Solved

How to detect and clean an SQL Injection

Posted on 2008-06-22
2
1,214 Views
Last Modified: 2008-10-27
Hi,

I believe that we have been hit with an SQL injection attack. At the top of our website page it has the following;

<script src=http://www.chinabnr.com/b.js></script>

Can you tell me how to detect and clean if this is the case.??

TIA

Lee
0
Comment
Question by:Lee025_
2 Comments
 
LVL 12

Expert Comment

by:patrikt
ID: 21844359
If it is realy comming from outside atack you have to fix all hole in your applications.
Every textbox without validataion can be hole to SQL if it is used insorrectly.
I can give you guiodelines for this but you have to do¨cleaning manualy.

As I know there is no automatic test tool, but somone may know about it.

Patrik
0
 
LVL 1

Accepted Solution

by:
rezen earned 500 total points
ID: 21849587
Same thing happened to me. Damn Chinese hackers!

What I did was run the SQL code here: http://alexduggleby.com/2008/05/09/off-topic-t-sql-replace-all-occurrences-in-all-columns-in-all-tables/

This allowed me to generate a sql script that parses all my tables and erases all the the injected text in all character storing columns.

NOTE:
The code on the guy's site is not entirely working. I had to erase a smiley tag and fix the comments. Once it ran, it generated all the update statements needed. Make sure you tweak the code to replace the '<script...' with an empty string: ''
Also note that this does not clean NTEXT columns, which are affected by the SQL Injection. What I did was convert all my NTEXT columns to VARCHAR(MAX) [supported in SQL Server 2005].

Good luck, and don't forget to fix your vulnerabilities.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Having an SQL database can be a big investment for a small company. Hardware, setup and of course, the price of software all add up to a big bill that some companies may not be able to absorb.  Luckily, there is a free version SQL Express, but does …
Ever wondered why sometimes your SQL Server is slow or unresponsive with connections spiking up but by the time you go in, all is well? The following article will show you how to install and configure a SQL job that will send you email alerts includ…
Familiarize people with the process of retrieving data from SQL Server using an Access pass-thru query. Microsoft Access is a very powerful client/server development tool. One of the ways that you can retrieve data from a SQL Server is by using a pa…
Via a live example, show how to backup a database, simulate a failure backup the tail of the database transaction log and perform the restore.

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question