3 ms·

Attacks evolve, but I remember reading around 2005 on OWASP site about SQL injections and XSS. Database APIs with parameter binding (and auto-escape of these pa

Attacks evolve, but I remember reading around 2005 on OWASP site about SQL injections and XSS. Database APIs with parameter binding (and auto-escape of these parameters) where available in most popular languages even back then and here we are 15 years later, SQL injections and XSS are still in OWASP top 10. Though Classic ASP was released much earlier in 1996 and I don't know if SQL libraries offered parameter binding and template engine - escaping of string in template variables.

raesene9 5y ago
The first named mention of SQLi was 1998 by Rain.Forest.Puppy (AFAICR), however classic ASP did not have any in-built protection from it. I started in security in 2000, as an analyst for an org using classic ASP. maintaining security was a pain. I then started as a pentester in ~2005 and what I can tell you is, in my experience, classic ASP applications rarely had good protections against injection attacks (e.g. XSS, SQLi) for precisely the reason that the framework did not protect against it, leaving developers to make sure they had routines to canonicalise/sanitize/parameterize input correclty, and also that they implemented them universally across all possible user inputs. Whilst this isn't impossible, in my experience, it was rarely done perfectly. In comparison, something like ASP.Net which had in-built protections available, at least had the chance of having good uniform protection.
mcguire 5y ago
I believe I can push parameter binding back past 2000.
fettucini 5y ago
There is no difference between the XSS, CSRF and SQL vulnerabilities of classic ASP and ASP.NET. See "Why are ASP.NET more secure than ASP Classic?": Ans: they're not. https://stackoverflow.com/questions/12648698/why-are-asp-net-more-secure-than-asp-classic https://stackoverflow.com/questions/12648698/why-are-asp-net... FTFA: "To summarise, I would not say ASP.NET is inherently more secure than Classic ASP, except for the fact that newbie developers are less likely to create an XSS vulnerable website in ASP.NET."

raesene9 5y ago

The first named mention of SQLi was 1998 by Rain.Forest.Puppy (AFAICR), however classic ASP did not have any in-built protection from it. I started in security in 2000, as an analyst for an org using classic ASP. maintaining security was a pain. I then started as a pentester in ~2005 and what I can tell you is, in my experience, classic ASP applications rarely had good protections against injection attacks (e.g. XSS, SQLi) for precisely the reason that the framework did not protect against it, leaving developers to make sure they had routines to canonicalise/sanitize/parameterize input correclty, and also that they implemented them universally across all possible user inputs. Whilst this isn't impossible, in my experience, it was rarely done perfectly. In comparison, something like ASP.Net which had in-built protections available, at least had the chance of having good uniform protection.

mcguire 5y ago

I believe I can push parameter binding back past 2000.

fettucini 5y ago

There is no difference between the XSS, CSRF and SQL vulnerabilities of classic ASP and ASP.NET. See "Why are ASP.NET more secure than ASP Classic?": Ans: they're not. https://stackoverflow.com/questions/12648698/why-are-asp-net-more-secure-than-asp-classic https://stackoverflow.com/questions/12648698/why-are-asp-net... FTFA: "To summarise, I would not say ASP.NET is inherently more secure than Classic ASP, except for the fact that newbie developers are less likely to create an XSS vulnerable website in ASP.NET."