June 2008 - Posts

• SQL Injection rule explaination of what is actually scanned by URLScan

  One of the things I was curious what URLScan actually scanned and how. What is just some server variables or what?! I asked Wade H from the IIS Team for further explaination. It is good to be aware when you are implementing URLScan 3.0 and sql injection...(read more) Posted Friday, June 27, 2008 10:52 AM from Steve Schofield Weblog | 1 Comments Filed under: sql injection

• Tool to help detect SQL Injection

  Here is a tool to help detect sql injections. You have to sign-up for the free tool, but it's worth it. http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2008/06/23/finding-sql-injection-with-scrawlr.aspx Hope this helps...(read more) Posted Friday, June 27, 2008 12:21 AM from Steve Schofield Weblog | (Comments Off) Filed under: sql injection

• URLScan 3.0 - help with sql injection attacks.

  For those supporting a Classic ASP and ASP.NET application, you probably have noticed an increase in sql injection attempts. Microsoft has released an updated URLScan 3.0. Here is the link to download URlScan version 3 beta for 32 bit or 64 bit . You...(read more) Posted Tuesday, June 24, 2008 11:55 PM from Steve Schofield Weblog | 1 Comments Filed under: IIS

• SQL Injection information for IIS admins and developers

  The sql injection that has came up is affecting several ASP and ASP.NET applications. Although the only way to prevent an attack is validate the code, hopefully these posts will provide some direction. I included some links that discuss this more. http...(read more) Posted Monday, June 23, 2008 12:51 AM from Steve Schofield Weblog | (Comments Off) Filed under: IIS, sql injection

• Powershell 2.0

  I''ve tried really hard to get excited about Powershell 1.0, it just hasn't stuck. Am I the only one?! :) However, (yes there is a however). The great thing about software, there is a 2.0 release sooner or later. I've made the committment to learn Powershell...(read more) Posted Sunday, June 22, 2008 11:35 PM from Steve Schofield Weblog | 1 Comments

• SMTP links for IIS

  I was answering a question @ http://forums.iis.net on SMTP scripting. I ran across a couple links I wanted to share. Programatically configure SMTP service on IIS to route mails to a domain http://blogs.msdn.com/mahjayar/archive/2004/11/08/254202.aspx...(read more) Posted Saturday, June 07, 2008 8:57 PM from Steve Schofield Weblog | (Comments Off) Filed under: SMTP

• IIS7 - post #69 - Remember to disable SSL 2.0

  I'm not certain why SSL 2.0 isn't disabled on Windows Server 2008 by default, but here is the KB article to remember to do that on your system. http://support.microsoft.com/kb/187498 How to test if you accept SSL 2.0 using IE is go to Internet options...(read more) Posted Friday, June 06, 2008 12:05 AM from Steve Schofield Weblog | (Comments Off)