-
-
My post will not get as much press as Slashdot, but here is some postings from sources at MS, including Bill Staples on the SQL Injection attacks that help clarify things.
Here is a post on forums.iis.net about this topic
http://forums.iis.net/t/1148917.aspx?PageIndex=1
For those who want to use Log parser to detect in your IISLogs if you've been hit, here are a few log parser examples.
'This will find all webpages that had sql injection. You can change the wording between the %% to look for a different string
logparser -i:iisw3c "select date,time,cs-uri-stem,cs-uri-query from <example.com> where cs-uri-query like '%CAST%'" -o:csv
'This will give you the first time your site was hit, if applicable.
logparser -i:iisw3c "select date,time,cs-uri-stem,cs-uri-query from <example.com> where cs-uri-query like '%1.js%'" -o:csv
'Download Log Parser 2.2
http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1287
Hope this helps,
Steve Schofield
Microsoft MVP - IIS
-
-
If you are an MVP, I'll be in Seattle / Redmond staying at the Sheraton for the 2008 MVP summit. See you there!
Steve Schofield
Microsoft MVP - IIS
-
-
Here is a script to pull all Windows Server 2008 servers out of your Active Directory and log to a text file. Just change the LDAP string.
Const ADS_SCOPE_SUBTREE = 2
Set fso = Wscript.CreateObject("Scripting.FileSystemObject")
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
"SELECT Name FROM 'LDAP://DC=example,DC=com' WHERE objectClass='computer' " & _
"and operatingSystemVersion = '6.0 (6001)'"
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst
Do Until objRecordSet.EOF
Wscript.Echo "Computer Name: " & objRecordSet.Fields("Name").Value
LogInfo objRecordSet.Fields("Name").Value
objRecordSet.MoveNext
Loop
set objCommand = Nothing
set objRecordset = Nothing
set objConnection = Nothing
' ---------------------------------------------------------------------------------------
' | Loginfo |
' ---------------------------------------------------------------------------------------
Sub LogInfo(strResult)
dim objFile, fso2
objFile = "output.txt"
If fso.FileExists(objFile) Then
Set objFile = fso.OpenTextFile(objFile, 8)
objFile.WriteLine strResult
Else
Set objFile = fso.CreateTextFile(objFile, True)
objFile.WriteLine strResult
End If
objFile.close
Err.clear
End Sub