WebApp Sec mailing list archives
RE: (@) aspx applictions SQL Injection
From: "Don Tuer" <don.tuer () cgi com>
Date: Wed, 13 Oct 2004 10:26:12 -0400
You should tell them to change all their SQL commands to use stored procedures and Parameters collections. I "think" it's easier to do in ADO.NET. "If you use the Parameters collection, no matter what a malicious user includes as input, the input is treated as a literal. An additional benefit of using the Parameters collection is that you can enforce type and length checks. Values outside of the range trigger an exception. This is a healthy example of defense in depth" http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetse c/html/SecNetch12.asp -----Original Message----- From: Mohamed Ali [mailto:rxmohamed () hotmail com] Sent: Tuesday, October 12, 2004 4:23 AM To: webappsec () securityfocus com Subject: (@) aspx applictions SQL Injection Hi all, I did a full pen-test on my client's web application and almost I can get all data and data dictionary information I need through exploiting SQL injection vulnerabilities they have in many dynamic pages. The question is when I discussed these issues with IT people they recommend not to solve any of them but just converting to .Net technology I'm not familiar with Net tech. but this recommendation sounds weird to me IS THERE ANY WAY TO PROVE THAT THEIR RECOMMENDATION IS NOT ENOUGH TO PREVERT UNAUTHRIZED ACCESS THROUGH SQL INJECTION (their platform IIS ,SQL Server and Oracle ) Any suggestions would be appreciated. Thanks Ahmed Rashad IT Audit Manger Experts.ae _________________________________________________________________ Don't just search. Find. Check out the new MSN Search! http://search.msn.com/
Current thread:
- aspx applictions SQL Injection Mohamed Ali (Oct 12)
- Re: aspx applictions SQL Injection Adam Shostack (Oct 12)
- RE: aspx applictions SQL Injection Anil John (Oct 12)
- RE: (@) aspx applictions SQL Injection Don Tuer (Oct 15)
- <Possible follow-ups>
- RE: aspx applictions SQL Injection Michael Silk (Oct 12)
- RE: aspx applictions SQL Injection BĂ©noni MARTIN (Oct 14)