DaniWeb Forum Index > Web Development > ASP

ASP RSS

SQl Injection through ASP and MS SQl 2000

Please support our ASP advertiser: $4.95 a Month - ASP.NET Web Hosting – Click Here!

•

Join Date: Dec 2004

Posts: 234

Reputation: cancer10 is an unknown quantity at this point

Solved Threads: 0

cancer10

Offline

Posting Whiz in Training

SQl Injection through ASP and MS SQl 2000

Oct 27th, 2007

Hello,

I have heard a lot about SQL Injection. I was wondering how does an injector come to know about the table/column name when they cannot see the asp codes in a website?

Can someone explain plz?

Thanx

FocusInterview.com - PHP Interview Questions & Answers

IGCHosting - Cheapest Web Hosting

•

Join Date: Sep 2007

Posts: 1,080

Reputation: SheSaidImaPregy is an unknown quantity at this point

Solved Threads: 68

SheSaidImaPregy SheSaidImaPregy is offline

Offline

Veteran Poster

Re: SQl Injection through ASP and MS SQl 2000

Oct 27th, 2007

You do not need to know the column names. If you pull information from an open source, like a querystring, and directly insert it into your sql statement, like below, they can add bad stuff to it... like below:

 Help with Code Tags 
 ASP Syntax (Toggle Plain Text) 
<%
strRequest = Request.QueryString("query")
strSQL = "SELECT column FROM table WHERE column2='" & strRequest & "'"
 
'This is why it is bad below:
strRequest = "stories from';DROP...;"
'Imaging with me, when they insert this and get it right, they deleted your entire table and all your data. Names are not as hard to guess as most would think.
'Try running the code to remove certain words like "drop" ";" "alter" "create" etc, if you have to pull from a querystring.
<%
strRequest = Request.QueryString("query")
strSQL = "SELECT column FROM table WHERE column2='" & strRequest & "'"

'This is why it is bad below:
strRequest = "stories from';DROP...;"
'Imaging with me, when they insert this and get it right, they deleted your entire table and all your data. Names are not as hard to guess as most would think.
'Try running the code to remove certain words like "drop" ";" "alter" "create" etc, if you have to pull from a querystring.

•

Join Date: Oct 2007

Posts: 147

Reputation: hopalongcassidy is an unknown quantity at this point

Solved Threads: 13

hopalongcassidy hopalongcassidy is offline

Offline

Junior Poster

Re: SQl Injection through ASP and MS SQl 2000

Nov 9th, 2007

If you are interested in reading a good piece on SQL Injection that tells you how to hack into sites that don't protect themselves against such attacks and (what is more important) how to protect your site against such attacts, let me share a URL with you:

http://ocliteracy.com/techtips/sql-injection.html

This article is easy to read. It takes you on a step by step journey through the hacker's thought process and how he can succeed in creating havoc. It also tells you what you can do to defend you site against such attacks.

Hope this helps.

Hoppy