Debugging .NET HTTPS apps

We're currently going through a security audit at work hardening a third party application. One of the improvements is to switch from HTTP to HTTPS which makes verifying the rest of the changes is tricky.

The way I did it was to download/installed Fiddler (http://www.fiddlertool.com/) which is an inspecting proxy. I followed the instructions to enable https decryption, and told Windows to trust the fiddler root certificate (Moved from Personal->Certificates to Trusted Root Certificate Authorities->Certificates).

Checked IE worked and it was fine, then I modified the application.exe.config file under the Docs and Settings\user\Local Settings\Application Data\Vendor\App and added

<configuration>
  <system.net>
    <defaultProxy>
      <proxy proxyaddress="http://localhost:8888" />
    </defaultProxy>
  </system.net>
</configuration>

I thought I was being very clever, but it turns out I couldn't get it to work. So I switched to using HTTPS instead.

Fiddlertool is pretty cool though :)

Dora the Explorer World Adventure workaround

My daughter was heartbroken when we bought this cheap and it didn't work under IE7, so with a little investigation I came up with this workaround rather than 'downgrade to IE6' as Activision recommend.

Download the 'standalone' IE6 from http://browsers.evolt.org/?ie/32bit/standalone

Uncompress it into C:\Program Files\Activision Value\Dora World Adventure

Then bring up a command prompt (Start -> All Programs -> Accessories under Windows XP) and type

        cd "C:\Program Files\Activision Value\Dora World Adventure" 
        copy IEXPLORE.EXE.local DoraAdventure.exe.local 
        exit 

And voila, it should just work. I'd expect this would work for any of your games that rely on IE6 for their presentation engine

iptables rules to lock out multiple failed ssh attempts

Two simple lines to run at boot:

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set &

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP &