SQL Injection is probably a huge problem today, especially given all the old classic ASP websites sitting around on the internet that were built when ASP Website Security was less discussed and the frameworks and tools themselves didn't offer much help with SQL Injection like you get with ASP.NET.
Over the past few months I have been involved in a pretty large conversion of a classic ASP and VBScript Website to ASP.NET Webforms and C#. The website had all kinds of problems wth respect to SQL Injection and Cross-Site Scripting that I am surprised it made it all these years with no incidences.
In this case the lack of parameterized queries, proper input validation, and HTML encoding was pretty obvious. There were hackish attempts to detect malicious input in form values and querystrings, but they were nothing compared to using Regular Expressions and various validation frameworks, like the Enterprise Library Validation Application Block.
To be fair this website had been running for years and I don't know anyone worth their salt that wouldn't look back at their own code after several years and think of a number of improvements. The volatile topics of ASP.NET Website Security is such a moving target that it is hard to stay up on the best practices.
Microsoft Source Code Analyzer for SQL Injection Tool
While I was surfing today I bumped into a tool by Microsoft that might be of value to those web developers dealing with maintaining, improving, or threat modeling classic ASP websites, called Microsoft Source Code Analyzer for SQL Injection Tool.
It only targets Classic ASP Websites that use VBScript. It will attempt to detect SQL Injection vulnerabilities in the code. Note I have not used it as I have no need for it at this moment, but I definitely would have given it a try if I had know about it a couple months ago when neck keep into ASP and VBScript Code.
The tool will apparently generate the following warnings if SQL Injection problems are detected with the page:
- 80400 - Possible SQL injection vulnerability through data that is read from the Request object without any input validation. These warnings are very likely bugs that must be fixed.
- 80406 - Possible SQL injection vulnerability through data that is read from the Request object where the input is passed through some unknown function calls that might perform data validation. If there is no data validation performed inside the function call, these are very likely bugs. Otherwise, these are false positives.
- 80403 - Possible SQL injection vulnerability through data that comes from a back-end server. If the data is controlled by an end-user through some other Web site, these are very likely bugs. However, if the data is well trusted, these may not be bugs. It is still a good practice to parameterize these queries as part of a defense-in-depth strategy.
- 80407 - Possible SQL injection vulnerability through data that comes from a back-end server and that is passed through some unknown function calls. If the data is controlled by an end-user through some other Web sites, and if there is no data validation performed on this data, these are very likely bugs.
- 80420 - Possible SQL injection vulnerability through function parameters. These warnings are generated at function scope. Therefore, if the function parameter values come from trusted sources, these are false positives. If the parameter values are controlled by end-users, these are very likely bugs. You can use the __sql_pre_validated annotation on the function parameters to detect whether end-users can reach this code.
- 80421 - Possible SQL injection vulnerability through function parameters, and the function parameters are passed through some unknown function calls that might perform data validation. You can use the __sql_pre_validated annotation on the function parameters and __sql_validate on the validation function to detect whether end-users can reach this code.
If you are in charge of any Classic ASP VbScript websites and want to double-check your SQL Injection vulnerabilities, it could never hurt to use the Microsoft Source Code Analyzer for SQL Injection Tool. Better safe than sorry :)
Download it here.
SQL Injection Tutorials