Hello,
someday's ago i go 1 of my .net 2.0 websites injected with some JavaScript code, i cleaned everything and searched for security holes.
Te website its used only for company employees, the only page that is seen by public is the login page that isn't injected.
I have the following options implemented in every page:
max length on textbox's request validation is activeall fields have validatorsLogin page have encoded textbox'sall my default.aspx pages are injected after the </html> or <asp:content>.
I don't have any sql injection.
Another odd thing is that i get the root ...
Go to the complete details ...