SQL Injection Attacks

Some of you may have noticed (hopefully not) that your sites or sites you visit have been victims of a SQL Injection attack that is referring to scripts at either wowyeye.cn or direct84.com.  It primarily works against sites that have SQL Server as a database and seems to be targeting primarily ASP and ASP.Net sites.  I have seen a few references to PHP sites and the like, but not many.

There is not a lot of information out there about this, but the best page I have found describing the problem is here: http://hackademix.net/2008/04/26.  I am not going to rehash everything on that page, but if you are uncertain if you have been hacked, I have taken the script that is behind this and modified it for the powers of Good.

DROP TABLE #SCRIPTTABLE  
GO

CREATE TABLE #SCRIPTTABLE (TABLENAME VARCHAR(200), COLUMNNAME VARCHAR(200),RECORDCOUNT INT)

DECLARE @T VARCHAR(255), @C VARCHAR(255);  
DECLARE TABLE_CURSOR CURSOR FOR  
SELECT A.NAME, B.NAME  
FROM SYSOBJECTS A, SYSCOLUMNS B  
WHERE A.ID = B.ID AND A.XTYPE = 'U' AND  
(B.XTYPE = 99 OR  
B.XTYPE = 35 OR  
B.XTYPE = 231 OR  
B.XTYPE = 167);

OPEN TABLE_CURSOR;  
FETCH NEXT FROM TABLE_CURSOR INTO @T, @C;  
WHILE (@@FETCH_STATUS = 0) BEGIN  
PRINT @T + ' ' + @C  
EXEC(  
'INSERT INTO #SCRIPTTABLE SELECT ''' + @T + ''',''' + @C + ''', COUNT(*) FROM [' + @T + '] WHERE [' + @C + '] LIKE ''%<SCRIPT%'''  
);  
FETCH NEXT FROM TABLE_CURSOR INTO @T, @C;  
END;  
CLOSE TABLE_CURSOR;  
DEALLOCATE TABLE_CURSOR;

SELECT * FROM #SCRIPTTABLE WHERE RECORDCOUNT > 0

I hope this can be of use to somebody.  I encourage you to check your database to see if you have been attacked and are not aware.  I also encourage you to use the best practices out there and make sure that your code is as protected against these kinds of attacks as you are able.

Good Night, and Good Luck.

*UPDATE:http://www.0×000000.com/?i=556 has a lot of good information regarding this attack. 600,000+ sites have been hit now.

Exploring WCF

I have been learning Windows Communication Foundation (WCF) recently.  While there are a LOT of frustrations involved with it, it is leaps and bounds better than what was previously available in the .Net world.

One thing I have discovered about WCF though is that there is precious little information about it available (in comparison to other .Net related topics) .  With that in mind, I thought I would start sharing some of the things that I am learning.

First of all WCF does its work through contracts.  The two main types of contracts that we’ll focus on here are Service Contracts, Operation Contracts, and Data Contracts.  A Service Contract describes which operations the client can perform on the service. Operation Contracts expose a method as a operation to perform as part of the service. Data Contracts define which data types are passed to and from the service.

The contracts are applied to your classes, methods, variables as attributes.
For instance:

[ServiceContract] 
interface ISample { 
    //Will be included in the service 
    [OperationContract] 
    string SayHelloSample(string name); 

    //Not included as part of the service 
    string SayGoodbyeSample(string name); 
}

In the above example, we are defining an interface for a service and exposing SayHelloSample as a operation for that service.  Only classes/interfaces with the ServiceContract attribute and methods with OperationContract will be recognized by WCF.

So, now that we’ve covered some of the basics, let’s jump into a project…

Using Visual Studio Click on File + > + New Project.
Choose your favorite language and the Select Web in the tree and select WCF Service Application
Visual Studio will stub out a service for you automatically.

You will have 3 files for each service you create.

  • An Interface for the service – ISample.cs
    It is generally considered best practice (and in fact WCF was designed with this in mind) to define your contracts in a separate interface that you then use to implement your service in a separate class.
  • The Service file itself – Sample.svc
    The “visible” file people will connect to when calling your service
  • The Code-Behind for the Service – Sample.svc.cs
    This is where you will code the behavior for the operations defined in the contract interface.****

Visual Studio implements the infamous “Hello World” to lay out a simple service for you to start from.

Let’s start by examining the interface.  The first thing to notice will be the namespaces that are imported to support WCF (System.Runtime.Serialization and System.ServiceModel).  If you are going to add contracts to any existing classes or objects you may have, then you will need to make sure these two namespaces are included in your using/imports.

The interface defined here will have two methods: GetData and GetDataUsingDataContract.  Given the similarity to the previous interface sample I have already shown, I won’t write out the code here, but notice that the Service and Operation contract attributes are on the interface and methods.

Under the interface you should see a class defined called CompositeType.  Here is an example of a Data Contract.

