RE: (@) aspx applictions SQL Injection

["Don Tuer" <don.tuer () cgi com>]

You should tell them to change all their SQL commands to use stored
procedures and Parameters collections. I "think" it's easier to do in
ADO.NET.

"If you use the Parameters collection, no matter what a malicious user
includes as input, the input is treated as a literal. An additional
benefit of using the Parameters collection is that you can enforce type
and length checks. Values outside of the range trigger an exception.
This is a healthy example of defense in depth"

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetse
c/html/SecNetch12.asp 

-----Original Message-----
From: Mohamed Ali [mailto:rxmohamed () hotmail com] 
Sent: Tuesday, October 12, 2004 4:23 AM
To: webappsec () securityfocus com
Subject: (@) aspx applictions SQL Injection

Hi all,

I did a full pen-test on my client's web application and almost I can
get 
all data and data dictionary information I need through exploiting SQL 
injection vulnerabilities they have in many dynamic pages.

The question is when I discussed these issues with IT people  they
recommend 
not to solve any of them but just converting to   .Net technology I'm
not 
familiar with Net tech. but this recommendation  sounds weird to me IS
THERE 
ANY WAY TO PROVE THAT THEIR RECOMMENDATION IS NOT ENOUGH TO PREVERT 
UNAUTHRIZED ACCESS THROUGH SQL INJECTION (their platform  IIS ,SQL
Server 
and Oracle )


Any suggestions would be appreciated.

Thanks



Ahmed Rashad
IT Audit Manger
Experts.ae

_________________________________________________________________
Don't just search. Find. Check out the new MSN Search! 
http://search.msn.com/