WebApp Sec mailing list archives
RE: aspx applictions SQL Injection
From: "Michael Silk" <michaels () phg com au>
Date: Wed, 13 Oct 2004 11:00:28 +1000
Hi Ahmed, No need to type in caps :) Of course, simply changing programming languages won't help at all; sql injection doesn't care about language it's based on the lack of validation on input. If they use .NET and force all sql-used inputs to be validated appropriately then there will be no more issue with SQL Injection, however simply changing languages *will not help at all*. -- Michael Ps: Just like writing this message in japanese or french wouldn't change it from being wrong to right, or right to wrong :) -----Original Message----- From: Mohamed Ali [mailto:rxmohamed () hotmail com] Sent: Tuesday, 12 October 2004 6:23 PM To: webappsec () securityfocus com Subject: aspx applictions SQL Injection Hi all, I did a full pen-test on my client's web application and almost I can get all data and data dictionary information I need through exploiting SQL injection vulnerabilities they have in many dynamic pages. The question is when I discussed these issues with IT people they recommend not to solve any of them but just converting to .Net technology I'm not familiar with Net tech. but this recommendation sounds weird to me IS THERE ANY WAY TO PROVE THAT THEIR RECOMMENDATION IS NOT ENOUGH TO PREVERT UNAUTHRIZED ACCESS THROUGH SQL INJECTION (their platform IIS ,SQL Server and Oracle ) Any suggestions would be appreciated. Thanks Ahmed Rashad IT Audit Manger Experts.ae _________________________________________________________________ Don't just search. Find. Check out the new MSN Search! http://search.msn.com/ This email message and accompanying data may contain information that is confidential and/or subject to legal privilege. If you are not the intended recipient, you are notified that any use, dissemination, distribution or copying of this message or data is prohibited. If you have received this email message in error, please notify us immediately and erase all copies of this message and attachments. This email is for your convenience only, you should not rely on any information contained herein for contractual or legal purposes. You should only rely on information and/or instructions in writing and on company letterhead signed by authorised persons.
Current thread:
- aspx applictions SQL Injection Mohamed Ali (Oct 12)
- Re: aspx applictions SQL Injection Adam Shostack (Oct 12)
- RE: aspx applictions SQL Injection Anil John (Oct 12)
- RE: (@) aspx applictions SQL Injection Don Tuer (Oct 15)
- <Possible follow-ups>
- RE: aspx applictions SQL Injection Michael Silk (Oct 12)
- RE: aspx applictions SQL Injection BĂ©noni MARTIN (Oct 14)