2

A long time ago before I left the Windows environment, there was such a thing as "IIS lockdown tool" - something that Microsoft provided for free. It was meant to well lock down your IIS instance and do some common security tests and tell you about what potential security weaknesses of your IIS/MS SQL are, what happened to that?

Here is my situation right now,

I have access to a Windows 2003 SP2 server (MS SQL Server Web Edition 10.0), that has been hacked once. It hosts an asp website, and we think it's been compromised via an SQL injection. The developers who wrote this a decade ago say there were different users there for read and write, and that it was not configured properly hence it got hacked.

Fixing the code is nearly impossible, so right now I'm looking for something that would make IIS and SQL as secure as possible.

Is there some kind of tool/module I could install on IIS to scan for SQL injection?

Anything like IIS lockdown?

0

4 Answers 4

8

If the site was attacked via SQL Injection, the only thing that can fix it is fixing the code.

4
  • Well yes, but as I mentioned in the question that is not an option at this point. So I'm trying to do whatever "else" I can.
    – user893730
    Dec 7, 2011 at 3:54
  • 3
    You mean shut down the site? Only alternative. 10 years without maintenancy - sure. Have fun.
    – TomTom
    Dec 7, 2011 at 16:47
  • 5
    Again, the ONLY way to fix SQL Injection is to fix the code. Nothing else will fix it. The only other option would be to down the site until dev resources can be found to fix it. If the app is that important to the business surely they can find some budget to fix it. I suppose that you could buy a SQL Firewall to inspect all the sql commands being executed and block the ones that are a problem but this will probably be more expensive than just fixing the site.
    – mrdenny
    Dec 7, 2011 at 19:06
  • 1
    Seriously: FIX. THE. CODE. OR. SCRAP. THE. CODE. I appreciate you don't want to hear that but it doesn't make it any less of the correct answer. Anything else isn't "making IIS and SQL as secure as possible", its fiddling while Rome burns.
    – Rob Moir
    Dec 7, 2011 at 19:22
2

According to Microsoft, IIS Lockdown is still available:

2

Here is my little friend, UrlScan, what exactly I was looking for

http://technet.microsoft.com/en-us/security/cc242650

1

There are tools claiming to be "application layer firewalls" or something like that which will scan for SQL injection but I am not familiar with any one product to say "go buy this". If you are using a hosting provider they may have something like this available.

IIS lockdown will reduce your attack surface but it will not mitigate the existing problems you have.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .