last day (29 days later) » 
07:00 - 11:0011:00 - 13:00

7:45 AM
hi
 
hi
 
yes
it is connected now
 
yep finally
 
can u connect with Teamviewer
so that i can show u what i want
 
I cannot use teamviewer neither
I have a restricted conection here
 
7:46 AM
OK
 
Bu you can tell me and I can test it here
 
ok
See
I have a site
which has Search Textbox
 
ok
 
it needs to stop cross site scripting
the Tester has a tool
 
alright
 
7:47 AM
named as Burrp tool for testing
what I want is
it has some criteria for testing
whenever they write any malcious script from the tool
and inject it
the search textbox should through an error
 
malcious script means <script> here?
 
<~script>
like this
 
in that box users will be searching what?
 
The use of tilt sign ‘~’ is to write scripts, in place of that sign adversary may use image tags or characters to write scripts.
searching anything
if they are using these scripts
it should not go ahead
 
I got that let me put it this way
will the data to be searched for be excessive?
 
7:53 AM
?
 
for example will the data to be searched is about 500-1000 rows or much more thatn that?
 
the data which has to be searched are not coming from the database
 
what is the source then?
 
DataTable
let me show u the code
 
the same question stands:
how many data does that datatable has?
 
7:57 AM
private void SearchResult()
{
DataTable dt;
if (Session["Search"] == null)
{
ResXResourceReader reader = new ResXResourceReader(Server.MapPath("~/App_GlobalResources/Strings.en-US.resx"));
IDictionaryEnumerator id = reader.GetEnumerator();
string sResourceFile = Server.MapPath("~/App_GlobalResources/Strings.en-US.resx");
XmlDocument xmlResource = new XmlDocument();
xmlResource.Load(sResourceFile);

XmlNodeList elmData = xmlResource.SelectNodes("//root/data");

dt = new DataTable();
dt.Columns.Add(new DataColumn("ID", System.Type.GetType("System.String")));
this is the code
I cant count that how many data it has
it will search on the text entered
 
will you be searching for your sitemap?
 
while I am trying to understand your code please take a look at here:
 
it is AutoComplete textbox right ?
 
yep
 
8:01 AM
is it related to my issue ?
 
If you don't have thousands of data in your datatable
then you can use a faster way to search
ın a way yes I am suggesting a clientside option to search
 
client side
will always allow to inject the XSS script
 
:)
you can say that
let me explain
 
typeahead can retrieve data from my webservice as JSON
 
8:03 AM
ok
 
and stores all the data in ocalstorage
localstorage
and searches for the entered data as it is being typed..
no data send to the server
 
ok
do you have any example of that
 
when you write <script> as search criteria
 
so that I can check with that tool
ok
 
it look in your eyes that it cannot have a result
test it in its own site
 
8:06 AM
i am testing these above
 
yep
 
ok
but where is button
to press enter the result
 
that is the magic I suppose
if there is a result you click on that result to visit that
 
yes
when I am entering A,
it is getting me result related to A,like Albama, Alaska
but
when I am selecting it via Tool and forwarding the request
i am unable to see any response in the tool
 
alright test it in another site
 
8:13 AM
i think i am not testing it properly
www.rblbank.com
see this site
it has a search box on the Top left
 
wait a sec.
 
have you tried the nuget package that I have sent you?
 
when u sent
?
 
take a look at the mails I have sent
 
8:24 AM
ok
let me install and check
 
OK
 
got this message
Installing 'AntiXSS 4.3.0'.
You are downloading AntiXSS from Microsoft, the license agreement to which is available at http://wpl.codeplex.com/license. Check the package for additional dependencies, which may come with their own license agreement(s). Your use of the package and dependencies constitutes your acceptance of their license agreements. If you do not accept the license agreement(s), then delete the relevant components from your device.
Successfully installed 'AntiXSS 4.3.0'.
Adding 'AntiXSS 4.3.0' to RBLBank.
should I check now
 
You must have installed it locally right?
you must upload the new files to the server
of course you should build it
 
installed means ?
i just wrote the command
and i can see one dll file
AntiXssLibrary
AntiXssLibrary.dll
in my bin folder
that is what I have to do right ?
or anything else
 
wait a sec a busy day :)
 
8:28 AM
ok
going for lunch
will be back in 15 mins
 
what is "Hayde Bre Efeler" ?
 
8:44 AM
OK
Hayde Bre Efeler is a set of words that Turkish Folk Dancers Shout while They Dance.
 
ohhh ok.
and whats the meaning??
 
hayde bre nearly means: let's go, Let's do it
Efeler
means the people used to exist especially in the eagean region of Turkey
who has his companions obey him
The Efe were the leaders of Turkish irregular soldiers and guerillas from the Aegean Region of Anatolia, called the Zeibeks and Kızan. There are many theories about the origins of the word Efe. The organization of the Efe and Zeibeks were first seen in the 16th century during the Jelali revolts which dismantled power throughout the Ottoman Empire. After that time, men who rebelled against local pressures and injustices and settled in the mountains were called Efe or Zeybek. The Efe were distinctive in their attire, weapons and general appearance, which were created for survival and to best suit...
 
ohh :)
@wooer are u guys from turkey?
 
9:01 AM
Nope its just me
ut I needed an immediate room name that was the first thing came to my mind since I am a Folk Dancer too
 
hahaha..ok :)
 
:)
Where are you from?
 
i am from pakistan
 
:)
 
u know i love turkey...its really beautiful place! :)
recently watched in many dramas..:P
 
9:04 AM
Glad to hear that..
 
