Hi Ahmed,
No need to type in caps :)
Of course, simply changing programming languages won't help at
all; sql injection doesn't care about language it's based on the lack of
validation on input. If they use .NET and force all sql-used inputs to
be validated appropriately then there will be no more issue with SQL
Injection, however simply changing languages *will not help at all*.
-- Michael
Ps: Just like writing this message in japanese or french wouldn't change
it from being wrong to right, or right to wrong :)
-----Original Message-----
From: Mohamed Ali [mailto:rxmohamed@hotmail.com]
Sent: Tuesday, 12 October 2004 6:23 PM
To: webappsec@securityfocus.com
Subject: aspx applictions SQL Injection
Hi all,
I did a full pen-test on my client's web application and almost I can
get all data and data dictionary information I need through exploiting
SQL injection vulnerabilities they have in many dynamic pages.
The question is when I discussed these issues with IT people they
recommend
not to solve any of them but just converting to .Net technology I'm
not
familiar with Net tech. but this recommendation sounds weird to me IS
THERE ANY WAY TO PROVE THAT THEIR RECOMMENDATION IS NOT ENOUGH TO
PREVERT UNAUTHRIZED ACCESS THROUGH SQL INJECTION (their platform IIS
,SQL Server and Oracle )
Any suggestions would be appreciated.
Thanks
Ahmed Rashad
IT Audit Manger
Experts.ae
_________________________________________________________________
Don't just search. Find. Check out the new MSN Search!
http://search.msn.com/
This email message and accompanying data may contain information that is
confidential and/or subject to legal privilege. If you are not the intended
recipient, you are notified that any use, dissemination, distribution or
copying of this message or data is prohibited. If you have received this email
message in error, please notify us immediately and erase all copies of this
message and attachments.
This email is for your convenience only, you should not rely on any information
contained herein for contractual or legal purposes. You should only rely on
information and/or instructions in writing and on company letterhead signed by
authorised persons.
