Pen testing your MVC application

Question

Here are some the commonly known practices for securing an MVC application: - Encode your output - Parameterize your SQL - Test your search backwards and forward - 1 way hash passwords - Lock out accounts or limit login attempts - Use code based impersonation when accessing the file system - Access SQL with a locked down username - Use Honey-pots or captchas for form submissions to counter bots If there are any I missed or misstated please feel free to contribute. What other techniques/best practices do you use or think about when pen testing your own software. What do you do to "kick the tires" before taking a applications live. What pen testing services or software do you use if any?

Accepted Answer

All methods that use modelbinding should be secured with whitelists or blacklists on bindable properties.

```
string[] allowedProperties = new[]{ "Title", "Description"};
UpdateModel(myObject, allowedProperties);
```

or

```
[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Create([Bind(Include="Title,Description")] MyObject object )
{

}
```

This is of course to prevent crafted requests from attempting to update/manipulate your objects in ways that weren't intended.

Pen testing your MVC application

Solution

Problem