Knowledge about IIS vulnerability to server

We know that from codered to nimda, a lot of worms have turned all the vulnerabilities that need to be manually exploited into automatic exploitation by programs. Do you still want to manually operate on these IIS vulnerabilities? Let's adjust our focus to see common databases on the server.

Generally, websites are based on databases, especially those that are dynamically displayed using databases such as ASP, PHP, and JSP. Many websites may pay more attention to operating system vulnerabilities. However, the security of these scripts for database and IIS vulnerabilities is always ignored and not paid much attention.

IIS vulnerabilities should be put down first. Starting from the most common scripting issues, these are all old topics. You can refer to Hectic's simple database intrusion and rogue destruction, taking Tian Rongxin as an example, this article provides a detailed explanation of the SQL script issue.

You can also filter the Security Solution of scripts. For more information, see what I wrote earlier. For ASP, you can use the following filter function:
 

 
 

  
  
Function Filter_ SQL (strData)
  
  
Dim strFilter
  
  
Dim blnFlag
  
  
Dim I
  
  
StrFilter = "',;, //, --, @, _, exec, declare"' the characters to be filtered. You can add them by yourself. "," is a separator.
  
  
BlnFlag = Flase 'filter flag. If a filter is generated, it is true.
  
  
Dim arrayFilter
  
  
ArrayFilter = Split (strFilter ,",")
  
  
For I = 0 To UBound (arrayFilter)
  
  
If Instr (strData, arrayFilter (I)> 0 Then
  
  
BlnFlag = True
  
  
Exit
  
  
End If
  
  
Next
  
  
If blnFlag Then
  
  
Response. Redirect "wrong. asp"
 
 

When you check for IIS vulnerabilities and find any filtering operation, go to a predefined page. Connection requests that are unavailable for normal access are not good at all.
 

 
 

  
  
Else   
  
  
Filter_SQL=strData   
  
  
End If   
  
  
End Function 
 
 

For ms SQL Server databases, security issues are not limited to scripts. The system of "Microsoft" is very strong, and the entire WINDOWS-based application is highly correlated. for SQL Server, database management and system management can basically be equivalent. This section describes the IIS vulnerability knowledge.