ASPROX

SQL Injections are becoming very common with automated bots launched from viruses on peoples computers firing off SQL Injections at every web site.

Luckily Web Wiz Forums is very well protected against this type of hacking as we see from log files 100's of failed SQL Injection attacks against this forum everyday from ASPROX.

This is what the SQLInjectionFinder that you link to will have picked up from your own log files, lots of attempts by ASPROX against Web Wiz Forums, however they WILL fail as Web Wiz Forums is very well protected against attacks by ASPROX and other viruses and hacking attacks.

To protect your own ASP applications from attack you need to parse ALL data from both querystring and form input, and not just for SQL Injection but also for Cross Site Scripting (XSS).

There are many sites if you search through google giving information on how to protect from these types of attacks.

At the very least you should check the datatype being passed, for intance if it is menat to be a number then use isNumeric(Request("userdata") to check that it is a number. For strings make sure you remove any single quotes (') by esacping them with Replace(userdata, "'", "''").

Other things you can do is strip out sentive words, HTML encode certain characters like [ ] ; etc.


Edited by WebWiz-Bruce - 09 July 2008 at 9:51am