SQL Injection continued

DotNetKicks.com — Mon, 02 Jun 2008 18:43:41 GMT

You've been kicked (a good thing) - Trackback from DotNetKicks.com

re: SQL Injection continued

roger — Tue, 03 Jun 2008 10:05:21 GMT

I have been attacked 6 times within 2 weeks and cant run my business. Whats the best way to stop this?

re: SQL Injection continued

Shail — Tue, 03 Jun 2008 11:01:58 GMT

Hi Tom,

So I am using Visual Studio 2005 professional edition ( we can not afford to have VS 2008 right now ). Now how I can use it to detect SQL Injection pron queries, Also what other tools or add-ins I can use with my professional edition so that I can detect XSS attacks and any other possible threats.

Something like I ask the "tool" check my code for all possible attacks and vulnerability.

Can you please suggest something ??

Thanks,

Shail

re: SQL Injection continued

StevenMcD — Tue, 03 Jun 2008 11:53:53 GMT

Maybe its just me, but I feel inline SQL is incredibly bad design. Especially with the introduction of LiNQ. To me, there is no longer a reason to include inline SQL in any project ever.

re: SQL Injection continued

Tom — Tue, 03 Jun 2008 17:53:57 GMT

Roger,

Are you discovering problems or they are just trying to get in? If you have problems, I'd suggest contacting someone to help you figure out how you can stop the attacks. If you are using Microsoft products, we will be glad to assist you in locking down the server and protecting it. So my "Contacting Tom" post:

http://blogs.msdn.com/tom/archive/2007/11/15/contacting-tom.aspx

For information on how to contact support.

re: SQL Injection continued

Tom — Tue, 03 Jun 2008 17:59:25 GMT

Shail,

Have you checked the tools that I linked to this post? The 3 towards the bottom don't rely on VS2008 and may help you.

re: SQL Injection continued

Tom — Tue, 03 Jun 2008 18:00:45 GMT

StevenMcD,

While I agree that Linq does help a lot, there are still some legacy projects that have this code it is that someone may be update to upgrade to Linq right away. Hopefully I will have a post about Linq soon to help with this also.

re: SQL Injection continued

theredhead — Wed, 04 Jun 2008 21:36:16 GMT

Tom, great to see this, too bad I didn't see it until now!

re: SQL Injection continued

jay — Wed, 23 Jul 2008 08:34:45 GMT

hi tom

im jay and im a comsci student..At this moment im still searching for my thesis.."SQL Injection Analysis: Attacks and Vulnerabilities"

i want to ask some opinion from you.

you can email me at (me_comsci@yahoo.com)