9 methods to prevent ACCESS database downloads [finishing]

Quiet Arrangement


First Article: It turns out that changing mdb to asp can prevent download.

Introduction: I tried it with animator yesterday and renamed the data. mdb file to the data. asp file and put it in the wwwroot directory. Then input data in IE. after asp path, IE is displayed blank. Right-click to view the source file, jump out of notepad, and save the content. mdb file, opened with ACCESS, found that the password is required, that is, at least the file header is damaged.
Use Flashget to download the data. asp file and save it as the data. mdb file. You can find that the file is intact with ACCESS !!! As you can see, some programmers thought it was wrong to change the mdb suffix to asp to prevent downloading! Downloading background databases is a terrible disaster for an asp + a ccess website. I found articles from various parties today and summarized the following nine methods to prevent the database from being downloaded (please add): & nbsp;


1. Use your imagination to modify the database file name
Needless to say, this is the most lazy method, but if the attacker obtains the database path through a third-party channel), it will be done. For example, if an attacker could only obtain the list permission and accidentally saw the database path, he could download the database and study it. In addition, the data file size is usually relatively large, and hidden file names cannot be concealed. Therefore, the confidentiality is the lowest.


2. Change the database name suffix to ASA, ASP, etc.

This method must be used with some settings. Otherwise, the situation at the beginning of this article will appear.

(1) Add a binary field (I have not made it-_-+ ).

(2) If you add <% or %> to this file, IIS will parse the file according to the ASP syntax, and then reports the 500 error, which cannot be downloaded. However, it is useless to simply add <% in the text or remarks field of the database, because ACCESS will process the content, it will exist in the database in the form of <%, invalid! The correct method is to store <% Into the OLE object field, so that our goal can be achieved. & Nbs p;
Method:
First, use notepad to create a text file whose content is <%.
Next, use Access to open your database file, create a new table, create a name, add an OLE object field to the table, add a record, and insert the text file created earlier, if the operation is correct, you can see a new record named "data packet. You can.


3. Add "#" before the Database Name "#"
You only need to add # To the front Name of the database file, and then modify the database address in the database connection file (such as conn. asp. The principle is to download only recognize the part of the front Name of & nbsp; #, for the automatic removal of the back, for example, you want to download: http://www.pcdigest.com/date/# 123.mdb( if there is ). Both IE and FLASHGET are http://www.test.com/dat e/index.htm (index. asp, default. jsp, etc. The home page document in IIS settings)
In addition, retaining spaces in database file names also plays a similar role. Due to the special nature of the HTTP protocol for address resolution, spaces are encoded as "%", such as http: // www.test.com/date/123; 456.mdb, http: // www. test.com/date/123 % 456.mdb. However, our directory does not have the 123% 456. mdb file at all, and the download is invalid. After such modification, even if you expose the database address, it is generally impossible for others to download it!


4. Encrypted Database
First, choose tools> Security> encryption/Decryption database, and select the database (for example, employer. mdb), and then click OK. The window "Save the database as encrypted database" appears, saving as: employer1.mdb. Then employer. mdb will be encoded and stored as employer1.mdb .. note that the above actions are not to set a password for the database, but to encode the database files to prevent others from using other tools to view the contents of the database files.
Next, we will encrypt the database. First, we will open the encoded e mployer1.mdb and select the "exclusive" mode when opening it. Select "tools-> Security-> set Database Password" in the menu, and enter the password. In this way, even if someone else gets the employee 1.mdb file, he cannot see emplo yer1.mdb without a password.
After encryption, modify the database connection page, for example:
Conn. open "driver = {microsoft access driver & nb sp; (*. mdb)}; uid = admin; pwd = Database Password; dbq = database path"
After this modification, even if the database is downloaded, it cannot be opened by others (provided that the password on your database connection page is not leaked)
However, it is worth noting that the encryption mechanism of the Access database is relatively simple, and it is easy to decrypt even if a password is set. The database system creates an encryption string by comparing the password entered by the user with a fixed key and stores it in *. the mdb file starts from the address "& H42. Therefore, a good programmer can easily create dozens of rows of small programs to easily obtain the password of any Access database. Therefore, as long as the database is downloaded, its information security is still unknown.


5. Store the database outside the WEB directory or store the database connection file in another virtual directory.
If your WEB directory is e: webroot, you can put the database in the e: data folder and modify the database connection address :".. /data/Database Name ", so that the database can be called normally, but cannot be downloaded, because it is not in the WEB directory! This method is generally not suitable for users who buy virtual space.


6. Use the ODBC data source.
In programming such as ASP, if conditions are met, try to use the ODBC Data Source. Do not write the database name in the program. Otherwise, the database name will be lost along with the password of the ASP source code. For example: DBPath = Server. mapPath (".. /123/abc/asfadf. mdb ")
Conn. open "driver = {Microsoft Access Driver & nb sp; (*. mdb)}; dbq =" & DBPath
It can be seen that even if the database name gets weird, the hidden directory goes deeper, and the ASP source code is easily downloaded after the password is lost. If you use an ODBC data source, the following problem does not exist: conn. open "ODBC-DSN name", but this is more annoying, if you want to re-set the data source, more convenient way please see the 7, 8 method!


7. Add the extended MDB ing of database names such as MDB
This method is implemented by modifying the IIS settings. This method is suitable for friends who have control over IIS and is not suitable for users who buy virtual hosts (unless the Administrator has already set it ). I think this method is the best at present. The database of the entire site can be modified to prevent downloading. You do not need to modify the code to prevent download even if the target address is exposed. & N bsp;
In IIS properties --- main directory --- configuration --- ing --- application extension, add the application parsing of the. mdb file. Note that the selected d ll (or EXE) here does not seem to be arbitrary, and the MDB file can still be downloaded due to improper selection. It is best not to select asp. dll. You can perform multiple tests on your own.
After this modification, download the database such as: http://www.test.com/dat a/dvbbs6.mdb. An error occurs (404 or 50 0)


8: advantages of using. net
The wooden bird on the Internet has written a "WBAL anti-leech tool" to prevent illegal file downloads ". You can log on to http: // www. 9 seek. com/WBAL /;
However, it only prevents non-local downloads and does not provide a real anti-download function. However, this method is not much different from the 5 method. You can modify the. NET file to achieve local download!

Only 7th and 8 of these methods are uniformly modified. After a configuration is modified, the database of the entire site can be prevented from being downloaded. The other methods need to modify the Database Name and connection file respectively, it is troublesome, but this is also the only option for virtual host friends!

In fact, 6th methods should be extended by 5th methods, which can implement special functions, but are not supported. net host or for fear of setup troubles, we still use the 5th method directly. By default, the 6th methods can still be copied and connected to the same host's forum or message book for publishing, then you can click Download (because the reference page is from the same host)

9. use NTFS partition File Permission settings (by percyboy)
We already know that ASP. NET uses ADO. NET to Access the database and can Access the Access database through the OleDb connection-one of our very common low-end databases. This article discusses ASP. NET may see several error prompts, from which you can see the database files created by & nb sp; Access 2000 and Access XP, when the Access error occurs, there will be a different error message. Hope to help you. Another key point is to use this article to give you a new understanding of the NTFS permission settings for Access database files in ASP. NET.

 

(1) experiment process


For the sake of convenience, let's take an experiment: The application is/test, and the data inventory is stored in D: wwwr ootestdatadb1.mdb. We already know in ASP. NET is called; ASPNET virtual user identity to access the database, we need to give this account with specific NTFS permissions to Make ASP. NET