Blocks ASP vulnerabilities)

Whether you believe it or not, asp can easily intrude into the web server, steal and capture files on the server.
Web
The user passwords of databases and other systems, and even the malicious deletion of files on the server until the system is damaged, these are not sensational and have actually occurred. This article will reveal these to you one by one.
Asp vulnerabilities, and provide some preventive opinions.

The previous article focuses on "ADO
How to display data by page when accessing the database? A friend sent me a message indicating that I ignored it when calculating the total number of pages.
An important parameter "PageCount" of the Recordset object, which can
After the value is assigned, the total number of pages is automatically obtained without the tedious formula "INT (RS. recordcount/PgSz *-1) *-1. I would like to thank this friend for kindly pointing out the shortcomings in the program, because this program was written a long time ago, because the total number of records displayed on the page may not be able to display the number of records displayed on the page, and at that time I was not sure
PageCount
Whether the number of pages can be obtained correctly, so I am lazy to write this formula :). To be honest, I have not tried it yet.
Pagecount: If you are interested, you must try it. Don't learn about my laziness.

Recently, When I discussed the issue on the chinaasp bbs, I found that many of my friends
Some of the most common asp: $ DATA
The source code is displayed, so I think it is very necessary to focus on this issue for the majority of friends.
With the consent of chinaasp, I will write something about asp
The vulnerability introduction and some of my own practical experience are provided for you to analyze in detail.
For webmaster, asp security is critical.

When last year: $ DATA
The second day after the vulnerability was discovered and announced, I detected most of the domestic applications at that time.
Asp
99% of these sites have issues with source code that can be seen above. On that day, I even caught it on Microsoft's site.
Search. asp
Source code of this file. You may think that the source code is not a problem.
Webmaster is wrong if you think so. For example, if asp
The programmer directly writes the login password of the site in asp
Once the source code is found, others can easily access the page that should not be seen, I used this method to become a paid Website member for free (don't expose me !), In addition, many database connection usernames and passwords are directly written in
Asp
If your database allows remote access and is not protected, it is quite dangerous. In some scenarios
The access mdb library is often used in bbs programs developed by asp.
The inventory path is known, and the database is likely to be downloaded by others. In addition, if the password contained in the database is not encrypted, it is very dangerous, if the attacker attempts to maliciously destroy the password
Log in as admin to delete all bbs
The post in is enough for you to throw. The following lists some existing vulnerabilities. I hope you can be vigilant,
To run the asp program on win95 + pws, you only need to simply
After the file name is added, an asp program with a decimal point will be downloaded. IIS3
The same problem also exists. If you are still using IIS3, you must test it.

 

 

2. a widely known vulnerability in iis2, iis3, and iis4 is: $ DATA.
Ie's view source or netscape can access the asp file directly to see asp easily
Code. This vulnerability does not exist in Win98 + pws4.

 

What is the cause of this terrible vulnerability? The root cause is
Windows NT exclusive file systems are being blamed. Anyone with a little knowledge knows that at NT
It provides a file system completely different from FAT: NTFS, which is called a new technology file system.
NT
It has a high security mechanism, but it also produces many headaches. You may not know,
NTFS
Supports multiple DATA streams contained in a file, and the main DATA stream containing all the content is called "DATA", so that direct access in the browser
NTFS
This feature of the system makes it possible to easily capture scripts in files. However
: $ DATA is caused by IIS
An error occurred while parsing the file name. It does not properly regulate the file name.

 

How can we solve this problem? There are several methods:

 

A. Set the directory where the. asp file is stored as unreadable (ASP
Can still be executed). In this way, html and css
Files cannot be stored in this directory, otherwise they cannot be browsed.

 

B. Install the patch provided by Microsoft. The download address is as follows (note that there are different patches for different systems ):

 

 

This patch is for IIS3 and Intel platforms.

 

Bytes

 

 

This patch is for IIS3 and Intel platforms.

 

Bytes

 

 

This patch is for the IIS4 and Alpha platforms.

 

Bytes

 

 

This patch is for the IIS4 and Alpha platforms.

 

Bytes
C. Whether ie4.01sp1 is installed on the server. I have not tried it.

