What to do If I’m sql-injected?

Many folks have asked for help on what to do when their website is sql-injected. Instead of posting their comments, I think it is better to consolidate a generic response here.

Incident response plan

Do follow your corporate incident response plan, if you have one.

Otherwise, this is a suggested plan for recovery:

Step 1: Disconnect the server

Plug out your network cable, so that your website will not infect people browsing your website.

Step 2: Database recovery

If you have a good backup of the database, then you can restore it. Otherwise, you have to reverse the changes done by the attack by searching and removing all the injected content.

Step 3: Application code review

This is the most important. Don’t connect the server until the code vulnerability has been fixed. Although your web access logs can give you a clue which ASP page(s) were vulnerable to the attack, it is pertinent to code review ALL your pages. Chances are, if one page is not securely coded, the rest are not too.

Some of there pages provide useful information on sql-injection:

Step 4: Testing and deployment

After getting all the vulnerable code rectified, get a reputable company to do a penetration test.

After passing all the review and testing, you should be assured enough to once roll out the website.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: