Algoritmo de Luhn El algoritmo de Luhn es un método creado para la verificación de números de identificación, como los números de las tarjetas de crédito (Visa, MasterCard) o el IMEI de los teléfonos móviles. Su creador fue Hans Peter Luhn , un científico de IBM y su uso ha sido tan extendido que desde que fuera creado hoy controla la creación y validación de todos los plásticos que se otorgan a los que poseen tarjetas de crédito de todo el mundo. Este algoritmo es muy simple, nos dice que dada un número que contenga solamente dígitos [0-9], una tarjeta de crédito es válida si y solo si, obteniendo la reversa de este número, y la suma sus dígitos debe ser un múltiplo de 10, es decir que la suma módulo 10 debe ser igual a cero. La forma en sumar es la siguiente, una vez hayamos invertido el número, si es posición impar, sumamos el dígito, si es posición impar, multiplicamos ese dígito por dos y sumamos los dígitos de ese número, para hacerlo más prácti...

Validator and ValidationRules Implementations  Anti Sql Injection Validation Rule Anti Cross Site Scripting Validation Rule Anti Path Traversal Validation Rule Anti Server Side Includes Injection Validation Rule Data Validation Service Implementation

Data Validation Service  public class DataValidationService : IDataValidationService     {           private readonly IValidator _validator;          public DataValidationService()         {             _validator = new Validator();             LoadCreditCardRules(_validator);             LoadStringRules(_validator);         }         public bool IsValidCreditCard(CreditCardType type, string number)         {             switch (type)             {                 case CreditCardType.AmericanExpress:                     return _validator.GetRule(ValidationRules.AmericanExpress).IsVali...

Server Side Includes (SSI) Injection SSIs are directives present on Web applications used to feed an HTML page with dynamic contents. They are similar to CGIs, except that SSIs are used to execute some actions before the current page is loaded or while the page is being visualized. In order to do so, the web server analyzes SSI before supplying the page to the user. The Server-Side Includes attack allows the exploitation of a web application by injecting scripts in HTML pages or executing arbitrary codes remotely. It can be exploited through manipulation of SSI in use in the application or force its use through user input fields. Another way to discover if the application is vulnerable is to verify the presence of pages with extension .stm, .shtm and .shtml. However, the lack of these type of pages does not mean that the application is protected against SSI attacks. In any case, the attack will be successful only if the web server permits SSI execution without proper validatio...

SQL   Injection A  SQL injection  attack consists of insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of  injection attack , in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands. See more information :  https://www.owasp.org/index.php/SQL_Injection Anti SQL Injection Validation Rule     public class AntiSqlInjectionValidationRule : IValidationRule     {         public bool IsValid(string input)         {       ...

Path Traversal A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. It should be noted that access to files is limited by system operational access control (such as in the case of locked or in-use files on the Microsoft Windows operating system). This attack is also known as “dot-dot-slash”, “directory traversal”, “directory climbing” and “backtracking”. See more information:  https://www.owasp.org/index.php/Path_Traversal Anti Path Traversal Validation Rule     public class AntiPathTraversalStringValidationRule : IValidationRule     {        ...

Cross Site Scripting Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. See more information :   https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) See more information about how to prevent it :  https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet     public class AntiCrossSiteScriptingValidationRule : IValidationRule     {         public bool IsValid(string input)         {             var pattern = new Str...