Suspect malicious probing in my asp.net ecommerce app

2
votes

I am receiving repeated errors from my asp.net ecommerce web app. I am beginning to suspect an automated malicious probe as this is the twelfth attempt to access ProductId=69 which does not exist (ProductId 69 was removed month ago ). I have not found any info via google and hope someone recognizes this. Here is the log entry.

Page location: /Product.aspx?ProductId=69

Message: Violation of PRIMARY KEY constraint 'PK_ShoppingCart'. Cannot insert duplicate key in object 'dbo.ShoppingCart'. The statement has been terminated.

Source: .Net SqlClient Data Provider

Method: Void OnError(System.Data.SqlClient.SqlException, Boolean)

Stack Trace:

at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async) at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result) at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(DbAsyncResult result, String methodName, Boolean sendToPipe) at System.Data.SqlClient.SqlCommand.ExecuteNonQuery() at GenericDataAccess.ExecuteNonQuery(DbCommand command)

2
asp.netsecurity
What type of ECommerce app are you using and are you using PayPal IPN? Make sure you're using parameterized queries for your data access. – IrishChieftain
I wrote this app and I do not use PayPal IPN. And yes my queries are @parameterized. Does this make me relatively bulletproof? – Steve Paul
Are you able to look at your IIS logs? You should be able to see the user agent for the request. Often search engines will keep trying to visit pages that you have removed until they are sure it should be removed from their index. Your server should ideally be returning a HTTP 404 error for these pages which tells search engines the page no longer exists. – David Duffett
Not able to look at IIS logs. And yes 404 pages are returned. Also, other pages have recently been requested that do exist with this error. But thanks for the clue. – Steve Paul

2 Answers

0
votes

After much observation I conclude that these page requests are bots, probably search engines.

0
votes

Finally identified this error as a duplicate order attempt.