Are there any SQL injection tools out there so I can test my site's vulnerabality? - sql-injection

Are there any SQL injection tools out there so I can test my site for vulnerabilities? Any good ones? Free ones would be good.

If it is non-commercial (free only for non-commercial use), http://www.nessus.org/nessus/ offers some really good web-app SQL injection tests. It also tests for XSS, and hundreds of known vulnerabilities as well. It helped me find a hole or two.

Related

Liferay CMS capabilities

I have requirements to establish a CMS system for enterprise and it has to be java based open source, I found out that liferay has CMS capabilities but I'm not able to find any detailed description of the features introduced on its CMS , also I found some people are talking about integrating Liferay with Alfresco ! does this mean that Liferay is not a complete CMS ? appreciate if anyone can guide me through this and provide me with any resources detailing liferay CMS features
Yes, Liferay has CMS features - coming from a portal background the CMS is only one of the many features delivered out of the box. A portal typically is an integration platform for any kind of application. If you ever only need CMS, it might be that "pure" CMS products offer a bit more of functionality, however, many people are very happy with the CMS functionality Liferay provides. And if you're not, it's typically easy to extend (this is the point of a portal).
Systems that start being a CMS and want to extend that with applications (who doesn't want that) typically have a different mindset - "everything is content" - and naturally your application feels a bit more like "content". The portlet standard, together with the additional APIs that you have available, is a nice way to start.
For CMSs the way to go is typically a proprietary API to extend it. In a portal, a CMS is one of the possible applications available.
Regarding Alfresco: Yes, you can combine it with Liferay. While Alfresco tends to come more from the Content-side, Liferay comes from the portal/integration side. I'd ask you to evaluate both first and see if you are missing vital features in any. Then evaluate which pain you'd like better: 1) Add the missing features you want in the system you decide for, or 2) integrate both systems and run them both. Of course, the optimum result is if only one of the two is sufficient for your requirements. Then project into the future and try to find out what you'll miss first.
There is no correct answer to this question, it all depends on your requirements, experience and ability to learn and administrate one or both of the systems.
Disclaimer: See my profile to detect my implicit bias - I hope to not stress it too much in this answer.

What is a good choice of database for a small .NET application? [closed]

