In the server Security section, I wrote an article on "Cracking the general SQL anti-injection method", said that some of the general anti-injection methods do not filter cookie data, will give hackers the opportunity to leave. Of course, my code also filtered the cookie data that was submitted.
Code:
Copy Code code as follows:
Using System;
Using System.Configuration;
Using System.Web;
Using System.Globalization;
Namespace Jnyw. Stum.sqlinject
{
public class Sqlstrany:ihttpmodule
{
public void Init (HttpApplication application)
{
Application. BeginRequest + = (new
EventHandler (this. Application_BeginRequest));
}
private void Application_BeginRequest (Object source, EventArgs E)
{
ProcessRequest PR = new ProcessRequest ();
pr. Startprocessrequest ();
}
public void Dispose ()
{
}
}
public class ProcessRequest
{
private static string sqlstr = system.configuration.configurationmanager.appsettings["Sqlinject"]. ToString ();
private static string sqlerrorpage = system.configuration.configurationsettings.appsettings["Sqlinjecterrpage"]. ToString ();
///
That is used to identify whether the stream is transmitted
///
///
///
BOOL Isuploadrequest (HttpRequest request)
{
return Stringstartswithanotherignorecase (Request. ContentType, "Multipart/form-data");
}
///
Compare Content Types
///
///
///
///
private static bool Stringstartswithanotherignorecase (string s1, string s2)
{
Return (String.Compare (S1, 0, s2, 0, S2.) Length, True, cultureinfo.invariantculture) = = 0);
}
Analysis of SQL injection attack code
Analysis of #region SQL injection attack code
///
Handling requests submitted by a user
///
public void Startprocessrequest ()
{
HttpRequest Request = System.Web.HttpContext.Current.Request;
HttpResponse Response = System.Web.HttpContext.Current.Response;
Try
{
String getkeys = "";
if (Isuploadrequest (Request)) return; Exit if the stream is passed
String parameters
if (request.querystring!= null)
{
for (int i = 0; i < Request.QueryString.Count; i++)
{
Getkeys = Request.querystring.keys[i];
if (! Processsqlstr (Request.querystring[getkeys])
{
Response.Redirect (Sqlerrorpage + "? Errmsg=querystring contains illegal strings &sqlprocess=true");
Response.End ();
}
}
}
Form parameter
if (Request.Form!= null)
{
for (int i = 0; i < Request.Form.Count; i++)
{
Getkeys = Request.form.keys[i];
if (! Processsqlstr (Request.form[getkeys])
{
Response.Redirect (Sqlerrorpage + "? Errmsg=form contains illegal strings &sqlprocess=true");
Response.End ();
}
}
}
Cookie parameters
if (request.cookies!= null)
{
for (int i = 0; i < Request.Cookies.Count; i++)
{
Getkeys = Request.cookies.keys[i];
if (! Processsqlstr (Request.cookies[getkeys]. Value))
{
Response.Redirect (Sqlerrorpage + "? Errmsg=cookie contains illegal strings &sqlprocess=true");
Response.End ();
}
}
}
}
Catch
{
Error handling: Processing user submission information!
Response.Clear ();
Response.Write ("Customerrorpage configuration Error");
Response.End ();
}
}
///
To analyze whether a user request is normal
///
Incoming User submission Data
Returns whether the SQL injection attack code is included
private bool Processsqlstr (string Str)
{
BOOL ReturnValue = true;
Try
{
if (Str!= "")
{
string[] Anysqlstr = sqlstr.split (' | ');
foreach (String ss in Anysqlstr)
{
if (Str.indexof (ss) >= 0)
{
ReturnValue = false;
Break
}
}
}
}
Catch
{
ReturnValue = false;
}
Return returnvalue;
}
#endregion
}
}
In actual use, we'll add the following code to the configuration section in the Web.config file
Here is the sample code:
Copy Code code as follows:
<!--anti-injection settings-->
<add value= "and |exec |insert |select |delete |update |count | * |CHR |mid |master |truncate |char |declare "key=" Sqlinject
<add value= "showerr.aspx" key= "Sqlinjecterrpage"/>
And in the Web.config file of the <system. Add the following code to the web>. Here is the sample code:
Copy Code code as follows:
<!--anti-injection settings-->
<HTTPMODULES>
<add name= "Sqlstrany" type= "Jnyw". Stum.sqlinject.sqlstrany,sqlstrany "/>
</HTTPMODULES>
