[cancer10]

Hello,


I have heard a lot about SQL Injection. I was wondering how does an injector come to know about the table/column name when they cannot see the asp codes in a website?

Can someone explain plz?



Thanx

[End User]

Try here for a simple explanation:

http://www.securiteam.com/securityre...DP0N1P76E.html

there is also this one from the sans institue, they have some good information usually.

https://www2.sans.org/reading_room/w...ication/52.php

[MadDog]

SQL injection allows anyone to break a SQL statement and destroy your database.

The best way to prevent this is to strip anything you might put into a SQL statement.

A simple SQL Inject would be:

URL Should be: yourpage.asp?ID=1
But someone enters: yourpage.asp?ID=1;Drop Table TableName;
That would drop the table "TableName" from your database!

To prevent that, your number should be filtered, so you would use Clng or Cint

Code:

intItemNumber = Clng(Request("ID"))

strSQL = "SELECT * From TableName WHERE ID=" & ID & ";"

If your passing a string, you only need to filter out one thing, the ' character:

Code:

strString = Replace(Request("Name"), "'", "''")

strSQL = "SELECT * From TableName WHERE Name='" & strString & "';"

Now you should look up XSS hacks and how to prevent that if you allow user inputs.

[GO4TF4CE]

For additional security you can setup 2 different users for the database, one with full permissions for your CMS for example and the another for the front end of your site with limited permissions.

Our company now uses this as an extra precaution as we had a lot of foreign people trying to hack our sites.

[algorithm]

The idea of SQl injection is to convince the application to run SQL code that was not intended

The attacker can know the table names from the error messages (error (server failure) returned by the SQl server.

First apply blind SQl injection And some guess work will get you the error messages that will have useful information. From this information shown by the error messages ,one can have the database table names

Regards