:)
 
to name the dramas?
 
"Mera Sultan" , "iffat" "ishq mamnu" :P
we have a channel "urdu 1" who play turkey dramasd with urdu dubing
 
Yep they were closely followed by a lot of Turkish citizens too
 
Ishq mamnu was a bigggg hit here
 
9:07 AM
really
 
yep.
 
But about Mera Sultan not everything is tru about the sultan
as we call him Padişah
 
yes my mom told me its all wrong they are showing
 
The media is not trusted that much at most of the places of the world.
 
hi wooer
 
9:10 AM
yeah
 
Hi Nadeem
welcome back
 
what is all this
who is Hemz
?
 
Hemz it was very nice to talk to you
Hemz is a friend from Pakistan
 
ohh
 
who wondered what the room name meant
 
9:11 AM
ok
hehehe
 
And we had some chat about Turkey
 
Yes i also love Turkey
 
@wooer nice talking to u tooooo...:)
 
its very beautiful place
 
And I found Amir Khan invalueable
 
9:13 AM
@NadeemKhan My name is Hareem..em from pak. and u?
 
@Hemz: I am from India.. :)
 
ok :)
 
@wooer: can we start our topic
 
Yep I suppose :)
Take Care Hemz See you around.
Nadeem Have you made your tests on the package?
 
take care Hemz
See
I added the Install-Package AntiXSS
in my package manager console
i think that is all what i have to do
 
9:15 AM
we'll see
 
after that I build the project and tested it
OK
 
yep
what was the result?
 
it still was bypassing
and the script i was able to see in the URL
 
bypassing ?
 
i mean injecting
 
what is this
how can i use it
 
it is an ancient article about the library you just installed
 
ok
i cant see AntiXss.dll when I add reference
 
I suppose it should already be referenced
 
9:21 AM
But in that article
<script> tag is also shown in the breakpoint
 
what
 
you see?
 
yes
 
for example
consider this page
I write <script> bu it is not interpreted right as script but as string right?
 
wooer
just a sec
 
9:23 AM
ok
 
i need to restart PC
something is going wrong
i will ping u
 
alright
 
9:37 AM
hi
u there
?
 
yep
 
yes
so how to include that
u dont have access to teamviewer ?
 
nope
but it says you should include encoderType="System.Web.Security.AntiXss.AntiXssEncoder, System.Web,
Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
 
in the httpRuntime if you have .net framework 4.5
 
9:41 AM
let me add and check
i have
targetFramework="4.0">
so it wont work ?
 
I don't know
I suppose You need that nuget package
in 4.5 you don't need that package
 
so the package what u gave me eariler right ?
 
yep
 
ok
that I have added
the reference
now shd I add the code in web.config file and check
 
does it have a reference in web config?
 
9:45 AM
wer will be the reference ? i mean under which section
 
use ctrl+f
 
ok
i get
<security>
<requestFiltering>
<fileExtensions allowUnlisted="true">
<add fileExtension=".htm" allowed="true"/>
<add fileExtension=".aspx" allowed="true"/>
<add fileExtension=".jpg" allowed="true"/>
</fileExtensions>
</requestFiltering>
</security>
nothing else
i searched for security
 
search for xss
 
nothing is there related to xss
 
check the references ?
 
9:50 AM
ok
in bin folder ?
i have
AntiXssLibrary dll file
AntiXssLibrary xml doc
AntiXssLibrary.dll one refresh file
u there ?
 
yep
in the solution explorer click on your project name
 
then click the "Show All Files button above"
then you'll see references node un der you project
 
i right clicked the project name
 
nope click left click once
 
9:57 AM
i did
nothing i can see
 
have you ever used "Show All Files" button?
 
no
i can see
one option
when I right click
Open Files in File Explorer
 
when you left click on your project name on solutions explorer
there will be a button above on the left of the Wrench sign
 
i am using web
that is why i cant see
visual studio web
anyhow i can see the reference now
 
ok
 
10:02 AM
now
 
here he is mentioning about a .net 4.0 version of the library
 
ok
i need to add this
<httpRuntime encoderType="Microsoft.Security.Application.AntiXssEncoder, AntiXssLibrary"/>
?
 
yep try that
 
ok
and reference are added
right ?
 
yep
 
10:08 AM
added like this
<httpRuntime requestValidationMode="2.0" encoderType="Microsoft.Security.Application.AntiXssEncoder, AntiXssLibrary" />
 
But the glitch in my mind is that he says .net 4.0 version of the library
try to build that
 
where
?
glitch
i am wrong anywhere
 
nope you're not wrong anywhere
 
ok
so i am checking again
 
if it doesnt build you'll need to find the .net 4.0 version of the library
whereever it si
is
 
10:11 AM
ok
let me check first
 
ok
while you're checking let me have lunch
see you soon
 
sure
 
but remember what I said about how <script> look like in this page :)
 
what is in lunch
meand ?
means*
 
I'll have soup
 
10:14 AM
wow
nice
u cum
by the time I check it and let u know
 
remember to check what <script> look like at the last picture of the haacked.com/archive/2010/04/06/…
OK see you
 
10:25 AM
i guess my reference part is not done properly
that is why it is not working
 
07:00 - 11:0011:00 - 13:00

  last day (29 days later) »