I recently summarized some of the basic vulnerabilities that are easy to exploit when writing asp.net.

1) Response. WriteFile ();

This statement is used to directly write a file into the response stream. We may use it to display an image or the content in a TXT file, and so on. However, I will give an example below, let's take a look at the potential risks of this statement:

1. Create a Handler. ashx page

2. Write code

Public void ProcessRequest (HttpContext context ){
Context. Response. ContentType = "text/plain ";
String r = context. Request ["re"]. ToString ();
Context. Response. WriteFile (r );
}
It is very simple, that is, to display the content of a file by passing a value. This usage is quite common. We can palm an image control on another page. The image address is Handler. ashx? Re = an image address that dynamically loads images to the image control. However, if you directly access "Handler. ashx? Re = './Handler. ashx' "; you are miserable, and the source code of this page will be downloaded. If there is something important on this page, the website security will be in crisis.

Note: first, the Handler. ashx determines the value to be uploaded. The suffix of the uploaded value is the image type, and Other types are prohibited. Second, the Response. WriteFile is used less.

2) xxs

It seems like a simple vulnerability, but a large website exposes this vulnerability every year, so pay attention to it.

3) WebShell

The upload control sounds very common. In fact, sometimes it also exposes vulnerabilities. For example, if you provide an upload control that allows users to upload portraits to the server hard disk:

FileUpload1.PostedFile. SaveAs (PATH); if you can see the relative path of the folder you want to put the file in through the url, and you have not checked the type information of the uploaded file. You can:

1. Create a page and add

Protected void Page_Load (object sender, EventArgs e)
{
System. IO. file. delete (the path of a file on the server); // that is, you can use this control to upload the file to any code written by the server. You can do anything, is it unsafe for you? He can delete your files, steal your database, and so on.
}

2. The user accesses http: // your domain name/the relative path of the upload Folder/the file name uploaded by the user just now. In this way, the code written by the user is executed.

Note: Remember to first determine the type and suffix of the uploaded file, and then set permissions for the files and folders on the server;

4) SQL injection.

That's not enough.