Notes for defending against SQL injection attacks

At present, many IIS firewalls are essentially an ISAPI filter. The essence of defense against SQL injection attacks is keyword filtering, this is also the case in the developed web server guard as mentioned in my previous articles. However, most IIS firewalls currently have a vulnerability: If the keyword contains the unescaped percentage sign (%), The request filtering and interception will bypass these IIS firewalls, including the Request Filter of IIS 7.0.

This type of firewall is used to search for keywords in URL/form/cookie, such as exec. However, if you pass in E % xec, it will not be filtered. This problem is currently known in most of the IIS firewalls (this is not detailed here to avoid advertising suspicion, can be found in Google search), which is easy to penetrate. This problem also exists in a set of security filter functions provided by Microsoft for ASP.

This problem also exists in URLScan, but I have not tested URLScan 3.0beta. Therefore, you should pay attention to this in developing the ISAPI request filter.

Http://www.ietf.org/rfc/rfc2396.txt

IIS 7.0 PatchingProgram:

Http://www.microsoft.com/downloads/details.aspx? Familyid = 9bf0adf3-20ce-4772-8304-83b68983c1fa & displaylang = ZH-CN

Http://support.microsoft.com/kb/957508/en-us