bjornen:
Thanks a lot alexhiggins732
I added this script to the website and it seems to work very well already. Only few hours after I set it up, he tried again. This time he was not able to destroy any data in the database. I got the email with the below information. Is there at all anything that can be done to purue this guy?
No Problem, Like I said I have had this in place for months and I know that it is working. I would also suggest you download my IIS Log File Viewer and checkout the log files in your web server. Sql Injection hack attempts are usually easy to spot becuase the query strings are so long.
As far as some of these ideas here, such as deny access to sys tables, I am sure they will work to an extent, but in a professional environment you may be dealing with hundreds or even thousands of databases and/or users and all it really does is stops a hacker from discovering the names of database, tables and columns in your database. If your application is vulnerable to these types of attacks, you need to intercept them before they hit the database or a hacker will still be able to gain access to sensitive data like usernames, passwords and credit card information.
As far as the post that searchs cookies, form values, and query strings, I initially went that route but saw to many false positives, especially in the form values. I would recommend filtering form values in another manner.
<%
' Usage <!-- #include virtual="stringfilters.asp"-->
' For Each Item In Request.Form
' Request.Form(Item) = getUserInput(Request.Form(Item), -1)
' Next
'
' alternately, if you know a string should be only a certing length
' specify the length -- for a first name -- getUserInput(Request.Form("FirstName"), 50)
Dim pFilteringLevel
pFilteringLevel=0
function getLoginField(input,stringLength)
' to filter login fields
dim regEx
Set regEx = New RegExp
getLoginField = left(trim(input),stringLength)
regEx.Pattern =
"([^-_A-Za-z0-9@.])"
regEx.IgnoreCase = True
regEx.Global = True
getLoginField = regEx.Replace(getLoginField, "")
Set regEx = nothingend functionfunction getUserInput(input, stringLength)
dim newString, regEx
Set regEx = New RegExp
' only specified length
if not stringLength = -1 then
newString = left(trim(input),stringLength)
else
newString=Input
end if
if pFilteringLevel=1 then
regEx.Pattern = "([^A-Za-z0-9@=:/*|' _-]+.%)"
regEx.IgnoreCase = True
regEx.Global = True
newString = regEx.Replace(newString, "")
Set regEx = nothing
newString = replace(newString,
"--","")
newString = replace(newString,";","")
end if
if pFilteringLevel=2 then
newString = replace(newString,"--","")
newString = replace(newString,";",";")
newString = replace(newString,"=","=")
newString = replace(newString,"(","(")
newString = replace(newString,")",")")
newString = replace(newString,"'","'")
newString = replace(newString,"""",""")
end if
if pFilteringLevel=3 then
newString = replace(newString,"'","'")
newString = replace(newString,"""",""")
end if
getUserInput = newString
end functionfunction getUserInputL(input,stringLength)
' light filtering
dim tempStr
tempStr = left(input,stringLength)
tempStr = replace(tempStr,
"--","")
tempStr = replace(tempStr,";",";")
tempStr = replace(tempStr,"=","=")
tempStr = replace(tempStr,"(","(")
tempStr = replace(tempStr,")",")")
tempStr = replace(tempStr,"CHAR","CHAR")
tempStr = replace(tempStr,"'","'")
tempStr = replace(tempStr,"""",""")
getUserInputL = tempStr end function
function
formatForDb(input)dim tempStr
tempStr=input
if isNull(tempStr)=false then
' replace to avoid DB errors tempStr = replace(tempStr,"'","''")
tempStr = replace(tempStr,"''''","''")
tempStr = replace(tempStr,"''''''","''")
tempStr = replace(tempStr,"''''''''","''")
tempStr = replace(tempStr,"""","""")
end
if
formatForDb = tempStr
end
function function formatNumberForDb(input) formatNumberForDb=replace(input,",",".")
end
function
%>