Just used bintray.com to publish a number of O2Platform/FluentSharp stand-alone exes

I just tried BinTray (see https://bintray.com/o2-platform) as a platform to host exe/binaries/release files, and I have to say that it was a great experience.

Ever since I added to the O2 Platform and FluentSharp the ability/feature to package O2/H2 scripts as stand-alone exes, I've been trying to find a nice place to host them (since there are dozens, if not hundreds, of mini-tools that I want to publish).

For a while I used DropBox, but not only that was not THAT practical, DropBox never gave me any stats. Even worse, DropBox started blocking the downloads (saying 'too much traffic on this account') but was not able to tell me which files were causing the problem!!

The good news is that BinTray.com seem to work perfectly for publishing these O2 Platform created tools.

To see this in action and download one or more of these tools, open https://bintray.com/o2-platform/O2-Tools

Adding KarmaJS support to WebStorm to automagically run tests on file changes (and test UI with SublimeText, Chrome and Cmd.exe)

On the AngularJs and KarmaJS theme (see A small AngularJS Jasmine test executed by KarmaJS and the related posts linked at the bottom), here is my first attempt at using Karma to test AngularJS code inside TeamMentor.

I’m using WebStorm instead of VisualStudio, since for Javascript coding WebStorm is MUCH better/faster/cleverer, specially since it has good support for AngularJs and Jasmine (with KarmaJS support easily added, as we are about to see).

Also shown below is a cool tool I created that hijacks windows from SublimeText, Chrome and Cmd.exe windows into the same UI (an O2 Platform .NET Script)

Here is the directory structure:

If AngularJS doesn’t work on your O2 Platform IE scripts (the fix is to change browser compatibility mode)

If when trying to open an AngularJS page inside an O2 Platform script, you see:



... this means that the IE browser embedded in that .NET process is set to run under IE 7

View ESAPI 11 Encodings methods in real-time via an ASP.NET Web Page

In the Another step in the use of ESAPI and AppSensor Jars from .Net/C# (using Jni4Net) I posted the screenshots below, which are such a big step forward that I'm creating this separate blog post to expand the idea a little bit :)

One of the things that I always wanted to do with ESAPI , was to have programmatic access to the multiple ESAPI encodings methods, since I believe they are a great example of the type of encodings capabilities that are needed in order to safely consume data provided by (potentially malicious) users.

ESAPI provides a number of sepecific methods to encode a string (each focused on a particular use case)

1. encodeForHTML
2. encodeForHTMLAttribute
3. encodeForCSS
4. encodeForJavascript
5. encodeForVBScript
6. encodeForLDAP
7. encodeForDN
8. encodeForXPath
9. encodeForXML
10. encodeForXmlAttribute
11. encodeForURL

And given a particular string, what does each of of these look like?

Responding to Andrew's O2 Platform feedback on the OWASP Leaders list

Here is my answers to OWASP's Andrew van der Stock on this feedback on the O2 Platform. My answers contains good info on my approach to O2 Platform's community and development.

Andrew's words are in italic below

----------------- (start) -----------------

(changing the title to reflect the new thread on the O2 Platform)

Hey Andrew, thanks a lot for your feedback, and please see my comments below

On 16 May 2013 13:41, vanderaj vanderaj <vanderaj@owasp.org> wrote:

Dinis,

I know what you mean about the lack of O2 feedback. So I'm going to
give you a tiny bit, and hopefully it will help rather than hinder the
discussion.

O2 Platform Fork of ManagedSpy

A while back I was trying O2Platform’s process hooking techniques and created a fork of the ManagedSpy tool which you can find at https://github.com/o2platform/O2_Fork_ManagedSpy

Here are a number of PDFs that show the changes I made to the original code and how I used the FluentSharp APIs to simplify its code:

• ManagedSpy - Adding new features to ManagedSpy.exe (part 1).pdf
• ManagedSpy - Adding new features to ManagedSpy.exe (part 2).pdf
• ManagedSpy - Adding new features to ManagedSpy.exe (part 3).pdf
• ManagedSpy - How ManagedSpyLib hooking works.pdf
• ManagedSpy - Moving Original code (and some changes) to GitHub.pdf
• ManagedSpy - Using and coding the ManagedSpyLib APIs.pdf
• ManagedSpy - Using O2 VS Extension to create ManagedSpy UserControls or Forms inside VisualStudio.pdf

Making Java, .Net and C++ apps work together

This past week I was in the 'zone' (coding 16h a day) and as you can see by the links below, I was able to (finally) find a way to make Java, .Net and C++ apps work together. 

I've 'only' been trying to do this for the past 5 years.

There are two key technological concepts at play here (which can work together or isolation)

Html 5 Sandbox site

Here is a cool site that can be used to try Html 5 (and its security features): http://htmlsandbox.com

Here is the default UI:

Trying UserEcho on O2 Platform

Just found UserEcho.com and I really liked their interface to ask questions (driven by a search first).

