ASPROX
Printed From: Web Wiz Forums
Category: Web Wiz Web App Support Forums
Forum Name: Web Wiz Forums
Forum Description: Support forum for Web Wiz Forums application.
URL: https://forums.webwiz.net/forum_posts.asp?TID=25942
Printed Date: 03 April 2026 at 11:14am
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com
Topic: ASPROX
Posted By: Nightrocker
Subject: ASPROX
Date Posted: 08 July 2008 at 11:05pm
Hi
I was victim of ASPROX (zanzana.net/forum) and all my database was flooded with a malicious scripts.
I think that the forum is not the cause of the injection, it is more my ASP programs in the other parts of the website, and I know that a big work has benn done by webwiz to secure the site.
But one of my forum members made me notice about some SQL injections vulnerabilities of the webwiz forum after having used this tool:
http://www.codeplex.com/Release/ProjectReleases.aspx?ProjectName=WSUS&ReleaseId=13436
So are there some ASPROX victims in here and what kind of filters have you written to protect yourselves?
|
Replies:
Posted By: WebWiz-Bruce
Date Posted: 09 July 2008 at 9:45am
SQL Injections are becoming very common with automated bots launched from viruses on peoples computers firing off SQL Injections at every web site.
Luckily Web Wiz Forums is very well protected against this type of hacking as we see from log files 100's of failed SQL Injection attacks against this forum everyday from ASPROX.
This is what the SQLInjectionFinder that you link to will have picked up from your own log files, lots of attempts by ASPROX against Web Wiz Forums, however they WILL fail as Web Wiz Forums is very well protected against attacks by ASPROX and other viruses and hacking attacks.
To protect your own ASP applications from attack you need to parse ALL data from both querystring and form input, and not just for SQL Injection but also for Cross Site Scripting (XSS).
There are many sites if you search through google giving information on how to protect from these types of attacks.
At the very least you should check the datatype being passed, for intance if it is menat to be a number then use isNumeric(Request("userdata") to check that it is a number. For strings make sure you remove any single quotes (') by esacping them with Replace(userdata, "'", "''").
Other things you can do is strip out sentive words, HTML encode certain characters like [ ] ; etc.
-------------
https://www.webwiz.net/web-wiz-forums/forum-hosting.htm" rel="nofollow - Web Wiz Forums Hosting
https://www.webwiz.net/web-hosting/windows-web-hosting.htm" rel="nofollow - ASP.NET Web Hosting
|
|