http://blogs.msdn.com/debuggingtoolbox/archive/2008/09/09/how-to-decipher-strings-originating-from-sql-injection-attacks.aspxThis blog article was written by Ayax Vargas, a friend and co-worker from my team. Ayax is very skilled in development/debugging and SQL Server. A few days ago I was reading one analysis done by Ayax and I was impressed by how he translated what lookeden-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.msdn.com/debuggingtoolbox/archive/2008/09/09/how-to-decipher-strings-originating-from-sql-injection-attacks.aspx#8937497Wed, 10 Sep 2008 00:37:58 GMT91d46819-8472-40ad-a661-2c78acb4018c:8937497a-foton &raquo; How to Decipher Strings Originating from SQL Injection Attacks<p>PingBack from <a rel="nofollow" target="_new" href="http://blog.a-foton.ru/2008/09/how-to-decipher-strings-originating-from-sql-injection-attacks/">http://blog.a-foton.ru/2008/09/how-to-decipher-strings-originating-from-sql-injection-attacks/</a></p> http://blogs.msdn.com/debuggingtoolbox/archive/2008/09/09/how-to-decipher-strings-originating-from-sql-injection-attacks.aspx#8937502Wed, 10 Sep 2008 00:39:35 GMT91d46819-8472-40ad-a661-2c78acb4018c:8937502tony roth<p>you have a warped sense of cool, but your right its cool! </p>http://blogs.msdn.com/debuggingtoolbox/archive/2008/09/09/how-to-decipher-strings-originating-from-sql-injection-attacks.aspx#8938500Wed, 10 Sep 2008 05:19:18 GMT91d46819-8472-40ad-a661-2c78acb4018c:8938500Barry Kelly<p>The data are just hex-encoded ASCII values. Seems to me it would be much safer to translate those directly rather than feed it through a SQL server instance.</p>http://blogs.msdn.com/debuggingtoolbox/archive/2008/09/09/how-to-decipher-strings-originating-from-sql-injection-attacks.aspx#8939427Wed, 10 Sep 2008 11:04:24 GMT91d46819-8472-40ad-a661-2c78acb4018c:8939427Roberto Farah<p>I know it's hex-encoded ASCII :) I didn't know that using SQL Server we could translate it. It's way faster and simpler than using WinDbg, for example.</p>http://blogs.msdn.com/debuggingtoolbox/archive/2008/09/09/how-to-decipher-strings-originating-from-sql-injection-attacks.aspx#8963878Wed, 24 Sep 2008 20:30:11 GMT91d46819-8472-40ad-a661-2c78acb4018c:8963878skyemark<p>We've been getting hit hard for a few months now. When the injection code is found in the querystring we redirect to a page that doesn't exist. We were hoping if the bots got enough 404 errors they would leave us alone, but that's not working. Anyone know of a poison pill we can send back to them?</p>http://blogs.msdn.com/debuggingtoolbox/archive/2008/09/09/how-to-decipher-strings-originating-from-sql-injection-attacks.aspx#8972184Wed, 01 Oct 2008 23:45:26 GMT91d46819-8472-40ad-a661-2c78acb4018c:8972184John H.<p>To speed things up I've stopped giving any response to these. &nbsp; I'm sure enough of my own code, that I parse my inbound variables for semicolons -- If I find one, I abort the page and don't send any response.</p> <p>If nothing else, it speeds up my server a little.</p>