A brief discussion of the security of ASP based on my experience with the "hacker"

Intermediary transaction http://www.aliyun.com/zixun/aggregation/6858.html ">seo diagnose Taobao guest cloud host technology Hall

I made a website, is a personal homepage, although not in the name of the individual, but it is only me to do this thing, I stand a set of back-Office system, with ASP, the host with the million nets, but yesterday I surf the internet, found that my investigation was changed, I thought it was my own input wrong. Quickly changed back, but after a while it was changed, but also changed more severe: The survey is, asked me to write a software is useful, I prepared the answer is:

Useful, helpful, completely useless,

He changed it to me: very useless, what help?

Also, I have a caption, said that my software is good, I certainly said that I am good, he has made me into a bunch of weeds, but the internet needs some weeds, and some personal attacks!

Also changed some of my column name, I am very angry.

Because my website is controlled by the backstage system, so I guess he went backstage.

I put a backstage demo in a subdirectory of my station, and the ASP page verification is a legitimate user is to determine whether the session of the password is null to achieve, so as long as the advanced subdirectory into the background of the demo, and then enter the background of the site file name may enter, So I deleted all the demo, but I found out that he was still doing the damage!

I have heard of the use of special code to do the password, but I did not try, also did not care, but did not want to go into other people's backstage, I think he is not using this method? So overnight change procedures, I think he will come again, put a test IP program, and check the content of his input program, It turned out that he had entered a ' or ' ' = ' into my website in the password, and I tried it myself,

So immediately started, so that every page test please password and the library to compare, finally, he did not come in! and improve the record log, note the "attack" type, time, IP, input characters, administrator access time, IP and so on. In my log, I left the exploits of that friend, who used ' or ' = with ' or '.

This article is provided by www.zydn.net