A brief analysis of the three steps to prevent hackers from intruding into the server

The WEB server often happens. How can this problem be solved? The following are three steps to prevent hackers from intruding into the server.

Step 1: Prevents ACCESS database downloads

Add the extended MDB ing of MDB. Method: Add IIS attributes, main directory, configuration, ing, and application extension. for mdb application parsing, you can test the selected parsing file by yourself. As long as the page cannot be found when accessing the database, you can select wam. dll

Step 2: Anti-Upload

Take the MSSQL database as an example. In the iis web directory, Only IIS users can read and list the directory permissions in the permission options, and then enter the directory for saving and storing the uploaded files, adding the write permission to IIS users, then, execute the permission options in the attributes of these two directories.

Step 3 to prevent hackers from intruding into the server: MSSQL injection prevention

This is very important. As a reminder, no SA account can be used to connect to the database. Generally, you can use DB--OWNER permissions to connect to the database. However, there is a problem of differential backup to obtain WEBSHELL. The following describes how to prevent differential backup.

Differential backup has the backup permission and requires the WEB directory. Now we can find the WEB directory through the registry or list the host directory. The two methods actually use the XP_REGREAD and XP_DRITREE extended storage. We only need to delete them. But the other point is that the program will expose its own directory. Therefore, the backup cannot be completed because the account has lower permissions. The operation is as follows: In the attributes of this account, the database access option only needs to select the corresponding database and grant its DB_OWNER permission, do not operate on other databases, and then go to the database, attributes, permission to remove the user's backup and backup log permissions, so that intruders cannot obtain WEBSEHLL through differential backup.

The above three methods are provided. Some people may say what to do with injection points. It's a great story. as for how to fill in, if you do not know how to write filter statements, you can use the anti-injection system that is ready for use on the Internet.
 

Edit recommendations]