Products

Solutions

Learn More

Partners

Community

Blog

About

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...DNN 6.2.9 under attackDNN 6.2.9 under attack
Previous
 
Next
New Post
11/3/2015 12:37 PM
 
Just some ideas if I was in your shoes:
1. SQL is the target, so I would check SQL Logs for user access - making sure no users you do not know about are accessing it
2. Check the IIS logs for Source and destination URLs - you may want to ban some user IPs if you see they are all from China for example - won't stop spoofing, but its a start
- investigate strange URLs that are being accessed and returned to the user as valid
- investigate the modules at those URLs' pages
3. Check your DNN users, making sure someone hasn't created an account they are using to access SQL through the interface.

These are probably all common sense, but just my 2 cents on where I might start.
 
New Post
11/3/2015 4:07 PM
 
I would set up a new SQL user with access to your DNN db. Test it it to verify connectivity. Then change your connection string to use the new username and password in the web.config and delete the old credentials from the db. If the db user name and password have been compromised they would not even need to use SQL injection to cause problems.   
 
New Post
11/3/2015 4:51 PM
 
Edoardo Antonini wrote:
What I'm experiencing is someone manages somehow to cripple my installation and I get all these errors on the site pages. They cripple my modules that don't show on pages and throw errors all over the place and the site looses more or less all functionality and I'm forced to restore a previous backup since there is no way of understanding how to repair the damage with all the administrator tools down.

When you restore, are you restoring the File System, Database, or both?

Does restoring ONE of them address the problem?

If restoring the File System restores the site, the issue is likely due to permissions on folders in your site, which could be caused by permissions from a 3rd party module.

OR, are you seeing that entries in the DB are messed with?

 
New Post
11/3/2015 6:59 PM
 
are you really seing SQL being executed / Data being modified in the database?
In DNN 7 and later, you should prefer using IIS Request Filtering over UrlScan, please read http://blogs.iis.net/peterviola/block....
And heres an easy example as well - https://www.iis.net/configreference/s...

Cheers from Germany,
Sebastian Leupold

dnnWerk - The DotNetNuke Experts   German Spoken DotNetNuke User Group

Speed up your DNN Websites with TurboDNN
 
New Post
11/6/2015 5:09 AM
 
Mike Riley wrote:

When you restore, are you restoring the File System, Database, or both?

Does restoring ONE of them address the problem?

If restoring the File System restores the site, the issue is likely due to permissions on folders in your site, which could be caused by permissions from a 3rd party module.

OR, are you seeing that entries in the DB are messed with?

Hello Mike

All it takes is to restore the Database. No file System restore (luckily since I'm not sure I have a viable backup of that).

I'm basically seeing entries in the DB are messed with. When the modules load they mess up stuff by adding special characters like ' and " and confusing the proper module functions by passing strings where modules expect integers or boolean.

I did not see any changed content inside my HTML modules as yet but they simply don't appear on the page.

Leupold, I'm still on DNN 6.2.9 because of minimum SQL Server requirements my provider could not meet in order to upgrade to DNN 7.

Upgrade would be possible now but I'm not particularly keen on investing more money on a platform that is driving me nuts because of third party modules I would be forced to purchase upgrades for once I upgrade my DNN core - with no guarantee of solving the problem.

I tried to look at the IIS logs but there is a bunch of websites hosted on the server and I'm not terribly proficient at looking through IIS logs - not really sure what I'm supposed to look for in all that mess.

Is there a freeware software I can use to sort/search the logs for specific entries? Opening the stuff with notepad is a bit confusing. I'm using Excel but it would help if I knew what to look for and if I had a little more filtering.

As for the SQL logs you mean the log files you can find in SQL management studio under Managemen -> Logs or you mean some other log?

If you mean these logs I can't find anything significant apart from the list of all the restores I have performed in the last month or so.

I can't seem to find the user activity. If I filter activities specifying a user I get no records back.

One positive news is that since I removed almost any and all modules having some sort of form and or all links allowing user registrations on my websites the problems seemed to have stopped. 

The downside is I'm back to "good old" unresponsive static showcase sites and HTML 1 in one simple step. :/

Thanks

 

 

 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...DNN 6.2.9 under attackDNN 6.2.9 under attack


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.

Content Layout

Subscribe to DNN Digest

Subscribe to DNN Digest

DNN Digest is our monthly email newsletter. It highlights news and content from around the DNN ecosystem, such as new modules and themes, messages from leadership, blog posts and notable tweets. Keep your finger on the pulse of the ecosystem by subscribing.  

What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out