PK

<%Dim BlackList, ErrorPage, spvalidacion

BlackList = Array("--", "/*", "*/", "@@",_
" char ", " nchar ", " varchar ", " nvarchar ",_
" alter ", " begin ", " cast ", " create ", " cursor ",_
" declare ", " delete ", "drop ", " end ", " exec ",_
" execute ", " fetch ", "insert", " kill ", " open ",_
" select ", " sys ", " sysobjects ", " syscolumns ",_
" table ", " update ")

ErrorPage = "/Error.php"

Function CheckStringForSQL(str)
	On Error Resume Next
	Dim lstr
	
	If ( IsEmpty(str) ) Then
		CheckStringForSQL = false
		Exit Function
	ElseIf ( StrComp(str, "") = 0 ) Then
		CheckStringForSQL = false
		Exit Function
	End If
	lstr = LCase(str)
	
	For Each spvalidacion in BlackList
		If ( InStr (lstr, spvalidacion) <> 0 ) Then
			CheckStringForSQL = true
			Exit Function
		End If
	Next
	CheckStringForSQL = false
End Function

For Each spvalidacion in Request.Form
	If ( CheckStringForSQL(Request.Form(spvalidacion)) ) Then
		PrepareReport("Variables en Form")
		Response.Redirect(ErrorPage)
	End If
Next

For Each spvalidacion in Request.QueryString
	If ( CheckStringForSQL(Request.QueryString(spvalidacion)) ) Then
		PrepareReport("Variables en QueryString")
		Response.Redirect(ErrorPage)
	End If
Next

For Each spvalidacion in Request.Cookies
	If ( CheckStringForSQL(Request.Cookies(spvalidacion)) ) Then
		PrepareReport("Variables en Cookies")
		Response.Redirect(ErrorPage)
	End If
Next

Function PrepareReport(injectionType)
    'Build the messege
    Dim MessageBody
    MessageBody="<h1>La inyeccion Sql fue bloqueada</h1><br/>"
    MessageBody=MessageBody & "Tiempo de ataque: " & FormatDateTime(Now,3) & "<br/>"
    MessageBody=MessageBody & "Direccion IP del atacante: " &  Request.ServerVariables("REMOTE_HOST") & "<br/>"
    MessageBody=MessageBody & "Tipo de inyeccion: " & injectionType & "<hr size='1'/><br/>"
    MessageBody=MessageBody & "Informacion detallada: <br/>"
    
    MessageBody=MessageBody & "<table width='100%'>"
    MessageBody=MessageBody & "<tr><td colspan='2'><h2>Variables de Form</h2></td></tr>"
    'List Form Data
    For Each spvalidacion in Request.Form
        MessageBody=MessageBody&"<tr>"
        MessageBody=MessageBody&"   <td>" & spvalidacion & "</td>"
        MessageBody=MessageBody&"   <td>" & Request.Form(spvalidacion) & "</td>"
        MessageBody=MessageBody&"<tr>"
    Next
    MessageBody=MessageBody & "<tr><td colspan='2'><h2>Variables de QueryString</h2></td></tr>"
    For Each spvalidacion in Request.QueryString
        MessageBody=MessageBody&"<tr>"
        MessageBody=MessageBody&"   <td>" & spvalidacion & "</td>"
        MessageBody=MessageBody&"   <td>" & Request.QueryString(spvalidacion) & "</td>"
        MessageBody=MessageBody&"<tr>"
    Next
 
    MessageBody=MessageBody & "<tr><td colspan='2'><h2>Variables de Cookie</h2></td></tr>"
    For Each spvalidacion in Request.Cookies
        MessageBody=MessageBody&"<tr>"
        MessageBody=MessageBody&"   <td>" & spvalidacion & "</td>"
        MessageBody=MessageBody&"   <td>" & Request.Cookies(spvalidacion) & "</td>"
        MessageBody=MessageBody&"<tr>"
    Next
    
    MessageBody=MessageBody&"</table><br/>"
    MessageBody=MessageBody & "Script de la pagina: " & GetCurrentPageUrl() & "<br/>"
    MessageBody=MessageBody & "Pagina de referencia: " & GetRefererPageUrl() & "<br/><br/>Mail enviado automaticamente"
    
	'response.write "Inyeccion Sql fue detectada por " & injectionType & "!" & MessageBody
	
	Dim mail
	set mail=server.CreateObject("CDONTS.NewMail")
	
	mail.From= "ventasonline@Fe-cort.com.ar" 
	mail.To = "tom@webtom.com.ar" 
	mail.Subject = "Inyeccion Sql en educacionpuig.com.ar"
	mail.Body = "<html><body>Inyeccion Sql fue detectada por " & injectionType & "!" & MessageBody & "</html></body>"
	mail.BodyFormat = 0 ' 0 = HTML, 1 = Plain
	mail.MailFormat = 0 ' 0 = MIME, 1 = Text
	mail.Importance = 1 ' 0 =High, 1 = Medium, 2 = Low
	mail.Send
	
	set mail=nothing 
	
End Function

Function GetCurrentPageUrl()
	Dim filename , querystring, domainname
    domainname = GetCurrentServerName() 
    filename = Request.ServerVariables("SCRIPT_NAME") 
    querystring = Request.ServerVariables("QUERY_STRING") 
    GetCurrentPageUrl= domainname & filename & "?" & querystring 
End Function
 
Function GetRefererPageUrl()
    GetRefererPageUrl= Request.ServerVariables("HTTP_REFERER") 
End Function
 
Function GetCurrentServerName()
	Dim prot , https, domainname
    prot = "http" 
    https = lcase(request.ServerVariables("HTTPS")) 
	
    if https <> "off" then prot = "https" 
    domainname = Request.ServerVariables("SERVER_NAME") 
    GetCurrentServerName=prot & "://" & domainname 
End Function
 
Function GetPageNameFromPath(strPath)
	Dim strPos, pageName
	
    strPos= len(strPath)-InStrRev(strPath,"/")
    pageName=right(strPath,strPos)
    GetPageNameFromPath=pageName
End Function
 
Function GetCurrentPageName()
	Dim scriptPath, pageName
    scriptPath = Request.ServerVariables("SCRIPT_NAME") 
    pageName=GetPageNameFromPath(scriptPath)
    GetCurrentPageName=pageName
End Function%>

PK 99