asp.net - How to clean up after an SQL Injection Attack?

Question

I have several old sites that have just been taken offline by my hosting company, apparently due to a SQL injection attack. I looked inside my database and yes I was hacked. *oops*

My database has been filled with script tags that have been appended to my original data (at least my original data is still there so that was nice of them).

I have been looking though my old code and have seen a few unsanitised input locations, so obviously I will go through this thoroughly and check for more. Im also downloading the hacked site to compare it to the version I uploaded years ago (using some kind of file checker program), this should allow me to see if they have tried to add a backdoor.

My questions are…

1) Is there a way I can strip out all the appended scrip tags from my database as they are all exactly the same?

2) Is there anything else I should be aware of or have overlooked?

I would just like to point out that no sensitive material are stored on these old sites so it’s no big deal, I would just like to get them back up and running again.

I am bushing up on my security knowledge and will shortly delete all the files on the host, change all the passwords and upload the improved (and less hacker friendly) site.

Thanks...

Ha ha, bad luck. Can you give us an idea of what the attacked data looks like? — James Wiseman, Apr 13 '12 at 12:05
@JamesWiseman - Haha, thanks for the sympothy, sadly all I know is that in my database there are now loads of "" — Luckyl337, Apr 13 '12 at 12:11
@AshwiniVerma Thats close and a start but not quite what Im looking for — Luckyl337, Apr 13 '12 at 12:14

James Wiseman · Accepted Answer · 2012-04-13T12:26:14.570

Specifically answering your script tag replacement issue, I can't see this anything other than being a manual task.

I'm sure you've considered this, but a simple replace statement on a field ought to get this stuff out:

update MyTable
set field = replace(field, 'unwanted', '')
where field like '%unwanted%'

If there are many tables and fields, then I'm sure you could conjour some sort of automation using the SQl data dictionary. Something like the following:

DECLARE @ColName varchar(255), @TableName varchar(255), @sSQL varchar(1000)
DECLARE colcur CURSOR for
 SELECT name, object_name(id) 
   FROM syscolumns
  WHERE name = 'Moniker'

  OPEN ColCur
 FETCH NEXT FROM ColCur 
  INTO @ColName, @TableName

WHILE @@FETCH_STATUS = 0
BEGIN
    Set @sSQL = 'update ' + @TableName + ' set ' + @ColName + ' = replace(' + @ColName + ', ''unwanted'', '''') where ' + @ColName + ' like ''%unwanted%'''

    exec(@sSQL) 

    select @ColName, @TableName
    FETCH NEXT FROM ColCur 
    INTO @ColName, @TableName
END 

CLOSE ColCur
DEALLOCATE ColCur

Yes thats a much better idea! Just a simple replace should work wonders. I should have thought of that but this is why we ask questions. There are a few tables and columns but Ill keep it simple and do a little work. Thanks! — Luckyl337, Apr 13 '12 at 12:25

score 2 · Answer 2 · answered Apr 13 '12 at 13:31

I guess these would be some steps in an ideal scenario:

Keep your site offline. Maybe you'd like to display a "Down to technical maintenance" message rather than a 404.
Make a backup of the hacked database, you may want to analyse it later
Make sure that you fix code pieces vulnerable for SQL Injections. I'd recommend doing this in a team, to be more thorough.
Restore your database from a backup
Upload the (hopefully) fixed homepage
Contact your lawyer because you may have probably leaked customer data.
With your lawyer you would discuss the next legal steps.

As you mentioned, no sensitive material was stored on the hacked page, that probably means you can skip steps 6 and 7.

score 1 · Answer 3 · answered Apr 13 '12 at 12:19

1

This is an ideal time to use your backup if you have one, because you don't know exactly how your data was corrupted. If you don't have a backup, then this should be a lesson to use backups in the future and to protect yourself against such attacks. Also, if you don't have a backup, you should create an algorithm which cleans up your data, this doesn't guarantee that no junk will remain though.

answered Apr 13 '12 at 12:19

Lajos Arpad

64,414
37
100
175

That is true but these sites just need the scripts taking out if they have messed with my other data in some way its no big deal. And yeah yeah backups I know :) – Luckyl337 Apr 14 '12 at 10:14

score 0 · Answer 4 · answered Apr 13 '12 at 12:12

0

first Protect From SQL Injection

then, restore the data from a recent backup.

answered Apr 13 '12 at 12:12

Ashwini Verma

7,477
6
36
56

Thanks, thats a good start but its a little dated and Microsoft no longer maintain that page :/ I would rather download the database and use some kind of program to just strip out all the bad data and restore that if possible – Luckyl337 Apr 13 '12 at 12:18

asp.net - How to clean up after an SQL Injection Attack?

4 Answers4