Hey there,

I've got an issue that I'm trying to resolve for a client and I'm hoping that someone here can help...

There's this nasty SQL injection attack out there that DNN does not appear to be suceptable to which is great. But I'm trying to modify my SiteUrls.config to detect it so I redirect the zombies to a page so that I can track the incidences and respond with a page that looks like the attack works so the bots will stop hitting the portal.

The SQL attack is detailed here:

http://www.bloombit.com/Articles/2008/05/ASCII-Encoded-Binary-String-Automated-SQL-Injection.aspx

But the short version is that what I want to do is test the querystring of any request to any of the portals for the string ";DECLARE" and if it's found redirect to a specific page "http://www.mydomain/devnull.html"

I've managed to successfully match strings a the page level:

        <RewriterRule>
            <LookFor>.*/Fred.aspx</LookFor>
            <SendTo>http://www.mydomain.org/diezombiedie.html</SendTo>
        </RewriterRule>

But I can't seem to figure out the synatax to match on the querystring of the request. Something like:

        <RewriterRule>
            <LookFor>*;DECLARE*</LookFor>
            <SendTo>http://www.ifdf.org/filenotfound.html</SendTo>
        </RewriterRule>

When the request looks something like:

http://www.mydomain.org/LinkClick.aspx?fileticket=Jwu4XKtCo48%3D&tabid=127&mid=526&forcedownload=true;DECLARE

Thanks for reading.

Dave

Brandon,

I suspected that the issue lay with my ignorance of regex.

I'll Google up a primer and get cracking.

Thanks for your prompt reply and point in the right direction.

With much appreciation,

Dave

Dave,

You should be able to do this with a single RegEx, using the example provided by the previous poster.

I also have a RegEx tester tool available at http://www.iowacomputergurus.com

The key is to identify the common elements

* It will always be in the querystring (Always after a ?)
* It will always start wtih the word DECLARE
* It could be at the beginning or end of the querystring

With these criteria you can easily build a RegEx that will match correctly.

If you need further assistance please feel free to e-mail me at msellers@iowacomputergurus.com as I do not get forum notifications here, and with as many posts as I reply to I can't always get back to check on the threads.