Beginning ASP.NET Security

Chapter 1. Why Web Security Matters

Imagine working for the company providing Microsoft UK's events registration system. It's the beginning of summer in June 2007, and the news is filled with floods in the north of England where people have had to evacuate their homes while the rest of the country swelters in the well-above-average heat and sunshine. You fire up your Web browser just to check how your site is doing, only to discover the page shown in Figure 1-1. You've been hacked!

Figure 1-1. The defaced Microsoft UK Events Page, June 2006 (retrieved from www.zone-h.org)

DISCLAIMER: DO IT TO YOURSELF, BUT NOT TO OTHERS

This book sets out to teach you about common Web vulnerabilities. It does so by illustrating the problem and showing you how bad code can be used to attack an unprotected Web site. I firmly believe this is the best way to illustrate the problem and drive home the fact that Web security is something every Web developer should keep in mind as he or she develops a new site. It may be tempting to try out some of the techniques shown on a friend's Web site, or your company's Web site, or even a Web site that you visit on a regular basis. I have a single word of advice about this — don't!

Hacking is illegal in the majority of countries, regardless of the intent behind it, and using any of the exploits described in this book may land you in serious trouble. Neither the author ...