Pen Testing Your MVC Application

Question

Here are some well-known security methods for an MVC application:

• Encode Output
• SQL parameterization
• Check your search back and forth
• 1 way hash passwords
• Block accounts or restrict login attempts.
• Use code-based impersonation when accessing the file system
• Access to SQL with a locked username
• Use Honey-pots or captchas to submit forms to combat bots.

If there is any missing or erroneous data, please feel free to.

What other methods / best practices do you use or think about when the pen checks your own software. What do you do to "kick the tires" before accepting applications live.

, ?

Answer 1

, , .

string[] allowedProperties = new[]{ "Title", "Description"};
UpdateModel(myObject, allowedProperties);

[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Create([Bind(Include="Title,Description")] MyObject object )
{

}

, , / , .

Answer 2

, . , md4 , , . sha256 - . ( , , )

, . . , .

OWASP Top 10 - - , . , XSRF , . "", . , , , ? Scarlet PHP.

Answer 3

All your suggestions apply to any web application, not just MVC applications.

Specific MVC suggestions will be similar to "skinny controllers, fat models."