Re: aspx applictions SQL Injection

[jas () bebinary com]

Mohammed,

That is a typical response from a dev team but unfortunately it's not the
correct and complete fix.  It IS possible to screw up configuration in
.NET and have your web application still be SQL injectable, or XSS'able. 
The true fix has to come from strong input validation and/or escaping
malicious characters and/or using stored proc's.

If they push back on these suggestions and believe that porting to .NET is
sufficient, put the right suggestion in the final report convince them of
the fact they they NEED regression testing after they port.  And once
regression testing comes around just blow the doors off the app again
through the use of sql injection.  This way you build from credibility,
make a very strong point, and make more $$$ from the regression testing.

regards,
Jas

> Hi all,
>
> I did a full pen-test on my client’s web application and almost I can get
> all data and data dictionary information I need through exploiting SQL
> injection vulnerabilities they have in many dynamic pages.
>
> The question is when I discussed these issues with IT people  they
> recommend
> not to solve any of them but just converting to   .Net technology I’m not
> familiar with Net tech. but this recommendation  sounds weird to me IS
> THERE
> ANY WAY TO PROVE THAT THEIR RECOMMENDATION IS NOT ENOUGH TO PREVERT
> UNAUTHRIZED ACCESS THROUGH SQL INJECTION (their platform  IIS ,SQL Server
> and Oracle )
>
>
> Any suggestions would be appreciated.
>
> Thanks
>
>
>
> Ahmed Rashad
> IT Audit Manger
> Experts.ae
>
> _________________________________________________________________
> Express yourself instantly with MSN Messenger! Download today it's FREE!
> http://messenger.msn.com/
>
>
> ------------------------------------------------------------------------------
> Internet Security Systems. - Keeping You Ahead of the Threat
>
> When business losses are measured in seconds, Internet threats must be
> stopped before they impact your network. To learn how Internet Security
> Systems keeps organizations ahead of the threat with preemptive intrusion
> prevention, download the new whitepaper, Defining the Rules of Preemptive
> Protection, and end your reliance on reactive security technology.
>
> http://www.securityfocus.com/sponsor/ISS_pen-test_041001
> -------------------------------------------------------------------------------



------------------------------------------------------------------------------
Internet Security Systems. - Keeping You Ahead of the Threat

When business losses are measured in seconds, Internet threats must be stopped before they impact your network. To 
learn how Internet Security Systems keeps organizations ahead of the threat with preemptive intrusion prevention, 
download the new whitepaper, Defining the Rules of Preemptive Protection, and end your reliance on reactive security 
technology. 

http://www.securityfocus.com/sponsor/ISS_pen-test_041001
-------------------------------------------------------------------------------