;
	 
	 		Label_0071:
	 		if ((ch1 >= ' ') && (ch1 < '\u0100'))
	 		{
	  			num3 = ch1;
	  			output.Write(string.Concat("&#", 
	        		num3.ToString(NumberFormatInfo.InvariantInfo), ";"));
	 		}
	 		else
	   			output.Write(ch1); 
	 
	 			Label_00AE:
	 			num2 += 1;
	 		}
	}
	

	
			Option Strict On
			Option Explicit On
	
			Imports System
			Imports System.Windows.Forms
			Imports System.Drawing
			Imports System.Web
	
			Public Class WinApp
	    		Inherits System.Windows.Forms.Form
	
	    			private m_url as TextBox
	
	    			<STAThread()> _
	    		Shared Sub Main
	        		Application.Run(new WinApp())
	    		End Sub
	
	   		 Public Sub New
	        		Me.Text = "URL Test"
	
	        		m_url = New TextBox()
	        		m_url.Size = new Size(280,30)
	        		m_url.Location = new point (5,5)
	
	        		Controls.Add(m_url)
	        		m_url.Text = "http://www.microsoft.com?value="; & HttpUtility.UrlEncode("String To Encode.")
	    		End Sub
	
			End Class
	
	Just an implementation view.
	

		if (Request.QueryString["id"] != null)
		{
			  // Do something with the querystring
		}
		
		
		
		if (!String.IsNullOrEmpty(Request.QueryString["id"]))
		{
		  	// Do something with the querystring
		}
	
		So we do the check again more thoroughly:
		
		
		if (!String.IsNullOrEmpty(Request.QueryString["id"]) && Request.QueryString["id"].Length == 5)
		{
		  // Do something with the querystring
		}