Re: HELP! - I need to setup a temporary IIS redirect while I fix SQL Injection vulnerabilities on my site

On May 17, 2:23 pm, dsa157 <dsa...@xxxxxxxxx> wrote:
Hi all -

My site has been hot by the latest wave of SQL Injection attacks. I
(sorta) understand what I need to do to fix things, but it is going to
take a *lot* of work that'll be pretty time consuming as the site is a
hodge podge of classic ASP and ASP.Net and hand rolled scripts etc.

What I'd like to do in the meantime is redirect any web request that
comes in with a substring that I know I don't want to process, ie if
the URL contains "=CAST", I'd like to throw it out.

Can I go a global redirect like this in IIS to prevent the request
from every getting to my database back end? if so, how do I do it?

Thanks in advance!

Dave


There are no features in IIS that behave like you describe.

There are add-on extension modules that behave like that.
- There is URLScan that will reject requests based on certain
criteria, but it will NOT scan the Querystring.
- There are other ISAPI Filters of various reputation which
[foolishly] scans the querystring to reject requests.

In general, trying to do this temporary redirection is going the wrong
way, even temporary. All it takes is a few encodings/permutations and
all those hard-coded redirection filters are rendered useless. And
since Querystring has no defined encoding in the HTTP specification,
you're pretty much wasting your time.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
.

Relevant Pages

  • Re: Alter querystring through APP
    ... In my Startmethod I am appending the querystring to szUrl ... The request gets sent with the new url. ... In my ReportData() method my App calls targetSink's ReportProgress ... right before calling Start on target APP. ...
    (microsoft.public.inetsdk.programming.webbrowser_ctl)
  • Re: Preventing Request.Form abuse
    ... I think I would redirect them to a large video file on one of the online ... also block their IP real time in the filter, so any future request from them ... If we were to use a real rather than a fictitious URL for the redirect, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Logged in - Session timeout
    ... You have that info in a session, and then simply send them to: ... take any querystring info with it that you may need.... ... Now the users times out and you redirect them to your login page, ...
    (microsoft.public.inetserver.asp.general)
  • Re: BUG? With A HTTPModule
    ... querystring is specified but encountered 404 error if request the url ... I tried visit some pages (which is in the root folder of the application) ... both with querystring and without any querystring but seems not encounter ...
    (microsoft.public.dotnet.framework.aspnet)
  • Alter querystring through APP
    ... In my Startmethod I am appending the querystring to szUrl ... The request gets sent with the new url. ... In my ReportDatamethod my App calls targetSink's ReportProgress ... the browser sends to APP a request without the ...
    (microsoft.public.inetsdk.programming.webbrowser_ctl)