Is this default behavior?

Hello all,
I'm having difficulties understanding why something is not going the way I
want it (sounds familiar?). I'm testing SQL injection on my own PC, based on
the article at http://aspalliance.com/articleViewer...Id=385&pId=-1.
when I enter only my credentials in the user field, like
administrator';use master exec xp_cmdshell 'dir c:\*.*'--
I get the resultant string
SELECT strusername, strpassword FROM tUser WHERE strusername = 'beheerder';
use master exec xp_cmdshell 'dir c:\*.*' --' AND strpassword = ''
Now the output of "Response.write objrso.Fields.count" is 2. A closer look
gives me 'administrator' and 'password'. Not the C:\ drive listing, which
does show up in SQL Query Analyzer! Is this by any means possible with the
code
Set objConn = Server.CreateObject("ADODB.Connection")
Set objrso = Server.CreateObject("ADODB.Recordset")
sql = "SELECT strusername, strpassword FROM tUser WHERE strusername = '" +
username & _
"' AND strpassword = '" + password & _
"'"
objConn.Open cn
objrso.open sql, cn
If not, how should I change this code? Any hints would be highly welcome.
Best regards,
Carl.
Hi Carl,
Since you have two different SQL statements, separated by semicolon, then
provider executes them separately and returns two resultsets (recordsets).
When you open objrso recordset, then it points to the first one. To be able
to get information from the subsequent recordsets, you need to call
NextRecordset method of the opened recordset
Set objrso=objrso.NextRecordset
If provider returns another resultset, then you will see it after this call
Val Mazur
Microsoft MVP
"Carl Matthews" <ecvaneersel@.nospam.hotmail.com> wrote in message
news:ecJmrkjIEHA.1140@.tk2msftngp13.phx.gbl...
> Hello all,
> I'm having difficulties understanding why something is not going the way I
> want it (sounds familiar?). I'm testing SQL injection on my own PC, based
> on
> the article at http://aspalliance.com/articleViewer...Id=385&pId=-1.
> when I enter only my credentials in the user field, like
> administrator';use master exec xp_cmdshell 'dir c:\*.*'--
> I get the resultant string
> SELECT strusername, strpassword FROM tUser WHERE strusername =
> 'beheerder';
> use master exec xp_cmdshell 'dir c:\*.*' --' AND strpassword = ''
>
> Now the output of "Response.write objrso.Fields.count" is 2. A closer look
> gives me 'administrator' and 'password'. Not the C:\ drive listing, which
> does show up in SQL Query Analyzer! Is this by any means possible with the
> code
> Set objConn = Server.CreateObject("ADODB.Connection")
> Set objrso = Server.CreateObject("ADODB.Recordset")
> sql = "SELECT strusername, strpassword FROM tUser WHERE strusername = '" +
> username & _
> "' AND strpassword = '" + password & _
> "'"
> objConn.Open cn
> objrso.open sql, cn
> If not, how should I change this code? Any hints would be highly welcome.
> Best regards,
> Carl.
>

Is this default behavior?

