Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 607For example, to search for the string “password” in the Web directory of yourapplication, use the Findstr tool from a command prompt as follows:findstr /S /M /I /d:c:\projects\yourweb "password" *.*Findstr uses the following command-line parameters:●●●●/S — include subdirectories./M — list only the file names./I — use a case insensitive search./D:dir — search a semicolon-delimited list of directories. If the file path you wantto search includes spaces, surround the path in double quotes.Automating FindstrYou can create a text file with common search strings. Findstr can then read thesearch strings from the text file, as shown below. Run the following command from adirectory that contains .aspx files.findstr /N /G:SearchStrings.txt *.aspx/N prints the corresponding line number when a match is found. /G indicates the filethat contains the search strings. In this example, all ASP.NET pages (*.aspx) aresearched for strings contained within SearchStrings.txt.ILDASMYou can also use the Findstr command in conjunction with the ildasm.exe utility tosearch binary assemblies for hard-coded strings. The following command usesildasm.exe to search for the ldstr intermediate language statement, which identifiesstring constants. Notice how the output shown below reveals a hard-coded databaseconnection and the password of the well known sa account.Ildasm.exe secureapp.dll /text | findstr ldstrIL_000c: ldstr "RegisterUser"IL_0027: ldstr "@userName"IL_0046: ldstr "@passwordHash"IL_0065: ldstr "@salt"IL_008b: ldstr "Exception adding account. "IL_000e: ldstr "LookupUser"IL_0027: ldstr "@userName"IL_007d: ldstr "SHA1"IL_0097: ldstr "Exeception verifying password. "IL_0009: ldstr "SHA1"IL_003e: ldstr "Logon successful: User is authenticated"IL_0050: ldstr "Invalid username or password"IL_0001: ldstr "Server=AppServer;database=users; username='sa'password=password"