ASP – ANTI-SQL INJECTION

fix_injection.asp
<%
‘  fix_injection.asp

‘  Author: Nazim Lala, Codificar (https://www.codificar.com.br)
‘  Modified Date: 26-05-2008
‘  This is the include file to use with your asp pages to
‘  validate input for SQL injection.
Dim BlackList, ErrorPage

‘  Below is a black list that will block certain SQL commands and
‘  sequences used in SQL injection will help with i\0 putaput sanitization

‘  However this is may not suffice, because:
‘  1) These might not cover all the cases (like encoded characters)
‘  2) This may disallow legitimate input

‘  Creating a raw sql query strings by concatenating user input is
‘  unsafe programming practice. It is advised that you use parameterized
‘  SQL instead. Check http://support.microsoft.com/kb/q164485/ for information
‘  on how to do this using ADO from ASP.

‘  Moreover, you need to also implement a white list for your parameters.
‘  For example, if you are expecting input for a zipcode you should create
‘  a validation rule that will only allow 5 characters in [0-9].

BlackList = Array(“–“, “;”, “/*”, “*/”, “@@”, “@”,_
“char”, “nchar”, “varchar”, “nvarchar”,_
“alter”, “begin”, “cast”, “create”, “cursor”,_
“declare”, “delete”, “drop”, “end”, “exec”,_
“execute”, “fetch”, “insert”, “kill”, “open”,_
“select”, “sys”, “sysobjects”, “syscolumns”,_
“table”, “update”)
‘  Populate the error page you want to redirect to in case the
‘  check fails.
ErrorPage = “/fix_injection/error_page.asp”
”””””””””””””””””””””””””’
‘  This function does not check for encoded characters
‘  since we do not know the form of encoding your application
‘  uses. Add the appropriate logic to deal with encoded characters
‘  in here
”””””””””””””””””””””””””’
Function CheckStringForSQL(str)
On Error Resume Next
Dim lstr
‘ If the string is empty, return true
If ( IsEmpty(str) ) Then
CheckStringForSQL = false
Exit Function
ElseIf ( StrComp(str, “”) = 0 ) Then
CheckStringForSQL = false
Exit Function
End If
lstr = LCase(str)
‘ Check if the string contains any patterns in our
‘ black list
For Each s in BlackList
If ( InStr (lstr, s) <> 0 ) Then
CheckStringForSQL = true
Exit Function
End If
Next
CheckStringForSQL = false
End Function
Public Function CheckString (strEntrada)
Dim objRegExp
Set objRegExp = Server.CreateObject(“VBScript.RegExp”)
Dim strExpressao
strExpressao = “(<\s*/*(script|object|applet|embed|form|img)\s*.*>)” ‘< [/] script ou object ou applet ou embed ou form >
strExpressao = strExpressao & “|” & “(\s+eval\s*\()” ‘ EVAL(
strExpressao = strExpressao & “|” & “(\s+event\s*=)” ‘ Event=
strExpressao = Replace(strExpressao, “<“, “(<|%60|<)”) ‘Garantir < ou < em HTML ENCODE
strExpressao = Replace(strExpressao, “>”, “(>|%62|>)”) ‘Garantir > ou > em HTML ENCODE
objRegExp.IgnoreCase = True ‘Ignorar caixa “ALTA” ou “baixa”
objRegExp.Global = False ‘Para na hora que encontrar (velocidade)
objRegExp.Pattern = strExpressao ‘Define a expressão
CheckString = objRegExp.Test(strEntrada) ‘testa
Set objRegExp = Nothing
End Function
”””””””””””””””””””””””””’
‘  Check forms data
”””””””””””””””””””””””””’
Dim s
For Each s in Request.Form
If ( CheckString(Request.Form(s)) ) Then
‘ Redirect to an error page
Response.Redirect(ErrorPage)
End If
Next
”””””””””””””””””””””””””’
‘  Check query string
”””””””””””””””””””””””””’
For Each s in Request.QueryString
If ( CheckString(Request.QueryString(s)) ) Then
‘ Redirect to error page
Response.Redirect(ErrorPage)
End If
Next
”””””””””””””””””””””””””’
‘  Check cookies
”””””””””””””””””””””””””’
For Each s in Request.Cookies
If ( CheckString(Request.Cookies(s)) ) Then
‘ Redirect to error page
Response.Redirect(ErrorPage)
End If
Next
”””””””””””””””””””””””””’
‘  Add additional checks for input that your application
‘  uses. (for example various request headers your app
‘  might use)
”””””””””””””””””””””””””’
%>
error_page.asp
<%@LANGUAGE=”VBSCRIPT” CODEPAGE=”65001″%>
<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Transitional//EN” “http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd”>
<html xmlns=”http://www.w3.org/1999/xhtml”>
<head>
<meta http-equiv=”Content-Type” content=”text/html; charset=utf-8″ />
<title>SQL INJECTION</title>
<style type=”text/css”>
<!–
.style1 {color: #FF0000}
–>
</style>
</head>
<body>
<h1 class=”style1″>Tentativa de exploração de falha de segurança!!!</h1>
<p class=”style1″>Verifique os dados inseridos.</p>
</body>
</html>
os Arquivos fix_injection.]]>

Leave a comment