Website Redirecting

mdonaldson

I use an SQL database with the website and I have a search box on each page. I made sure that SQL injection and cross scripting attacks could not get through using the search box. I have read that a lot of attackers put new entries or delete entries in the SQL database but my database appears to be untouched so I don't think it can have been one of those attacks?

mdonaldson

Just to add, the only major change I have made to the website recently is to switch from http to https. I got a SSL certificate from SSL For Free and my hosting website installed it for me after I uploaded the certificate as a pfx file. I was also required to get a static IP address for this. All this was about a month ago. Could that have had anything to do with what happened? It is stange the website has been fine for 4 years and then I make the change to SSL and I get attacked!

AndyPix

Do you hold any usernames / passwords in the sql table ?


The main use of SQL injection is to trick the site into dumping the contents of sql tables rather than adding data - hence the above question

mdonaldson

I have a shop and the table just holds product details, prices, etc. I do not store any details from buyers. I have another SQL table which holds records of what people have searched for using the search box. I have noticed in the past attempts to use SQL injection using the search box but they fail as I have protection for this in place. LINQ protects against this anyway I think?

AndyPix

If you want to PM me the url of your site - I will check it for vulnerabilities with your permission