Browse by Tags

• IIS

• URLScan 3.0 rtw (release to web) available

  I have to give kudo's to the Microsoft IIS team for updating URLScan to help block automated sql injection attacks. Especially to Wade Hilmo and Nazim Lala . They have been very responsive when it came to involving the community (Thanks guys for the w3c...(read more) Posted Thursday, August 21, 2008 5:53 AM from Steve Schofield Weblog | 1 Comments Filed under: IIS, sql injection

• SQL Injection rule explaination of what is actually scanned by URLScan

  One of the things I was curious what URLScan actually scanned and how. What is just some server variables or what?! I asked Wade H from the IIS Team for further explaination. It is good to be aware when you are implementing URLScan 3.0 and sql injection...(read more) Posted Friday, June 27, 2008 10:52 AM from Steve Schofield Weblog | 1 Comments Filed under: sql injection

• Tool to help detect SQL Injection

  Here is a tool to help detect sql injections. You have to sign-up for the free tool, but it's worth it. http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2008/06/23/finding-sql-injection-with-scrawlr.aspx Hope this helps...(read more) Posted Friday, June 27, 2008 12:21 AM from Steve Schofield Weblog | (Comments Off) Filed under: sql injection

• SQL Injection information for IIS admins and developers

  The sql injection that has came up is affecting several ASP and ASP.NET applications. Although the only way to prevent an attack is validate the code, hopefully these posts will provide some direction. I included some links that discuss this more. http...(read more) Posted Monday, June 23, 2008 12:51 AM from Steve Schofield Weblog | (Comments Off) Filed under: IIS, sql injection