[DataContract] 
public class CompositeType { 
    bool boolValue = true; 
    string stringValue = "Hello "; 
    
    [DataMember] 
    public bool BoolValue { 
        get { return boolValue; } 
        set { boolValue = value; } 
    } 

    [DataMember] 
    public string StringValue { 
        get { return stringValue; } 
        set { stringValue = value; } 
    } 
}

You will notice the DataContract attribute applied to the class.  This is telling WCF that we want this class/struct to be part of our service contract and to serialize it for incoming/outgoing messages. Inside the class/struct itself, for each property / variable that we would like WCF to take not of and serialize, we decorate it with the DataMember attribute.  Much like with the OperationContracts, anything that does NOT have the DataMember attribute will be ignored by WCF.

Looking at the code behind that was generated for our service, we will see that it is inheriting from the contract interface.  Notice here that because the contracts were already specified in the interface, we do not specify them here on the class itself.

public class Sample : ISample { 
    public string GetData(int value) { 
        return string.Format("You entered: {0}", value); 
    } 

    public CompositeType GetDataUsingDataContract(CompositeType composite) { 
        if (composite.BoolValue) { 
            composite.StringValue += "Suffix"; 
        } 
        return composite; 
    } 
}

When GetDataUsingDataContract is called, WCF will take care of serializing the CompositeType class to the appropriate format depending on what kind of service you are developing.  In this case, XML. Also, be sure to open the web.config and look at the new system.ServiceModel section at the bottom.  This is where the service gets exposed/defined and will be where you will configure the security and accessibility of your service.  I will be writing more on this in the future.

As you can imagine, if you have existing code already written with custom objects / methods, by simply adding the appropriate attributes, it becomes very simple to expose them via WCF.

I highly encourage everyone to dig into WCF and poke around.  It is an incredibly robust and powerful framework and is a definite step forward for .Net based services.

Spaghetti with Meat Sauce

Ingredients:

  • 1lb of ground beef
  • 2 large Prego (traditional)
  • 1lb of Italian sausage
  • 4 slices of bacon
  • 1 package of sliced mushrooms (~2 cups)
  • 1-2 tblsp of minced/diced garlic
  • 1 tbsp. butter
  • 1 cup red wine (merlot/shiraz/chianti/etc)
  • fresh basil
  • oregano
  • garlic powder
  • onion powder

Instructions:

Note:  This will make a LOT of meat sauce, so either fiddle around with the proportions, or be prepared to feed a lot of people / have leftovers.

In a LARGE pot (or crock pot), pour both bottles of Prego sauce and combine 2 minced basil leaves, a large sprinkling of dried oregano, and a pinch or two of salt and start on a very slow simmer for 4 hours.

In a large skillet, combine the butter, garlic and bacon.  When the bacon is mostly reduced, add in the mushrooms and sauté the mushrooms.  When the mushrooms are nearly finished, pour the wine in and continue to cook until the wine is mostly reduced.

Leaving the grease and wine in the saucepan, carefully scoop the mushrooms and bacon into the sauce.

In the saucepan mix the beef and the sausage and sprinkle with onion powder, garlic powder, and salt (to taste). Once the meat is cooked, drain off all the oil and combine the meat into the sauce.

Check on the sauce every 15-30 minutes and stir completely to make sure nothing is sticking to the bottom or sides as well as mix the sauce that has bubbled to the top back into the sauce.

After the sauce has simmered for ~3.5 hours, start cooking the noodles.

WPF: Element State Binding

I’ve been working with WPF lately.  Partly for work, but mostly to teach myself while at the same time being productive.  I am definitely one of those people that learns best by doing.

I have been working on adding some encryption to a application recently and I am making a form that will allow the user to enter a password that will be used for the encryption/decryption process.

On the form that I made, I had a checkbox to determine whether they even want to use encryption at all, as well as two password boxes for the password and the confirmation.  I wanted to make it such that when they clicked the checkbox that it would enable the password fields and disable them when the checkbox was unchecked.  Essentially tie the IsEnabled property of the PasswordBox’s to the IsChecked property of the CheckBox.

Well, I could tie a method to the Checked event of the CheckBox, and then adjust the PasswordBoxes accordingly, or I could do it the WPF way and use Binding to tie the elements together to one another.

Opting for the latter (since I am trying to learn after all), I dug around in my WPF book and in short order, had the answer.

Assuming that the CheckBox is named checkbox1:

<PasswordBox Name="Password1" Margin="0,5" Width="200" IsEnabled="{Binding ElementName=checkbox1, Path=IsChecked}"/>

What is happening here is that WPF is telling the IsEnabled property to watch checkbox1 and specifically the IsChecked property of that control and grab the value from there.

Pretty cool stuff.

R.I.P. Arthur C. Clarke

The world lost a great man this week. Arthur C. Clarke, died in hospital care at the age of 90. He helped invent the communications satellite, he was a scuba diver, visionary, and wrote some books that you may have heard of called 2001: A Space Odyssey

You’ll be dearly missed Arthur