In one of the webserver logs I review daily I started seeing requests similar to the following:
default.aspx View=All%27/**/XoR/**/%278%27%3D%278
/default.aspx View=All%25%27/**/aND/**/%278%25%27%3D%273
/default.aspx ci=08142008%27%20aND%20%278%27%3D%273
I'm familiar with traditional SQL injection and how it looks in the log file, but you throw in the /**/XoR/**/ or /**/aND/**/ and I'm not sure how the webserver will react. I'm not sure if this is a new type of attack? Depending on the page and XoR/aND sequence the web server is responding with either a 200 or a 500. When it is a 500, sometimes an error message shows up in the log file, when it does it is "ASP_0173_:_80004005|Invalid_Path_Character". But most requests don't have an error message in the log file.
Has anyone seen these types of re ...
Go to the complete details ...