Notes for defending against SQL injection attacks

Source: Internet
Author: User

At present, many IIS firewalls are essentially an ISAPI filter. The essence of defense against SQL injection attacks is keyword filtering, this is also the case in the developed web server guard as mentioned in my previous articles. However, most IIS firewalls currently have a vulnerability: If the keyword contains the unescaped percentage sign (%), The request filtering and interception will bypass these IIS firewalls, including the Request Filter of IIS 7.0.


This type of firewall is used to search for keywords in URL/form/cookie, such as exec. However, if you pass in E % xec, it will not be filtered. This problem is currently known in most of the IIS firewalls (this is not detailed here to avoid advertising suspicion, can be found in Google search), which is easy to penetrate. This problem also exists in a set of security filter functions provided by Microsoft for ASP.

This problem also exists in URLScan, but I have not tested URLScan 3.0beta. Therefore, you should pay attention to this in developing the ISAPI request filter.

Http://www.ietf.org/rfc/rfc2396.txt

IIS 7.0 PatchingProgram:

Http://www.microsoft.com/downloads/details.aspx? Familyid = 9bf0adf3-20ce-4772-8304-83b68983c1fa & displaylang = ZH-CN

Http://support.microsoft.com/kb/957508/en-us

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.