1

I'm wondering if it is possible to block SQL Injection Attacks on an ASP.Net login form using IIS Request Filtering?

Basically we have a legacy ASP.Net application that we don't have all the source code to, and it has been detected through a penetration test that it is vulnerable to Injection Attacks.

I've already put in place the following Request Filtering Rule to block injection attacks from query strings, but I'm still trying to figure out how to block this type of attack from the text fields on the login page.

<requestFiltering>
    <filteringRules>
        <filteringRule name="SQLInjectionQuery" scanUrl="false" scanQueryString="true">
            <appliesTo>
                <clear />
                <add fileExtension=".aspx" />
            </appliesTo>
            <denyStrings>
                <clear />
                <add string="--" />
                <add string=";" />
                <add string="/*" />
                <add string="@" />
                <add string="char" />
                <add string="alter" />
                <add string="begin" />
                <add string="cast" />
                <add string="create" />
                <add string="cursor" />
                <add string="declare" />
                <add string="delete" />
                <add string="drop" />
                <add string="end" />
                <add string="exec" />
                <add string="fetch" />
                <add string="insert" />
                <add string="kill" />
                <add string="open" />
                <add string="select" />
                <add string="sys" />
                <add string="table" />
                <add string="update" />
                <add string="waitfor" />
                <add string="delay" />
            </denyStrings>
            <scanHeaders>
                <clear />
            </scanHeaders>
        </filteringRule>
    </filteringRules>
</requestFiltering>

I tried adding scanAllRaw="true" to the filteringRule element, but it didn't give the desired result. I was still able to run a username' WAITFOR DELAY '0:0:10'-- attack to detect the vulnerability.

I know that the best way to fix this is through the code, but much of the bad code is packaged into a dll that we don't have the source code to, so at the moment I'm trying to find an alternate way to fix this.

Any suggestion are appreciated

Michael
  • 8,362
  • 6
  • 61
  • 88
John-Rock Bilodeau
  • 377
  • 5
  • 15
  • Sounds like you need a WAF (web application firewall). Have you considered a CDN service like cloudflare that includes a WAF? (this approach will require you restrict access to the app to just cloudflares IPs to avoid attackers finding your server by IP). Also theres several WAF products you can manage yourself either as a module running in the site, or running a dedicated machine infront of your app. Depending on your hosting requirements, AWS has a PaaS WAF if thats an option and you can buy commercially produced rulesets for the AWS WAF. – MisterSmith May 10 '18 at 21:19
  • Assemblies can be disassembled. – Lex Li May 10 '18 at 22:57
  • [Current wisdom](https://stackoverflow.com/a/40509565/241211) is "No." – Michael May 31 '19 at 12:23

0 Answers0