.NETIDS – .NET Intrusion Detection System

Use Netsparker


This tool is another one on the side of protection, again for web-based applications but this time for .NET applications it’s called .NETIDS (.NET Intrusion detection System). This tool is capable of detecting on attacks on web applications and gives the developer the possibility to react. The project files include filter rules and function stubs to react on possible intrusions which may vary from logging to warning or redirecting the user.

The goal of this project is to provide am additional layer of protection to any .NET application this project is used with. This also includes the detection of XSS, directory traversal, SQL injections, protection against overwriting JS objects and methods, advanced logging functions, categorization and tagging of the single filter rules and interfaces for reacting on possible intrusions.

.NET IDS is a actually a port of PHPIDS, which we’ve mentioned before, to the .NET Framework. The library is fully CLS compliant and implements exactly the same filtering sets as the PHP version.

.NETIDS can be used in three ways.

The first method is by inheriting your ASP.NET pages from the SecurePage class. This offers an easy and customizable way to scan page input. If you are relatively new to the .NET Framework this is the simplest way to secure your applications.

The second method is more customizable but harder to implement for novice programmers and involves working directly with the IDS objects.

The third method (available in the upcoming release) is by using the supplied HttpModule.

You can find the documentation here:

http://www.the-mice.co.uk/dotnetids/docs/

You can download .NET IDS v.0.1.3.0 here:

dotnetids-bin-0_1_3_0.zip

Or you can read more here.

Posted in: Countermeasures, Secure Coding, Security Software

, , , , , , , , , , , ,


Latest Posts:


Four Year Old libSSH Bug Leaves Servers Wide Open Four Year Old libssh Bug Leaves Servers Wide Open
A fairly serious 4-year old libssh bug has left servers vulnerable to remote compromise, fortunately, the attack surface isn't that big as neither OpenSSH or the GitHub implementation are affected.
CHIPSEC - Platform Security Assessment Framework CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
CHIPSEC is a platform security assessment framework for PCs including hardware, system firmware (BIOS/UEFI), and platform components for firmware hacking.
How To Recover When Your Website Got Hacked How To Recover When Your Website Got Hacked
The array of easily available Hacking Tools out there now is astounding, combined with self-propagating malware, people often come to me when their website got hacked and they don't know what to do, or even where to start.
HTTrack - Website Downloader Copier & Site Ripper Download HTTrack – Website Downloader Copier & Site Ripper Download
HTTrack is a free and easy-to-use offline browser utility which acts as a website downloader and a site ripper for copying websites and downloading them for offline viewing.
sshLooter - Script To Steal SSH Passwords sshLooter – Script To Steal SSH Passwords
sshLooter is a Python script using a PAM module to steal SSH passwords by logging the password and notifying the admin of the script via Telegram when a user logs in.
Intercepter-NG - Android App For Hacking Intercepter-NG – Android App For Hacking
Intercepter-NG is a multi functional network toolkit including an Android app for hacking, the main purpose is to recover interesting data from the network stream and perform different kinds of MiTM attacks.


5 Responses to .NETIDS – .NET Intrusion Detection System

  1. Rajat Bhargava March 21, 2008 at 1:00 am #

    Interesting technique.

    If you’re interested in IPS and IDS I recommend you look at our free Strataguard Lite product and our free secure networking security platform Cobia.

  2. Pantagruel March 21, 2008 at 7:32 pm #

    A nice .NET implementation of the PHPIDS package. I guess the big advantage will most likely be not having to install PHP on an IIS server.

    @Rajat Bhargava
    Product info sounds OK, perhaps you can persuade Darknet into having a better look at the mentioned products.

  3. zupakomputer March 24, 2008 at 5:15 pm #

    Does anyone know what happened to NQL? This seemed like a relevant and recent enough article to ask. There’s some kind of version 3.0 of it, but it seems to be extremely low-profile (hardly any books or sites on it, 7 years later) when it looked to be what its name suggested – the network equivalent of SQL.

  4. lyz August 13, 2008 at 2:21 pm #

    What about the Untangle software? I’m still on the testing period. But I can say that the interface is nice. Very useful esp. to those whose really not familiar with scripting and *nix commands. Untangle can be a router, vpn, IDS, IPS, virus blocker etc.

    See for yourself. After all, it’s opensource.

  5. Morgan Storey August 31, 2008 at 11:47 pm #

    Oh Darknet is there nothing you don’t have for me.
    I was googling PHPIDS for ASP and this came up, damn lucky really.
    I will be testing this on an IIS dev server today.

    @lyz: Untangle looks damn good, I am a fan of Pfsense, M0n0wall but really if you are trying to secure a windows box you have few open source choices. There is also the custom firmwares for WRT based routers that are really flexable and low powered, if I had the time and money, I would go two layer at home, openwrt and pfsense.