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.
Closed 10 years ago.
I'm developing a small application with C# in .NET and I want to have a small light weight database which does not use much resources.
Could you please list some of the best known light weight database softwares.
14/06/2016 Yep... still getting upvotes :-/
17/03/2014 I'm still receiving upvotes for this, be mindful of the date this was originally answered. Though the main three items listed are still entirely viable, the list will tend towards becoming stale. There are further database technologies available that are not listed.
You have a couple of immediately recognisable and free options:
SQL Server Express LocalDB
SQL Server Compact Edition
SQLite
The SQL Server Compact download comes with the ADO.NET provider that you will need to reference in code. The SQLite download might not have it so here is a link:
http://sqlite.phxsoftware.com/
All three use SQL, though likely with a few limitations / quirks. Management Studio works with Compact and LocalDB, whereas with SQLite you will need another UI tool such as SQLite Administrator:
http://sqliteadmin.orbmu2k.de/
There are NoSQL alternatives, such as:
Sterling
RavenDb
Personally I would avoid using MS Access in the face of other free options. You cannot go wrong with LocalDB, Compact, or SQLite. They are all lovely small databases that run relatively quickly in little RAM - personal preference as to the religious aspects about liking a Microsoft product I suppose :-)
I use Sterling for Windows Phone programming as it is built to use Isolated Storage. I have only seen articles on RavenDb, but I can tell you that it is a JSON based document storage framework.
Not to confuse the situation (go with SQLite, SQL Server Express LocalDB, or SQL Server Compact Edition), but there are other embedded / local databases out there, some are relational others are object-oriented:
Embedded Firebird
db4o
VistaDb
SharpHSQL
Berkeley DB
Eloquera
SiaqoDb
Not all of these are free. SQL / LINQ / in-proc support differs across them all. This list is just for curiosity.
There is now also Karvonite, however the code gallery link is broken. When it's live again I'll be looking into this one for WP7 development.
I'd recommend SQLite. We are using it for almost all of the apps we develop where I work.
It's small and compact. It does require a DLL to be in the app directory, but you don't have to have other software installed like Access or SQL Server. Also, as stated by danielkza below, "SQLite is public domain, so you don't have to worry at all about licensing." That can really make a big difference.
You can use System.Data.SQLite or csharp-sqlite to access it in a C# app using the same methods as that of SQL or OleDB.
You will also need an application to edit/manage the database. The best one in my opinion is SQLite Studio. Here are a couple more:
SQLite Admin
SQLite 2009 Pro (bottom of the page)
Update - 7/25/11 - More SQLite apps (question here on SO)
Here's more on SQLite:
SQLite on Wikipedia
Companies that use SQLite
Custom Functions:
As an addition, if you are looking in the SQLite Core Functions and don't see one you like, you can create your own custom functions. Here are a couple of examples:
From SOAnoter example
Firebird embedded can be a good choice
The embedded version is an amazing variation of the server. It is a
fully featured Firebird server packed in just a few files. It is very
easy to deploy, since there is no need to install the server.
There is some very good dot net drivers
SQL Server Compact if you want to use the official microsoft solution. This has the advantage of being able to use replication with SQL server if you need that sort of thing.
SQLite if you want to somthing very simple small and free. This is what android uses for it's internal databases so it is very well supported and there are very good .NET bindings available.
One distinct advantage of SQLite is that it is cross-platform. So if you wanted to port your application to Mono.NET then you wouldn't have any modifications to make to the database implementation.
I do not like MS Access for this solution but a lot of people have included it in their answer. It is limited due to the proprietary format and platform dependence. It does have it's advantages though. You can manipulate data easily if you have a copy of MS Access, you can build queries graphically and create macros. You can easily integrate it with the rest of MS Office.
Out of all these SQLite would be my recommendation due to it being so compact, well documented and supported by a growing army of fellow developers regardless of platform.
EDIT
I realized that there is another option that everybody here forgot to mention
So long as you don't need relational tables you could use CSV file read as a dataset via ADO.NET. (More of a lulz suggestion than anything else but would be suitable in some cases and doesn't require additional libraries for a MS deployment.
If you are building a project with .NET 4.0.2 or greater and want embedded database support, consider SQL Server Express LocalDB.
It's a relatively new addition to the Express family that features a smaller installation footprint and reduced management overhead (when compared to other editions of Express), yet it maintains the programmability aspects of SQL Server. That is, unlike Compact Edition, LocalDB does not require the installation of a separate ADO.NET provider to communicate with SQL.
See the following for more details:
SQL Express v LocalDB v SQL Compact Edition (MSDN Blogs)
SQL LocalDB vs SQL Server CE (Stack Overflow)
what about http://en.wikipedia.org/wiki/NoSQL_(RDBMS) ?
in particular MongoDB for .Net
http://www.mongodb.org/display/DOCS/Home
You could use Sql Server Express Edition as its free and is equally powerful until and unless you want functionality like mirroring etc. Have a look at this.
I've used db4o with success.
File based, large community, simple to use.
http://www.db4o.com/
Licensing Details
Free General Public License db4o is licensed under the GPL by default.
The GPL license is ideal if you plan to use db4o in house or you plan
to develop and distribute your own derivative work as free software
under the GPL as well.
Commercial License A commercial license is required if you want to
embed db4o in a commercial non-GPL product. Commercial licensees gain
access to premium services and support.
An alternative that hasn't been mentioned if you don't require it to be a free database is VistaDB. It's all managed code, provides tons of features for an embedded database, and offers pretty good performance. A pretty good bridge between SQL CE and SQL Server Express since the majority of your VistaDB stored procedures will run without modification in SQL Server Express. I've been pretty pleased with customer service at this point as well. I've been using it at work. No services to start. An empty DB is around 1MB and the DLL is pretty lightweight too. Has ADO.NET providers and such things. I liked it a good bit.
VistaDB
SQL server Compact Edition best as it is free and Light in Size and integrates Well
SQL Server Express or MS Access

