Database brute-force database sorting

First Article: It turns out that changing MDB to ASP can prevent download.

Introduction: I tried it with animator yesterday and renamed the data. MDB file to the Data. asp file and put it in the wwwroot directory. Then input data in IE. after ASP path, ie is displayed blank. Right-click to view the source file, jump out of notepad, and save the content. MDB file, opened with access, found that the password is required, that is, at least the file header is damaged.
Use flashget to download the data. asp file and save it as the data. MDB file. You can find that the file is intact with access !!! It seems that some programmers thought it was wrong to change the MDB suffix to ASP to prevent downloading! Downloading background databases is a terrible disaster for an ASP + access website. I have read articles from various parties today and summarized the following nine methods to prevent the database from being downloaded (please add ):

1. Use your imagination to modify the database file name
Needless to say, this is the most lazy method, but if the attacker obtains the database path through a third-party channel), it will be done. For example, if an attacker could only obtain the list permission and accidentally saw the database path, he could download the database and study it. In addition, the data file size is usually relatively large, and hidden file names cannot be concealed. Therefore, the confidentiality is the lowest.

2. Change the database name suffix to Asa, ASP, etc.

This method must be used with some settings. Otherwise, the situation at the beginning of this article will appear.

(1) Add a binary field (I have not made it-_-+ ).

(2) If you add <% or %> to this file, IIS will parse the file according to the ASP syntax, and then reports the 500 error, which cannot be downloaded. However, it is useless to simply add <% in the text or remarks field of the database, because access will process the content, it will exist in the database in the form of <%, invalid! The correct method is to store <% Into the OLE object field, so that our goal can be achieved.
Method:
First, use NotePad to create a text file whose content is <%.
Next, use access to open your database file, create a new table, create a name, add an OLE object field to the table, add a record, and insert the text file created earlier, if the operation is correct, you can see a new record named "data packet. You can.

3. Add "#" before the Database Name
You only need to add # To the front Name of the database file, and then modify the database address in the database connection file (such as Conn. asp. The principle is to download the part can only recognize # before the first name, for the next automatic removal, such as you want to download: http://www.pcdigest.com/date/#123.mdb (if there is ). Both IE and flashget are http://www.test.com/date/index.htm (index. asp, default. jsp, etc. You are on the IIS settings of the home page Documentation)
In addition, some spaces in the database file name also play a similar role, because of the special nature of the HTTP protocol for address resolution, space will be encoded as "%", such as http://www.test.com/date/123; 456.mdb, download http://www.test.com/date/123 % 456.mdb. Our directory does not have the 123% 456. MDB file at all, so the download is also invalid. After such a modification, even if you expose the database address, it is generally impossible for others to download it!

4. Encrypted Database
First, choose tools> Security> encryption/Decryption database, and select the database (for example, employer. MDB), and then click OK. Then, the window "Save the database encrypted and saved as: employer1.mdb" appears. Then employer. MDB will be encoded and stored as employer1.mdb .. note that the above actions are not to set a password for the database, but to encode the database files to prevent others from using other tools to view the contents of the database files.
Next, we encrypt the database. First, we open the encoded employer1.mdb, and select the "exclusive" mode when opening it. Choose tools> Security> set database password from the menu, and enter the password. In this way, even if someone else gets the employee 1.mdb file, he cannot see the employee 1.mdb without a password.
After encryption, modify the database connection page, for example:
Conn. Open "driver = {Microsoft Access Driver (*. mdb)}; uid = admin; Pwd = Database Password; DBQ = database path"
After this modification, even if the database is downloaded, it cannot be opened by others (provided that the password on your database connection page is not leaked)
However, it is worth noting that the encryption mechanism of the Access database is relatively simple, and it is easy to decrypt even if a password is set. The database system creates an encryption string and stores the password entered by the user in *. the MDB file starts from the address "& h42. Therefore, a good programmer can easily create dozens of rows of small programs to easily obtain the password of any access database. Therefore, as long as the database is downloaded, its information security remains unknown.

5. Store the database outside the web directory or store the database connection file in another virtual directory.
If your web directory is E:/webroot, you can put the database in the E:/data folder and modify the database connection address: ".. /data/Database Name ", so that the database can be called normally, but cannot be downloaded, because it is not in the web directory! This method is generally not suitable for users who buy virtual space.

6. Use the ODBC data source.
In programming such as ASP, if conditions are met, try to use the ODBC Data Source. Do not write the database name in the program. Otherwise, the database name will be lost along with the password of the ASP source code. For example: dbpath = server. mappath (".. /123/ABC/asfadf. mdb ")
Conn. Open "driver = {Microsoft Access Driver (*. mdb)}; DBQ =" & dbpath
It can be seen that even if the database name gets weird, the hidden directory goes deeper, and the ASP source code is easily downloaded after the password is lost. If you use an ODBC data source, you will not have this problem: Conn. open "ODBC-DSN name", but this is more annoying, if the directory is moved, you have to re-set the data source, more convenient way please see the 7, 8 method!

