UZUN.NET

i am taking sans web security training. here are some live tips and tricks :)

• If you have file upload to the server, dont let users pick the filename (directory traversal)
  
• if you have file upload to the server, dont upload the files to a folder where u can execute scripts (iis/wwww)
• escape every input, sanitize everything, users are evil
• there are some tools out on the internet, that lets attackers' life easier.
• buffer overflow attacks can cause DoS so know the language you are using on the server side.
• watch out for unicode attacks. dont just look for <> ...
• once the user logins to your system, change the session id to prevent session hijacking.
• remote file include attack is very common in php environments.n If you have a web site that lets the user to choose the templates. and you pass the template file in the querystring, this could be manipulated. check and sanitize the querystring .NET is stopping these kind of attacks, as a developer you have to try hard to write remote file attack vulnerable code.
• try to have a centralized validation, try to have retrieve and validate in one function
• javascript can be disabled very easily :) dont trust on javascript validation.

Last few weeks we had some problems with some of our old web sites mostly developed using classic asp, and also somebody at the Ceviz.NET forums, asked how to develop a secure web site, what is our practices. Below is my practices for developing a secure web site. In the order of what comes to my mind first:

• I use client side UI validation (asp.net validators) only to respond the user quicker, i dont trust the client side UI validation but i am using it
• Every input: QueryString, Cookies, Form Elements arre validated at the server side
• Each layer has its own validation (UI,BAL,DAL)
• I try to use 1 validation class to handle the validations in the project
• I dont use direct sql commands, i try to use orms such as SubSonic, if i cant cause of the nature of the project, i create my db layer and always use stored procedures
• I never use dbo permission to access the db
• If there is membership involved in the project, i dont rewrite my own membership classes, i use the framework provided one
• i use health monitor to track the app
• i use certificate in the login page
• i encrypt personal info in the database
• i think that somebody can easily see my source code, so i try not to leave a back door in the code.

Any other ideas?