 

D. Save the author's personal opinions and try to install the English version of NT instead of the Chinese version. The reason is that the author cannot tell the reason, but according to practical experience, the English version
NT has fewer bugs than the Chinese version. If any of you know the reason, please let me know.

 

3. Support for asp
Free homepage space and problems faced by servers of the VM Service

 

1. asp code on the server may be owned by others
Unauthorized access.

 

For example, in the ASP1.0 routine provided by Microsoft, There Is A. asp
File is used to view the source code of other. asp files. This file is
ASPSamp/Samples/code. asp. If someone uploads this program to the server, and the server does not take any preventive measures, it is easy for someone else to view the program.

 

 

For example:

 

Code. asp? Source =/directory/file. asp

 

2. ACCESS mdb used
The database may be downloaded. Generally, asp is provided.
The free homepage server of the permission cannot provide the service that sets the DSN on behalf of, so asp
The database used by the program is usually limited to the mdb library, while the mdb
The remote database is located in the DSN-less address we mentioned in section 14th.
The method specified in asp is as follows:

<% Connstr =
"DBQ =" + server. mappath ("database/source. mdb") + "; DefaultDir =; DRIVER = {Microsoft
Access Driver (*. mdb)}; DriverId = 25; FIL = MS
Access; ImplicitCommitSync = Yes; MaxBufferSize = 512; MaxScanRows = 8; PageTimeout = 5;
SafeTransactions = 0; Threads = 3; UserCommitSync = Yes; "%>

 

As mentioned above, in this case, mdb
The library may be downloaded by others, resulting in leakage of passwords.

 

Therefore, as a webmaster, some measures should be taken to prohibit code. asp.
Such programs (it seems difficult to do, But feature code can be retrieved regularly), limit mdb
.

 

3. Threats from powerful filesystemobject Components

 

IIS3 and IIS4 ASP file operations can all be performed through filesystemobject
Implementation, including read/write directory operations for text files, copy and rename deletion of files, but this powerful function also leaves a very dangerous "backdoor ". Exploitation
Filesystemobjet can tamper with any file on the fat partition. Even ntfs
Partition. If permissions are not set, they can also be damaged. If you are not careful, you may suffer a "Disaster Tolerance ". Unfortunately, many
The webmaster only knows how to run the web server and seldom sets the ntfs permission.
The default settings of the NT directory permission are terrible and secure. Therefore, if you are
Webmaster, the author strongly recommends that you pay close attention to server settings and try
The directory is created on the ntfs partition. Do not set the everyone full control for the directory. It is not necessary even if it is a member of the Administrator group.
Full control, as long as you have read and Change permissions.

 

 

Iv. Attacks that asp applications may face in the past many CGI attacks on the Internet
Written message book or BBS
Is to change the message entered by the customer into a variable, and then insert this variable into the display message
Therefore, if the text entered by the customer needs to be displayed in the HTML file
HTML standard, while CGI programs generally add specific HTML
Language. When the user inputs the content and inserts the HTML file, the content is inserted at the beginning and end of the HTML file.
Statement, such:

 

<Font> variable input by the customer </font>
You can do a lot of things by marking the screen.

 

If you enter the following information:

 

</Font> HTML-compliant statements <font>
It is used to hide HTML statements in CGI. Inserted into the HTML file becomes:

 

<Font> </font> HTML-compliant statements <font> <
/Font> with this feature, you can write Javascript
As long as you enter the following in the input box:

 

<A href = "url"
Onmouseover = "while (1) {window. Close ('/')}"> or <a herf = "url"
Onmousever = "while (ture) {window. Close ('/')}">
The browser of other customers who view the message will die due to an endless loop. ASP
The developed program may also have this problem, so when you use ASP
When writing similar programs, you should take precautions against such operations. For example, you can write a program to judge the input of the client and block all
HTML and JavaScript statements.

After reading this article, if you are shocked, you must thoroughly understand your existing website or
ASP
Program to check whether the above vulnerabilities exist. If you understand all the vulnerabilities mentioned in this article and have enough countermeasures, remind you to check your website and
ASP
Programs. If you have a database, you should check it frequently to prevent others from exploiting unknown vulnerabilities. Finally, if you talk about
ASP
Do you have any unique insights on security issues or discover new vulnerabilities? I hope you can send me a letter to discuss them.