A long time ago before I left the Windows environment, there was such a thing as "IIS lockdown tool" - something that Microsoft provided for free. It was meant to well lock down your IIS instance and do some common security tests and tell you about what potential security weaknesses of your IIS/MS SQL are, what happened to that?
Here is my situation right now,
I have access to a Windows 2003 SP2 server (MS SQL Server Web Edition 10.0), that has been hacked once. It hosts an asp website, and we think it's been compromised via an SQL injection. The developers who wrote this a decade ago say there were different users there for read and write, and that it was not configured properly hence it got hacked.
Fixing the code is nearly impossible, so right now I'm looking for something that would make IIS and SQL as secure as possible.
Is there some kind of tool/module I could install on IIS to scan for SQL injection?
Anything like IIS lockdown?