Choosing a CMS: EPiServer vs Orchard vs SiteCore vs Umbraco

Increasingly, I have noticed the number of Content Management Systems in use. I have some familiarity with SiteCore. I have read some literature on Umbraco. I only just got wind of Orchard the other day. I have only heard positive feedback about EPiServer. I am soon to move into a role that uses it.
Do these differ vastly in features and price? What has led you to choose one (or several) over the others?
EDIT
I did a brief review of so-called free CMSs here: On Free Microsoft Compatible Content Management Systems
Reasons I ditched Orchard when developing a 50k page website:
The Orchard CMS import tool is simply too slow. It would only accept
small batches at a time. Initially, it took eight minutes to import
1000 records. So, working on that principle I expected that it could
take seven hours to import all the records. Unfortunately, I started
to receive performance issues as more records were inserted into the
database. I even started to reduce the batch size, which helped only
temporarily in the early stages. (See Saying no to Orchard)
I can only comment mainly on Sitecore and a bit on Umbraco from my knowledge of others using it:
Sitecore is an enterprise level web CMS with an "enterprise price tag." It's very extensible, has a lot of developer/community support, and is very developer friendly. The structure of content is based on a tree of nodes with parent-children relationships. Sitecore is well known in the WCM community as a leader in content management and is rated very well by companies sch as Forrester Research, etc.
Based on my previous research and conversations with friends, Umbraco is very similar to Sitecore. It has a lower price compared to Sitecore but its not a complete rip off. Umbraco is also built on ASP.NET like Sitecore.
Here's a three-part series on Sitecore vs. Umbraco from a developer.
Of the ones you mention above, I have only used Umbraco and Sitecore to build with and am certified in both. I like the way they allow me to build systems that really work well for my customers. They both have a feel that they simply give you building blocks to create your masterpiece instead of "modules" of functionality plugged in that give you a blog, forum, etc. They make it really easy to share content throughout the site and create really nice admin experiences.
Umbraco's community is really great. They both struggle a little on the documentation side IMO, but Umbraco's videos really help and the community is quick to help. Also, if you're talking cost then its free (Umbraco) vs. quite expensive (Sitecore).
But the reality is that each developer has their own taste and the style of CMS they like to work with. Ultimately, its the team that has to build the site that really matters most when it comes to how each CMS performs for the end user.
In addition to the links above, here are a couple blog posts that may help you get a feel for the different systems:
Orchard & Umbraco - Introduction (part 1 of 4) - Aaron Powell
Sitecore vs. Umbraco Terminology
Good luck!
I mostly work with EPiServer and Sitecore, and I can tell you the difference in short:
Sitecore has broader architecture and more powerfull UI. CMS is deeply configurable and highly extensible, it has clever publishing and caching system, powerful search and page editor. But it doesn't provide much out of box and UI is pretty old, slow and hard to learn. So this will be a long journey until you understand it good and make a good support of all its features for editors.
EPiServer is easy, friendly to users and developers. It provides an essential bunch of features out of box, has easy UI and page editor, good drag-and-drop experience, easy personalization. It is code-first, distributed with NuGet, provides dependency injection for its services, out of box MVC support. But it's not so extensible and configurable, has pure search (without expensive EPiFind module) and generally lower-featured comparing to Sitecore. So it's good for small/middle websites, but can be an obstacle in complex solutions.
Both have similar tree-item concept, rich documentation, pure public module system and hard UI customization. Both expensive and not open source.
As I know, Umbraco is pretty similar to EPiServer and Sitecore, but free and open source. Of course you get less features, more bugs, not much docs and no free support.
Orchard is really different comparing to other three CMS. It is module-based like Wordpress: you use standard or public modules and themes, instead of writing the whole website from scratch. You create your own themes and modules to customize the website and CMS. So entire CMS is highly extensible and provides a lot of free community modules. But in the same time you lose control and learning curve is much longer. Orchard is free and open-source, entirely MVC-based, UI and API are well done, but it can be hard for both developers and editors to understand it.
Wordpress vs Episerver:
http://tedgustaf.com/blog/2011/2/comparison-of-episerver-and-wordpress/
OK so the guy who wrote that is an Episerver consultant but it's interesting and balanced.
All the different web content management systems have different strengths. So which one is best for you depends a lot on what kind of sites you create, what kind of budget you have and what you think matters the most in a CMS.
For example, Orchard and SiteCore are VERY different systems.
I'm a bit biased as I work there, but I believe that Webnodes CMS have several important advantages over the systems you mention.
Keywords: Relations between content, actual classes for the different content types, custom LINQ provider for all data access, expose all content as an OData endpoint etc.
Microsoft used our CMS to demonstrate OData at Mix11. Video from Mix 11

