Improving Web Application Security: Threats and - CGISecurity

606 Part V: Assessing Your SecurityFxCopA good way to start the review process is to run your compiled assemblies throughthe FxCop analysis tool. The tool analyzes binary assemblies (not source code) toensure that they conform to the .NET Framework Design Guidelines, available onMSDN. It also checks that your assemblies have strong names, which providetamperproofing and other security benefits. The tool comes with a predefined setof rules, although you can customize and extend them.For more information, see the following resources:●●●●To download the FxCop tool, see http://www.gotdotnet.com/team/libraries/default.aspx.To get help and support for the tool, see http://www.gotdotnet.com/community/messageboard/MessageBoard.aspx?ID=234.For the list of security rules that FxCop checks for, see http://www.gotdotnet.com/team/libraries/FxCopRules/SecurityRules.aspx.For the .NET Framework Design Guidelines, see http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpgenref/html/cpconnetframeworkdesignguidelines.asp.Performing Text SearchesTo assist the review process, check that you are familiar with a text search tool thatyou can use to locate strings in files. This type of tool allows you to quickly locatevulnerable code. Many of the review questions presented later in the chapter indicatethe best strings to search for when looking for specific vulnerabilities.You may already have a favorite search tool. If not, you can use the Find in Filesfacility in Visual Studio .NET or the Findstr command line tool, which is includedwith the Microsoft Windows operating system.Note If you use the Windows XP Search tool from Windows Explorer, and use the A word or phrasein the file option, check that you have the latest Windows XP service pack, or the search may fail.For more information, see Microsoft Knowledge Base article 309173, “Using the ‘A Word or Phrasein the File’ Search Criterion May Not Work.”Search for Hard-Coded StringsBefore you perform a detailed line-by-line analysis of your source code, start with aquick search through your entire code base to identify hard-coded passwords,account names, and database connection strings. Scan through your code and searchfor common string patterns such as the following: “key,” “secret,” “password,”“pwd,” and “connectionstring.”