Attack Part two: anti-crime of cross-station script attack
First, how to prevent the server from cross-station script attack
Thankfully, the technology to prevent a Cross-site script attack is becoming perfect. There are several ways in which you can now prevent Cross-site script attacks:
1. Encode the characters of dynamically generated pages
2. Filter and Restrict input
3. Use HTML and URL encoding
1. Encode the characters of dynamically generated pages
The first thing you have to do is code the characters that dynamically generate the page, you have to do this, or the hacker is likely to change your character settings and easily pass your line of defense. If our site is an English site, so long as we set the character encoding into a Latin character iso-8859-1 on the line, the specific situation is as follows:
<meta http-equiv= "Content-type" content= "text/html;charset=iso-8859-1" >
2. Filter and restrict all input data
This is the second way to prevent Cross-site script attacks, and do not allow those special characters to enter when you log in. So we can do this by adding JavaScript programs to the OnSubmit method. In this case we limit the maximum of 15 characters. This blocks the input from the longer script.
In <<knowledge Base Article qa252985>>, Microsoft provides a short JavaScript program to filter the input data. We have also introduced this code to our example based on the specific circumstances, such as:
function Checkform () {
Document.forms[0].username.value = _
RemoveBad (Document.forms[0].username.value);
return true;
}
MICROSOFT ' S CODE
function RemoveBad (strtemp) {
strtemp = Strtemp.replace (/\</\>/\ "/\ '/\%/\;/\ (/\)/\&/\+/\-/g," ");
return strtemp;
}
In this way, you can filter the characters that are included in the input:
% < > [] {}; & +-"' ()
3. Use HTML and URL encoding
Although using the filtering and limiting input described above is a very important defense, it has no way of doing anything with my email attack. Because I put the parameters of the URL directly in the message. We have to adopt a more forceful security measure against this situation. If we use ASP, it is much easier to solve it. As long as HTML and URL encoding are always used for dynamically generated Web pages. For the case in our example, we made the following changes to the redirect URL in the first input page:
Strredirecturl = Strredirecturl & _
Server. UrlEncode (Response.Cookies ("UserName"))
In the execution page we add:
strUserName =server. HTMLEncode (Request.QueryString ("UserName"))
And
strUserName =server. HTMLEncode (Request.Form ("UserName"))
Microsoft recommends that all dynamic page input and output should be encoded. This should be even in the case of storing and fetching database data. This way you can largely avoid a cross-site script attack.
To do this, add in the page1.asp:
<%@ Language=vbscript%>
<% If request.cookies ("UserName") <> "" Then
' REDIRECT if detect the cookie
Dim Strredirecturl
Strredirecturl = "Page2.asp?username="
Strredirecturl = Strredirecturl & _
Server. UrlEncode (Request.Cookies ("UserName"))
Response.Redirect (Strredirecturl)
Else%>
<HTML>
<HEAD>
<meta http-equiv= "Content-type" content= "text/html; Charset=iso-8859-1 ">
<title>mynicesite.com Home page</title>
</HEAD>
<script language= "JavaScript" >
<!--
function Checkform () {
Document.forms[0].username.value =
RemoveBad (Document.forms[0].username.value);
return true;
}
//******************************************************
Programmer:not ORIGINAL Code-comes from MICROSOFT
Code source:microsoft knowledge Base Article q25z985
Description:removes bad characters.
//******************************************************
function RemoveBad (strtemp) {
strtemp =strtemp.replace (/\</\>/\ "/\ '/\%/\;/\ (/\)/\&/\+/\-/g," ");
return strtemp;
}
-->
</SCRIPT>
<BODY>
<BR>
<H2>MyNiceSite.com</H2>
<BR>
<form method= "POST" action= "page2.asp" onsubmit= "return Checkform ();" >
Enter your mynicesite.com username:
<input type= "text" name= "UserName" width= "ten" maxwidth= "ten" >
<input type= "Submit" name= "submit" value= "Submit" >
</FORM>
</BODY>
</HTML>
<% End If%>
Page2.asp In addition:
<%@ Language=vbscript%>
<% Dim strUserName
If request.querystring ("UserName") <> "" Then
strUserName =server. HTMLEncode (Request.QueryString ("UserName"))
Else
Response.Cookies ("UserName") =request.form ("UserName")
strUserName = Server. HTMLEncode (Request.Form ("UserName"))
End If%>
<HTML>
<HEAD>
<meta http-equiv= "C
