| T O P I C R E V I E W |
| MarcelG |
Posted - 16 October 2009 : 07:39:20
I'm a bit paranoia when it gets to websitesecurity.
I often see people active on my websites who are trying to perform strange pagerequests, with stuff like TOPIC_ID=100+1+1+AND' etc.
To keep those people out (and send them a message) I've implemented the following lines of code in config.asp, before the database is even opened.
What it does is this:
- it checks for the various numeric querystrings used by Snitz to see if they are numeric or not.
- if they're not empty but also not numeric, the user is redirected to a 401 page, which tells them that they're busted.
Example: http://oxle.com/topic.asp?topic_id=6205+lamehackattack$
(Warning, my 401 page is pretty rude... )
You can extend this with custom numeric querystrings used on your forum, for for example the blogmod, download mods etc.
'let us keep out the querystring injectors before we open up the SQL connection
if Request.QueryString("id") <> "" and IsNumeric(Request.QueryString("id")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("whichpage") <> "" and IsNumeric(Request.QueryString("whichpage")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("TOPIC_ID") <> "" and IsNumeric(Request.QueryString("TOPIC_ID")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("REPLY_ID") <> "" and IsNumeric(Request.QueryString("REPLY_ID")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("forum_id") <> "" and IsNumeric(Request.QueryString("forum_id")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("cat_id") <> "" and IsNumeric(Request.QueryString("cat_id")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
'end of the querystring injectors protection
This code is put in config.asp above the line that starts with this:
dim strDBType,
Make sure you create a 401.asp page so that the viewer is notified he's being watched.
Or redirect to something else instead, that's also possible of course.
I've tried to get as many numeric querystrings in here as I could think of, but if you know one that I've missed, please let me know.
***** EDIT: code fixed, Carefree spotted a missing end if***** |
| 15 L A T E S T R E P L I E S (Newest First) |
| Carefree |
Posted - 30 December 2012 : 00:30:22
quote:
Originally posted by Giumer
ok !! Grazie !! test !! http://giumer.it/forum/topic.asp?topic_id=6205+lamehackattack$
Works perfectly (in my opinion LOL). Testing it as "http://giumer.it/forum/default.asp?id=!#test" results in the attempted hack message. |
| HuwR |
Posted - 26 December 2012 : 13:01:15
Unauthorized normally implies it has failed authentication, but in fact you are failing it due to bad request parameters being passed not because it is failing any kind of authentication. |
| Carefree |
Posted - 26 December 2012 : 12:31:03
quote:
Originally posted by HuwR
strictly speaking you should be issuing a 400 Bad Request not a 401 Unauthorized
Maybe so ... but if someone is trying to hack me, I think "unauthorized" is precisely what I want to say.
quote:
Originally posted by Giumer
but the page does not mean 404 page not found?
No. The page is found, but the query string passed isn't allowed. If you want a custom 404 page, that's a whole different topic. |
| Giumer |
Posted - 26 December 2012 : 11:26:59
but the page does not mean 404 page not found? |
| HuwR |
Posted - 26 December 2012 : 07:57:46
strictly speaking you should be issuing a 400 Bad Request not a 401 Unauthorized |
| Giumer |
Posted - 26 December 2012 : 05:19:09
ok !! Grazie !! test !! http://giumer.it/forum/topic.asp?topic_id=6205+lamehackattack$ |
| Carefree |
Posted - 26 December 2012 : 02:59:18
OK, I wrote one inspired by Marcel's. I captured the query strings (even if used on pages which don't contain forms or queries, e.g. default.asp?id='afab) and they are displayed on the 401 page. If the query contains an illegal character (for use in SQL injection attempts), the comment is changed to reflect that. I included an image appropriate to the occasion. You can get a copy on SnitzBitz. |
| Giumer |
Posted - 15 December 2012 : 16:11:19
quote:
Originally posted by Carefree
LOL, revisiting old topics and clicked your 401 link.
mate you have 1 page 401.asp for me ?? thx |
| Carefree |
Posted - 15 December 2012 : 10:14:58
LOL, revisiting old topics and clicked your 401 link. |
| MarcelG |
Posted - 17 October 2009 : 11:41:49
No I'm not.
 |
| Carefree |
Posted - 17 October 2009 : 10:48:08
quote:
if Request.QueryString("whichpage") <> "" and IsNumeric(Request.QueryString("whichpage")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
You're missing an end if |
| HuwR |
Posted - 17 October 2009 : 03:07:14
yes, -1 is valid for the whichpage variable |
| AnonJr |
Posted - 16 October 2009 : 13:57:06
quote:
Originally posted by Podge
Marcel, if you want to be thorough you should add a check to test if the value is numeric and greater than zero. Technically -1 is numeric but not valid as a Snitz querystring AFAIK.
It is valid for the whichpage variable IIRC... |
| Podge |
Posted - 16 October 2009 : 13:12:52
Marcel, if you want to be thorough you should add a check to test if the value is numeric and greater than zero. Technically -1 is numeric but not valid as a Snitz querystring AFAIK. |
| Etymon |
Posted - 16 October 2009 : 12:32:28
Looks good.
I tried ... http://oxle.com/topic.asp?topic_id=6205&whichpage=-1+1+1+AND and got flagged.  |
