Once I talked to the dongle about webshell.
Objectives: http://www.xxx. cn0x01 xx. xxx.248.48 ② target IP xx. xxx.248.48 Server System Microsoft-IIS/6.0 environment platform ASP. net url: overviewPreliminary judgment is that there is no waf and no CDN. Port. After all, we just want to get webshell, not a server. 0x02 vulnerability modeling since the web container is iis6, you can get the web shell through various parsing vulnerabilities. For websites
First of all, I declare that although simple dongles are used to make such titles, there are many entertainment ingredients. Even the simplest programs sold on the Internet are more complicated than the principles mentioned in this article. In addition to software developers who often check the cell in the dongle in the program and compare the returned values, the hardware also includes the EPROM fired by the manufacturer and the dedicated integrated
Recently, the company's software has to be installed with dongle. The framework is winform + WebService;
Use the usb key of et99 to verify the client and server;
C # Call provided by et99CodeThe API file is called through the com dynamic library. Too difficult to deploy. You need to deploy multiple nodes and register COM files;
So I simply wrote a class to directly call the et99api file. Just completed.
Now, we will share it with you.
This code h
Dongle SQL Injection Protection Policy Bypass Vulnerability
Dongle Bypass Vulnerability: attackers can bypass a character directly. In some special cases, they must be used with annotator.Core character used for bypass: % 0A, which must be used with annotator in some special cases.% 0A is just an idea, and the divergence is that multiple % 0A overlays, or is used together with the annotator -,/**/
1. The l
Dongle prompts you that the requested page contains unreasonable content
The dongle prompts you that the requested page contains unreasonable content. Generally, there are two situations.
The first type is Trojan, which usually appears at the front-end. Trojan fix program vulnerabilities.
The second is to use VBScript. Encode technology, which is generally used in the background. For example, you cannot
Many people may think of the overflow that has been passed in for a long time before. In fact, the overflow is not so awesome, but the impact is not small. It is a logic vulnerability,
If you build a website and install WAF, you will definitely put the search engine crawler on the white list. Otherwise, SEO will hurt.
What does whitelist mean ???
That is to say, the users in the White List, WAF will not care about it, directly allow, then we can use this thing to bypass the safe dog.
Search
Sharing of pony php bypass dongle DetectionDirectly run the Code:
Analysis and Exploitation Overhead:
Usage:
Encode the written content with a url, such as Encoded as: % 3C % 3F % 70% 68% 70% 20% 70% 68% 70% 69% 6E % 66% 6F % 28% 29% 3B % 3F % 3E
Remove % and get 3C3F70687020706870696E666F28293B3F3E.
Then access the backdoor and change the POST content:
A =/111.php B = 3C3F70687020706870696E666F28293B3F3E
You can write content.
Ov
Use dongle to optimize mysql as followsThen run the following program and report an error.$ Cn = mysql_connect ('localhost', 'username', 'password') or die (mysql_error ());If ($ cn){Echo 'success ';}Else{Echo 'FA ';}?>The result isCan't connect to MySQL server on 'localhost' (10061)As a result, I checked the service to see if it was started. As shown in the figure below, we only need to click start.
In general, the current SaaS service provides the current SDK or API docking service that involves an authentication and data encryption issue. It is generally common practice to configure the use of asymmetric encryption to solve this problem, you hold the public key of the SaaS company, the SaaS company holds your public key, you can do encryption and signature verification.Let's look at two ways to generate key pair under Linux or Mac:Using OpenSSL to generate a 2048bit-length key pair, we fi
Php rsa encryption and decryption methods and development interfaces, rsa encryption and decryption
Network security is very important, especially to ensure data security. Many programmers who write interfaces directly transmit plaintext data. In my opinion, this is not professional. I advocate that all data through interfaces should be encrypted and decrypted before use.
This article mainly introduces the
At the time of the reptile analysis, the RSA public key in the following format is often seen on the Web page:migfma0gcsqgsib3dqebaquaa4gnadcbiqkbgqdc7kw8r6tq43pwapyvkj5laljan9bzb21taift/ Vexbobzh7q8sudp5udpxebkzojx2l28y7xs1d9v3tdpfki2lr7pazwbmdmn8rihrddnpupjnlaguqjg9oopn8j7ynpcxca1iybolc2kehmjn5uwoanqq +ca6agnkqly2h4j6widaqabFor the RSA algorithm's public key, we learned that there are two main information
Add an RSA signature to the APP and an RSA signature to the APP
RSA signature. Google is mainly used for APP source control and settlement. The so-called settlement means that the APP can be used only when the Google account logged on from the current machine has downloaded the APP from the Google market, thus achieving app sales.To add an
Today survey of C # RSA and Java RSA, many people on the web said that C # encryption or Java encryption, Java can not decrypt or C # cannot decryptBut I tried it, found that it is possible, the following is the code I tried, if you have any problem, I want to see, why they can not exchange?Rsamain CodePackage RSA;Import Java.math.BigInteger;Import Java.security.
Brief introductionRSA Asymmetric encryption has a very strong security, HTTPS SSL encryption is the use of this method of HTTPS requests encrypted transmission. Because the RSA algorithm involves private key and public key respectively for encryption and decryption, it is called asymmetric encryption. Private key and public key have interoperability, that is encrypted with private key can be decrypted with public key, with public key encryption can be
Example of the RSA encryption and decryption algorithm implemented in Java, rsa encryption and decryption
This example describes the RSA encryption and decryption algorithm implemented in Java. We will share this with you for your reference. The details are as follows:
Import java. awt. alphaComposite; import java. awt. color; import java. awt. font; import java.
Asp can decrypt the ciphertext encrypted by using the built-in RSA method with the RSA that comes with PHP. this is now the case. here (Company A) there is something that was previously outsourced to Company B, ASP is used on the other side, and PHP is used on the company side. now B needs to be used. Now A generates the private key and public key (refer to blog. csdn. netclh604articledetails20224735), prov
RSA Algorithm and Its Use in iOS, RSA Algorithm Used in iOS
Because the project needs to transmit the user password, in order to ensure security, we need to use RSA encryption, So we learned how to use RSA encryption in iOS. On the history and principle of RSA, the followin
Chapter 2 digital signature algorithm-RSA, digital signature-rsa
Note: In this section, refer
Java encryption and decryption art (2nd edition) Chapter 9th "message digest algorithm with key-digital signature algorithm"
Chapter 3rd "Internet security architecture" of "Design and Practice of large-scale distributed website architecture"
14.1 Digital Signature Algorithm
Features:
Combination of asymmetri
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.