So to see how it works in action, I just created an Free account for the O2 Platform: http://o2plaform.userecho.com/

Here is what it looks like:

It looks like you can add ideas, questions, bugs and praises.

So if you have one of these related to the O2 Platform, please post them at http://o2plaform.userecho.com/

Exploiting Microsoft MVC vulnerabilities using OWASP O2 Platform

Michael Hidalgo wrote this great article on using O2 to exploit an overposting (i.e. auto-binding) vuln in an ASP.NET MVC demo app: Exploiting Microsoft MVC vulnerabilities using OWASP O2 Platform

As you can notice that was posted on CodeProject.com which has always been a good source of technical content for me (although not a site I would use everyday). That said, I'm starting to like the new version of http://codeproject.com and this could be a great place to post O2-related technical articles.

On the Asp.NET MVC topic, if you are interested, here are a couple related posts:

• Why ASP.NET MVC is 'insecure by design' , just like Spring MVC (and why SAST can help) 
• Current O2 support for analyzing Spring MVC 
• "Two Security Vulnerabilities in the Spring Framework’s MVC" pdf (from 2008)

The next step is to see how we can write SAST rules (maybe executed by Cat.NET) to find these issues on the source code.

I really don't have hard numbers, but I will bet that the number of Asp.NET apps vulnerable is really high (just like what happens with the Spring Framework MVC)

Real-time Vulnerability Creation Feedback inside VisualStudio (with Greens and Reds)

Here is a pretty cool PoC of a Real-time Vulnerability Creation Feedback inside VisualStudio where I show how a number of security vulnerabilities (XSS, SQL Injection, Path Transversal, Unvalidated Redirects) are detected as soon as they are created.

I'm trying to find out the best visual way to present this info to the user, and Greens/Red are usually a good indication of good/bad stuff (also note how the squiggly lines show the traces (i.e. the places where there is a vulnerability)

If you want to comment on this PoC or idea, please use this reddit thread 

Related posts:

• Real-Time C# Solution Compilation and Security Scanning (using Roslyn and Cat.NET) 
• Running Cat.NET SAST Scanner outside VisualStudio 
• 1 line to compile, create and execute: O2 Script to use Roslyn to Dynamically compile and execute a method 
• New Reddit Community for Cat.Net 
• Using/Consuming Cat.Net's engine inside the O2 Platform (and outside VisualStudio) 
• Using Roslyn to Load and (quickly) Compile C# Solution files (outside VisualStudio) 
• Video: Real time Vulnerability Scanning using Cat.Net and Roslyn (SAST) 

Running Cat.NET SAST Scanner outside VisualStudio

One of the big limitations of Cat.NET was its need to be executed inside VisualStudio.

Yes VisualStudio is one of the places where we want to use Cat.NET's engine and GUIs, but it is also very important to be able to run it as a stand-alone tool (and to inject it into other .NET applications).

Here is a video that shows a GUI/script I created with the O2 Platfrom, which shows the execution of Cat.NET GUIs + Scanning engine outside VisualStudio, and a couple extra features added.

Removing an Event from a WinForm ListView control using reflection

The objective was to remove an event from a WinForm control that we don't have the source code for (and can't recompile and remove the event on directly on the source code).

This problem happened originally when dynamicaly consuming Cat.NET's guis (outside VisualStudio) and there were a couple controls (like a ListView) that hooked event handlers that triggered functions that had DTE dependencies (which triggered an exception since we were running Cat.NET outside visualstudio (and the DTE2 object was null).

There doesn't seem to be an easy way to do this (and google didn't find a good solution) so using O2's powerful reflection APIs I was able to find a solution which is now available as these extensionmethods:



Here is a document that shows how these extension methods were created:

Using/Consuming Cat.Net's engine inside the O2 Platform (and outside VisualStudio)

A key component of the Real time Vulnerability Scanning using Cat.Net and Roslyn (SAST) PoC is the 'Real Time' part :)

The only way to achieve that type scanning speeds was to find a way to directly consume (i.e. access) Cat.Net scanning engine directly (i.e. in-process), instead of the command line (this will also be critical when we try to scan large projects, which will need to sliced, partially scanned and have its results glued/merged).

The document below shows how I did that and the evolution of the scripts.

Note that by these techniques, we have access to the entire Cat.Net scanning engine and can easily control its rules and execution workflow :)

In addition to the sheer fast-prototyping/development speed that we get with O2's REPL Scripting environment, one the key advantages of doing this type of development on top of the O2 Platform is the number of Static-Analysis-focused tools/APIs that already exists. For example note how I was able to easy consume/transform the Cat.Net findings into O2Findings (which can then be consumed/manipulated by the multiple O2Finding's viewers and tools)

asd