Installer capabilities, WIX vs InstallShield Express

Programmers that actually promote their products to production need an installer. (pre-emptive "programming related" justificaton.)
For deploying a new suite of internal corporate apps and services, I'm trying to decide between using WIX and the InstallShield Express edition that comes with Visual Studio 2010.
I've looked, but haven't found a feature matrix that highlights the features that are not in the express edition. I expect WIX to be generally quite capable, but more difficult to use, and have heard of situations that WIX doesn't support well.
Has anyone found a feature matrix, or have other recommendations on the long-term best way to manage internal deployments?
I find that wix is a great choice (in spite of the very very steep learning curve) if you need to manage installers in a complex environment because
setup definitions are stored in an XML format
it gives you full control to the underlying windows installer technology; the XML schema typically closely follows the windows installer database schema (which is also the main reason why the learning curve is so steep)
It is easy to integrate into your automated build
Parts of the setup can be generated automatically
It allows you to define small reusable modules and manage complex dependencies between them.
no cost or licensing issues (before wix we all had to use a single "Installshield PC")
Why the XML format is an advantage: this allows you to fully leverage code versioning systems like subversion or mercurial. Reviewing changes, examining history or even merging changes across branches is a breeze. Compare that to installshield projects which are opaque binary blobs.
What I mean by managing complex dependencies: in our case we have a big pool of reusable component libraries with a complex set of dependencies between them, and many applications that were build on top of that. Before wix, this was a nightmare when a new dependency was introduced somewhere: ALL setups had to be updated.
Now with wix, we have a ComponentGroup for each library, organized into a couple wixlibs. Each component group references other component groups that it depends on with a ComponentGroupRef. Application setup developers only need to reference the component groups of direct dependencies, and wix will do the rest by following the references. As a result, introducing a new dependency only requires making a single local change. Our automated builds and wix do the rest to regenerate all the setups.
InstallShield Express is for basic deployments (it's nothing but glorified WinZip). You can also check my favorite AdvancedInstaller. They have also free express edition but I think both of them will be no use to you, because if you need to do anything with IIS, MS SQL, Active directory, GAC etc, you will need "enterprise level" editions. WiX is free but learning curve is so steep, that it's not worth learning. I regret ever learning it.
If you need this just for internal deployments and cannot spend $1,000 on installer, just create your own "installation" project from scratch. System.EnterpriseServices.Internal namespace contains some useful wrappers for IIS, GAC etc. System.Configuration.Install.ManagedInstallerClass can help you deploy windows services. In other words, you can make your own program from scratch that can handle all necessary steps for deployment of your primary product. Many companies don't use for their flagship products commercial installers, they make their own.
The feature matrix for Install shield can be found here:
http://www.flexerasoftware.com/products/installshield/features.htm
However, for the IIS section (I assume you need IIS based on the link to my earlier question) all it says is "Limited". It is up to you to guess what Limited means, but I am betting it will not support an enterprise level deployment.

What should I propose for a reusable code library organization?

