If you're getting that stack trace and you're NOT on the local machine,
,then someone misconfig'd the web.config. Take a look at the Custom
Errors heading and make sure they're set to either ON or REMOTE. If
they're OFF, then anyone who generates a 500 will get a stack trace or
worse. I knew a dude once who studied up and studied up on SQL
Injection then asked me to test his site. While his queries were all
tight, he misconf'd the custom errors, so I got all his source code
anyhow.
Here's an interesting article on accidentally pushing debug code to
production too. Definitely something to be avoided.
http://www.aspnetresources.com/articles/debug_code_in_production.aspx
-----Original Message-----
From: bryan allott [mailto:homegrown@bryanallott.net]
Sent: Monday, November 28, 2005 2:43 PM
To: Jason binger; webappsec@securityfocus.com
Subject: Re: Simple to exploit SQL Injection ?
just a by-the-by...
although not a successful SQL injection attack, the error
message you're receiving as a public user already tell you a
little about their database...
Probably not too much to go with, but a better exception
message would have
been:
"Invalid credentials" or something equally generic and less revealing.
so probably also be on the lookout for other places where
more information is displayed than usual..
other famous .Net parser and other jit compile errors tell u
quite a bit about the filesystem :)
----- Original Message -----
From: "Jason binger" <cisspstudy@yahoo.com>
To: <webappsec@securityfocus.com>
Sent: Monday, November 28, 2005 2:49 AM
Subject: Simple to exploit SQL Injection ?
I am reviewing a .Net web application. When entering
xyz for a username and ' for a password into a form I
receive the following stack trace (extract):
System.Exception: Can't Load DataReader using SQL
string: 'SELECT * FROM users WHERE username = 'xyz'
AND password = '''' -- Unclosed quotation mark before
the character string '''. Line 1: Incorrect syntax
near '''.
Now I would have thought this would be easy to
exploit, but I can't bypass the logon page. xyz is a
valid username. Any ideas?
Cheers
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.362 / Virus Database: 267.13.8/184 - Release
Date: 27-Nov-05
