Turning: An ASP Common security vulnerabilities

Common Security vulnerabilities for ASPs
ASP's vulnerability is already very small, want to find the actual location of the database is not simple, but this does not mean that hackers have no access to, it is this view, the general programmer often forget to carefully check whether there is a loophole, so that the site data can be stolen events occur. Today I am here to talk to you about the common vulnerabilities of ASP, in order to arouse the attention of everyone and take effective preventive measures. (Note that the method introduced in this article please do not try, please consciously abide by the network guidelines, thank you!) ）
Microsoft's Internet Information Server (IIS) provides Web services that are dynamically generated using Active Server pages (ASPs). An ASP file, which is a file that directly contains program code in an HTML Web page. A callback (Request) ASP file prompts IIS to run the program code embedded in the Web page and then sends its results directly back to the browser. On the other hand, static HTML pages are uploaded back to the browser in their original form, without any parsing processing. Here, IIS uses the file's additional file name to differentiate the file's form. A file with an additional filename of. htm or. html is a static HTML file, while an. asp file with an attached file is an active Server Pages file. Because of this, this active Server Pages left a backdoor to others.
For example, by taking advantage of this simple parameter, the time of the system on which it resides is displayed. The date is automatically obtained from the system and transmitted in the form of a Web page. Back to this page through the browser, we will not see the program code just now, but see the program code execution results, perhaps in all network security vulnerabilities, the most important thing is not resolved the contents of the file or the program code inadvertently displayed security vulnerabilities. To put it simply, these vulnerabilities allow users to spoof the program code in a dynamic Web page from a Web server.
The first way people used ASP security vulnerabilities was to access files using the serial characteristics of Windows NT data transmission. You just use one of the simplest parameters (:: $DATA) You can see the ASP's original program.
For example, the following URL:
Http://10.1.1.11/login.asp:: $DATA
You will get an ASP program code that is not parsed in a file called Login.asp. Because this URL string does not end with. asp, IIS has no way to determine whether the file being consulted is an ASP file.
The program code shown is as follows:
xxxx
Alert ("Please enter your password!!")
}
else {
document.f1.action= "Checkuser.asp"
Document.f1.submit ()
}
}
xxxx
Note: Checkuser.asp is the thing to check the password of the account!