My organization has begun slowly repurposing itself to a less product-oriented business model and more contract-oriented business model over the last year or two. During the past year, I was shifted into the new contracting business to help put out fires and fill orders. While the year as a whole was profitable (and therefore, by at least one measure, successful, we had a couple projects that really dinged our numbers for the year back around June.
I was talking with my manager before the Christmas holiday, and he mentioned that, while he doesn't like the term "post-mortem" (I have no idea what's wrong with the term, any business folks or managers out there know?), he did want to hold a meeting sometime mid-January where the entire contract group would review the year and try to figure out what went right, what went wrong, and what initiatives we can perform to try to improve profitability.
For various reasons (I'll go into more detail if it's requested), I believe that one thing our team, and indeed the organization as a whole, would benefit from is some form of organized code-sharing. The same things get done again and again by different people and they end up getting done (and broken) in different ways. I'd like to at least establish a repository where people can grab code that performs a certain task and include (or, realistically, copy/paste) that code in their own projects.
What should I propose as a workable common source repository for a team of at least 10-12 full-time devs, plus anywhere from 5-50 (very) part time developers who are temporarily loaned to the contract group for specialized work?
The answer required some cultural information for any chance at a reasonable answer, so I'll provide it here, along with some of my thoughts on the topic:
Developers will not be forced to use this repository. The barrier to
entry must be as low as possible to
encourage participation, or it will
be ignored. Sadly, this means
that anything which requires an
additional software client to be
installed and run will likely fail.
ClickOnce deployment's about as
close as we can get, and that's awfully iffy.
We are a risk-averse, Microsoft shop. I may be able to sell open-source solutions, but they'll be looked upon with suspicion. All devs have VSS, the corporate director has declared that VSTS is not viable going forward. If it isn't too difficult a setup and the license is liberal, I could still try to ninja a VSTS server into the lab.
Some of my fellow devs care about writing quality, reliable software, some don't. I'd like to protect any shared code written by those who care from those who don't. Common configuration management practices (like checking out code while it's being worked on) are completely ignored by at least a fifth of my colleagues on the contract team.
We're better at writing processes than following them. I will pretty much have to have some form of written process to be able to sell this to my manager. I believe it will have to be lightweight, flexible, and enforced by the tools to be remotely relevant because my manager is the only person who will ever read it.
Don't assume best practices. I would very much like to include things like mandatory code reviews to enforce use of static analysis tools (FxCop, StyleCop) on common code. This raises the bar, however, because no such practices are currently performed in a consistent manner.
I will be happy to provide any additional requested information. :)
EDIT: (Responsing to questions)
Perhaps contracting isn't the correct term. We absolutely own our own code assets. A significant part of the business model on paper (though not, yet, in practice) is that we own the code/projects we write and we can re-sell them to other customers. Our projects typically take the form of adding some special functionality to one of the company's many existing software products.
From the sounds of it you have a opportunity during the "post-mortem"to present some solutions. I would create a presentation outlining your ideas and present them at this meeting. Before that I would recommend that you set up some solutions and demonstrate it during your presentation. Some things to do -
Evangelize component based programming (A good read is Programming .NET Components - Jubal Lowy). Advocate the DRY (Don't Repeat Yourself) principle of coding.
Set up a central common location in you repository for all your re-usable code libraries. This should have the reference implementation of your re-usable code library.
Make it easy for people to use your code libraries by providing project templates for common scenarios with the code libraries already baked in. This way your colleagues will have a consistent template to work from. You can leverage the VS.NET project template capabilities to this - check out the following links VSX Project System (VS.Net 2008), Code Project article on creating Project Templates
Use a build automation tool like MSBuild (which is bundled in VS2005 and up) to copy over just the components needed for a particular project. Make this part of your build setup in the IDE (VS.NET 2005 and up have nifty ways to set up pre-compile and post-compile tasks using MSBuild)
I know there is resistance for open source solutions but I would still recommend setting up and using a continuous automation system like CruiseControl.NET so that you can leverage it to compile and test your projects on a regular basis from a central repository where the re-usable code library is maintained. This way any changes to the code library can be quickly checked to make sure it does not break anything, It also helps bring out version issues with the various projects.
If you can set this up on a machine and show it during your post-mortem as part of the steps that can be taken to improve, you should get better buy since you are showing something already working that can be scaled up easily.
Hope this helps and best of luck with your evangelism :-)
I came across this set of frameworks recently called the Chuck Norris Frameworks - They are available on NuGet at http://nuget.org/packages/chucknorris . You should definitely check them out, as they have some nice templates for your ASP.NET projects. Also definitely checkout Nuget.
organize by topic, require unit tests (feature-level) for check-in/acceptance into library; add a wiki to explain what/why and for searching
One question: You say this is a consulting group. What code assets do you have? I would think most of your teams' coding efforts would be owned by your clients as part of your work-for-hire contract. If you are going to do this you need to make absolutely certain that your contracts grant you rights to your employees' work.
Maven has solved code reuse in the Java community - you should go check it out.
I have a .NET developer that's devised something similar for our internal use for .NET assemblies. Because there's no comparable .NET Internet community, this tool will just access an internal repository in our corporate network. Otherwise will work rather much the way Maven does.
Maven could really be used to manage .NET assemblies directly (we use it with our Flex .swf and .swc code modules) is just .NET folk would have to get over using a Java tool and would probably have to write a Maven plugin to drive msbuild.
First of all for code organization check out Microsoft Framework Design Guidelines at http://msdn.microsoft.com/en-us/library/ms229042.aspx and then create a central Location source control for the new framework that your going to create. Set up some default namespaces, assemblies for cleaner seperation and make sure everyone gets a daily build.
Just an additional point, since we have "shared code" in my shop as well.
We found out this is very much a packaging issue:
Whatever code your are producing or tool you are using, what you should have is a common build tool able to package your sources into a "delivery component", with everything used to actually execute the code, but also the documentation (compressed), and the source (compressed).
The main interest into having a such a "delivery package unit" is to have as less files to deploy as possible, in order to ease the download of those units.
The build process can very well be managed by Maven or any other (ant/nant) tool you want.
When some audit team want to examine all our projects, we just deploy on their post the same packages we deploy on a production machine, except they will un-compressed the source files and do their work.
Since our source files also includes whatever files are needed to compile them (like for instance eclipse files), they even can re-compile those projects in their development environment).
That way:
Developers will not be forced to use this repository. The barrier to entry must be as low as possible to encourage participation, or it will be ignored: it is just a script to execute to get the "delivery module" with everything in it they need (a maven repository can be used for that too)
We are a risk-averse, Microsoft shop: you can use any repository you want
Some of my fellow devs care about writing quality, reliable software, some don't: this has nothing to do with the quality of code written in these packages modules
We're better at writing processes than following them: the only process involved in this is the packaging process, and it can be fairly automated
Don't assume best practices: you are not forced to apply any kind of static code analysis before packaging executable and source files.