Hello all,
I'm having difficulties understanding why something is not going the way I
want it (sounds familiar?). I'm testing SQL injection on my own PC, based on
the article at http://aspalliance.com/articleViewe...aId=385&pId=-1.
when I enter only my credentials in the user field, like
administrator';use master exec xp_cmdshell 'dir c:\*.*'--
I get the resultant string
SELECT strusername, strpassword FROM tUser WHERE strusername = 'beheerder';
use master exec xp_cmdshell 'dir c:\*.*' --' AND strpassword = ''
Now the output of "Response.write objrso.Fields.count" is 2. A closer look
gives me 'administrator' and 'password'. Not the C:\ drive listing, which
does show up in SQL Query Analyzer! Is this by any means possible with the
code
Set objConn = Server.CreateObject("ADODB.Connection")
Set objrso = Server.CreateObject("ADODB.Recordset")
sql = "SELECT strusername, strpassword FROM tUser WHERE strusername = '" +
username & _
"' AND strpassword = '" + password & _
"'"
objConn.Open cn
objrso.open sql, cn
If not, how should I change this code? Any hints would be highly welcome.
Best regards,
Carl.Hi Carl,
Since you have two different SQL statements, separated by semicolon, then
provider executes them separately and returns two resultsets (recordsets).
When you open objrso recordset, then it points to the first one. To be able
to get information from the subsequent recordsets, you need to call
NextRecordset method of the opened recordset
Set objrso=objrso.NextRecordset
If provider returns another resultset, then you will see it after this call
Val Mazur
Microsoft MVP
"Carl Matthews" <ecvaneersel@.nospam.hotmail.com> wrote in message
news:ecJmrkjIEHA.1140@.tk2msftngp13.phx.gbl...
> Hello all,
> I'm having difficulties understanding why something is not going the way I
> want it (sounds familiar?). I'm testing SQL injection on my own PC, based
> on
> the article at http://aspalliance.com/articleViewe...aId=385&pId=-1.
> when I enter only my credentials in the user field, like
> administrator';use master exec xp_cmdshell 'dir c:\*.*'--
> I get the resultant string
> SELECT strusername, strpassword FROM tUser WHERE strusername =
> 'beheerder';
> use master exec xp_cmdshell 'dir c:\*.*' --' AND strpassword = ''
>
> Now the output of "Response.write objrso.Fields.count" is 2. A closer look
> gives me 'administrator' and 'password'. Not the C:\ drive listing, which
> does show up in SQL Query Analyzer! Is this by any means possible with the
> code
> Set objConn = Server.CreateObject("ADODB.Connection")
> Set objrso = Server.CreateObject("ADODB.Recordset")
> sql = "SELECT strusername, strpassword FROM tUser WHERE strusername = '" +
> username & _
> "' AND strpassword = '" + password & _
> "'"
> objConn.Open cn
> objrso.open sql, cn
> If not, how should I change this code? Any hints would be highly welcome.
> Best regards,
> Carl.
>sql

Is there anyway to issue a http POST from SQL Server?

Just wondering if there is a way to issue a http post from SQL? Basically I
want to write an insert trigger that will create a SOAP msg and then send it
to a webservice, anyone know if there is an internal mechanism in
SQL/SQLXML/SOAP Toolkit or otherwise that will allow you to do this? I am
thinking an answer might be to write it in C and the create an Extended
Stored Procedure but was ondering if there was another way.It's not SQL based, but there is a way in SQL Server 2005, using .NET
procedure or trigger. It's conceivable you might do the same in SQL Server
2000 using SP_OACreate and friends, but IIRC, the COM component that
implements this (from Wininet?) may not be thread safe. Your own XP is
another way.
Bob Beauchemin
http://www.sqlskills.com/blogs/bobb
"James Morton" <james_morton@.hotmail.com> wrote in message
news:OUoPHrroFHA.420@.TK2MSFTNGP09.phx.gbl...
> Just wondering if there is a way to issue a http post from SQL? Basically
> I
> want to write an insert trigger that will create a SOAP msg and then send
> it
> to a webservice, anyone know if there is an internal mechanism in
> SQL/SQLXML/SOAP Toolkit or otherwise that will allow you to do this? I am
> thinking an answer might be to write it in C and the create an Extended
> Stored Procedure but was ondering if there was another way.
>

Is there anyway to issue a http POST from SQL Server?

Just wondering if there is a way to issue a http post from SQL? Basically I
want to write an insert trigger that will create a SOAP msg and then send it
to a webservice, anyone know if there is an internal mechanism in
SQL/SQLXML/SOAP Toolkit or otherwise that will allow you to do this? I am
thinking an answer might be to write it in C and the create an Extended
Stored Procedure but was ondering if there was another way.
It's not SQL based, but there is a way in SQL Server 2005, using .NET
procedure or trigger. It's conceivable you might do the same in SQL Server
2000 using SP_OACreate and friends, but IIRC, the COM component that
implements this (from Wininet?) may not be thread safe. Your own XP is
another way.
Bob Beauchemin
http://www.sqlskills.com/blogs/bobb
"James Morton" <james_morton@.hotmail.com> wrote in message
news:OUoPHrroFHA.420@.TK2MSFTNGP09.phx.gbl...
> Just wondering if there is a way to issue a http post from SQL? Basically
> I
> want to write an insert trigger that will create a SOAP msg and then send
> it
> to a webservice, anyone know if there is an internal mechanism in
> SQL/SQLXML/SOAP Toolkit or otherwise that will allow you to do this? I am
> thinking an answer might be to write it in C and the create an Extended
> Stored Procedure but was ondering if there was another way.
>