Sql injection attacks

Question

I have an asp.net site ... In recent days, I have seen in my logs that they are attacking me with sql injection, for example:

Exceptia: Error Caught in Application_Error event Error in: http://gramma.ro/Site/DetaliiProdus.aspx?c=m1&p=1465&s1=45&s2=79/**/or/**/ 1=@ @version))-- 

Of course, this will throw an exception, because I check the parameters before executing any sql query:

 Error Message:Input string was not in a correct format. 

For all these exceptions, I redirect the user to the page with a specific error.

Of course, these attacks do not affect me right now (I use the sql parameterized commands), but I take the ips and put them in the IIS-Ip address and domain restrictions so that ip can no longer access my site.

My question is: can I do anything else? It seems that this attacker, even I block his ip, is going and trying to use the same attack from another ip (I blocked about 6 ips in the last 3 days, which is pretty ugly ...). Can you suggest anything else I have to do?

UPDATE:. All these attacks put /**/or/**/ 1=@ @version instead of the value of the query parameter, so I am sure that the attack is not a random problem for users, but a real SQL injection attack. The problem is that these ips are from different places, so I can not report this to some Internet service providers or host companies ...

Answer 1

This will provide protection against the only request you show. To protect against SQL injection correctly, parameterize all queries as much as possible, check user input parameters.

In my code, I go further and throw exceptions on any unexpected querystrings, which makes the discovery of the API (this is what this attack is) much more complicated.

Add this to global.asax

 void Application_BeginRequest(object sender, EventArgs e) { if(HttpContext.Current.Request.Url.ToString().Contains("@@version")) { throw new HttpException(400,"Bad Request"); } } 

Answer 2

Use stored procedures for your application. This way you can prevent SQL injection. Because stored procedures accept only the limited parameters described by the developer.