Keeping the querystring-injectors out

Snitz™ Forums 2000
https://forum.snitz.com/forumTopic/Posts/68980?pagenum=1
05 November 2025, 03:51

Topic

MarcelG
Keeping the querystring-injectors out
16 October 2009, 07:39


I'm a bit paranoia when it gets to websitesecurity. I often see people active on my websites who are trying to perform strange pagerequests, with stuff like TOPIC_ID=100+1+1+AND' etc. To keep those people out (and send them a message) I've implemented the following lines of code in config.asp, before the database is even opened. What it does is this:
- it checks for the various numeric querystrings used by Snitz to see if they are numeric or not. - if they're not empty but also not numeric, the user is redirected to a 401 page, which tells them that they're busted.
Example: http://oxle.com/topic.asp?topic_id=6205+lamehackattack$
(Warning, my 401 page is pretty rude...cool)
You can extend this with custom numeric querystrings used on your forum, for for example the blogmod, download mods etc.
Code:
'let us keep out the querystring injectors before we open up the SQL connection
if Request.QueryString("id") <> "" and IsNumeric(Request.QueryString("id")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("whichpage") <> "" and IsNumeric(Request.QueryString("whichpage")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("TOPIC_ID") <> "" and IsNumeric(Request.QueryString("TOPIC_ID")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("REPLY_ID") <> "" and IsNumeric(Request.QueryString("REPLY_ID")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("forum_id") <> "" and IsNumeric(Request.QueryString("forum_id")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if
if Request.QueryString("cat_id") <> "" and IsNumeric(Request.QueryString("cat_id")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
end if

'end of the querystring injectors protection
This code is put in config.asp above the line that starts with this:
Code:
dim strDBType,

Make sure you create a 401.asp page so that the viewer is notified he's being watched. Or redirect to something else instead, that's also possible of course.
I've tried to get as many numeric querystrings in here as I could think of, but if you know one that I've missed, please let me know.
***** EDIT: code fixed, Carefree spotted a missing end if*****

 

Replies ...

HuwR
16 October 2009, 10:29


your forum should be perfectly safe without the need to do this, Snitz already ensures that a valid number is passed in order to prevent injection
MarcelG
16 October 2009, 10:34


Yes, I know. But still, I want to send them a message....wink
BTW, I seem to have broken it, so I'm trying to figure out what's happening now...strange.
bobby131313
16 October 2009, 10:35


I like redirecting buttheads here. tongue
HuwR
16 October 2009, 12:07


Originally posted by MarcelG
Yes, I know. But still, I want to send them a message....wink
BTW, I seem to have broken it, so I'm trying to figure out what's happening now...strange.
looks like it's working to me
Etymon
16 October 2009, 12:32


Looks good.
I tried ... http://oxle.com/topic.asp?topic_id=6205&whichpage=-1+1+1+AND and got flagged. smile
Podge
16 October 2009, 13:12


Marcel, if you want to be thorough you should add a check to test if the value is numeric and greater than zero. Technically -1 is numeric but not valid as a Snitz querystring AFAIK.
AnonJr
16 October 2009, 13:57


Originally posted by Podge
Marcel, if you want to be thorough you should add a check to test if the value is numeric and greater than zero. Technically -1 is numeric but not valid as a Snitz querystring AFAIK.
It is valid for the whichpage variable IIRC...
HuwR
17 October 2009, 03:07


yes, -1 is valid for the whichpage variable
Carefree
17 October 2009, 10:48


Code:

if Request.QueryString("whichpage") <> "" and IsNumeric(Request.QueryString("whichpage")) = false then
Response.Status="401 Access denied"
response.redirect "401.asp"
Response.End
You're missing an
Code:
end if
MarcelG
17 October 2009, 11:41


No I'm not.
wink
Carefree
15 December 2012, 10:14


LOL, revisiting old topics and clicked your 401 link.
Giumer
15 December 2012, 16:11


Originally posted by Carefree
LOL, revisiting old topics and clicked your 401 link.

mate you have 1 page 401.asp for me ?? thx
Carefree
26 December 2012, 02:59


OK, I wrote one inspired by Marcel's. I captured the query strings (even if used on pages which don't contain forms or queries, e.g. default.asp?id='afab) and they are displayed on the 401 page. If the query contains an illegal character (for use in SQL injection attempts), the comment is changed to reflect that. I included an image appropriate to the occasion. You can get a copy on SnitzBitz.
Giumer
26 December 2012, 05:19


ok !! Grazie !! test !! http://giumer.it/forum/topic.asp?topic_id=6205+lamehackattack$
HuwR
26 December 2012, 07:57


strictly speaking you should be issuing a 400 Bad Request not a 401 Unauthorized
Giumer
26 December 2012, 11:26


but the page does not mean 404 page not found?
Carefree
26 December 2012, 12:31


Originally posted by Giumer
but the page does not mean 404 page not found?

No. The page is found, but the query string passed isn't allowed. If you want a custom 404 page, that's a whole different topic.
HuwR
26 December 2012, 13:01


Unauthorized normally implies it has failed authentication, but in fact you are failing it due to bad request parameters being passed not because it is failing any kind of authentication.
Carefree
30 December 2012, 00:30


Originally posted by Giumer
ok !! Grazie !! test !! http://giumer.it/forum/topic.asp?topic_id=6205+lamehackattack$

Works perfectly (in my opinion LOL). Testing it as "http://giumer.it/forum/default.asp?id=!#test" results in the attempted hack message.
© 2000-2021 Snitz™ Communications