7. Add the extended MDB ing of database names such as MDB
This method is implemented by modifying the IIS settings. This method is suitable for friends who have control over IIS and is not suitable for users who buy virtual hosts (unless the Administrator has already set it ). I think this method is the best at present. The database of the entire site can be modified to prevent downloading. You do not need to modify the code to prevent download even if the target address is exposed.
In IIS properties --- main directory --- configuration --- ing --- application extension, add the application parsing of the. MDB file. Note that the selected DLL (or EXE) here does not seem arbitrary. If you choose improperly, the MDB file can still be downloaded. You are advised not to select ASP. dll. You can perform multiple tests on your own.
In this way, download the database, for example, http://www.test.com/data/dvbbs6.mdb. (404 or 500 errors)

8: advantages of using. net
The wooden bird on the Internet wrote a "WBAl anti-leech tool" to prevent illegal file downloads ". Specific can login http://www.9seek.com/WBAL;
However, it only prevents non-local downloads and does not provide a real anti-download function. However, this method is almost the same as Method 5. You can modify the. NET file to achieve local download!

Only 7th and 8 of these methods are uniformly modified. After a configuration is modified, the database of the entire site can be prevented from being downloaded. The other methods need to modify the Database Name and connection file respectively, it is troublesome, but this is also the only option for virtual host friends!

In fact, 6th methods should be extended by 5th methods, which can implement special functions, but are not supported. net host or for fear of setup troubles, we still use the 5th method directly. By default, the 6th methods can still be copied and connected to the same host's forum or message book for publishing, then you can click Download (because the reference page is from the same host)

9. use NTFS partition File Permission settings (by percyboy)
We already know that ASP. NET uses ADO. Net to access the database and can access the ACCESS database through the oledb connection-one of our very common low-end databases. This article discusses several error prompts that may be seen in ASP. NET, from which you can see database files created by Access 2000 and Access XP. Different error prompts will appear when access errors occur. Hope to help you. Another key point is to use this article to give you a new understanding of the NTFS permission settings for Access database files in ASP. NET.

(1) experiment process

For the sake of convenience, let's take an experiment: The application is/test, and the data inventory is stored in D:/wwwroot/test/data/db1.mdb. We already know that in ASP. net accesses the database as an ASP net virtual user. We need to grant this account specific NTFS permissions to Make ASP.. Net program runs normally.

To get the strictest NTFS permission settings, we will give the program the lowest NTFS permission at the beginning of the experiment:

A) D: The/wwwroot/test/data/folder grants the user ASPnet the following permissions:
Reject allowed
Full Control □□
Modify □□
Read and run √ □
List folder directories √ □
Read √ □
Write □□

B) D: The/wwwroot/test/data/db1.mdb file itself grants the user ASPnet the following permissions:
√ Allow propagation of inherited permissions from parent to this object

1.1 For An ASPX program that only contains the "select" command, the above permission settings are not available during running, that is, the above permissions have met the operation of such programs.

1.2 For aspx programs that contain commands such as "Update", "insert", and "Update,

(A) If db1.mdb is a database created by Access 2000, the following error occurs:

A server error occurs in the "/test" application.
---------------------------------------
The Microsoft Jet Database Engine cannot open the file 'd:/wwwroot/test/data /'. It has been opened exclusively by another user or has no permission to view data.
Note: An unhandled exception occurs during the execution of the current Web request. Check the stack trace information for details about the error and the source of the error in the code.
Exception details: system. Data. oledb. oledbexception: the Microsoft Jet Database Engine cannot open the file 'd:/wwwroot/test/data /'. It has been opened exclusively by another user or has no permission to view data.

(B) If db1.mdb is a database created by Access XP, the following error occurs:

A server error occurs in the "/test" application.
----------------------------------------------
The operation must use an updatable query.
Note: An unhandled exception occurs during the execution of the current Web request. Check the stack trace information for details about the error and the source of the error in the code.
Exception details: system. Data. oledb. oledbexception: The operation must use an updatable query.

(C) Preliminary Analysis of the Cause: Because there are commands such as "Update", "insert", and "Update", the database file itself needs to be written, so the above permissions cannot meet this requirement, we need to further release the permissions.

We release some permissions,
A) D:/wwwroot/test/data/folder unchanged:

B) D: The/wwwroot/test/data/db1.mdb file itself grants the user ASPnet the following permissions:
Reject allowed
Full Control □□
Modify □□
Read and run √ □
List folder directories √ □
Read √ □
Write √ □

1.3 open the permission and continue the experiment,

(A) If db1.mdb is a database created by Access 2000, the following error occurs:

A server error occurs in the "/test" application.
------------------------------------------
Files cannot be locked.
Note: An unhandled exception occurs during the execution of the current Web request. Check the stack trace information for details about the error and the source of the error in the code.
Exception details: system. Data. oledb. oledbexception: the file cannot be locked.

(B) If db1.mdb is a database created by Access XP, no error occurs.

(C) Preliminary Analysis of the Cause: We found that a *. LDB file with the same name will be generated in the directory where the ACCESS database is opened, which is a lock mark of access. In view of this, we guess that when the user ASPnet accesses the ACCESS database, it also needs to generate a lock mark, and this directory does not allow it to write, so an error occurs. The reason why the database created by Access XP does not have this error is unknown.

We further open the permissions,
A) D:/wwwroot/test/data/folder to give the user ASPnet the following permissions:
Reject allowed
Full Control □□
Modify □□
Read and run √ □
List folder directories √ □
Read √ □
Write √ □

B) D: The/wwwroot/test/data/db1.mdb file itself grants the user ASPnet the following permissions:
√ Allow propagation of inherited permissions from parent to this object

1.4 continue the experiment and find that the error has been resolved. The above permission is the "minimum permission" we need to release ".

(A) If db1.mdb is a database created by Access 2000, we will find a small problem: generated *. LDB files will not be deleted by themselves. The files still exist after access, but this problem will not affect ASP.. net.

(B) If db1.mdb is a database created by Access XP, the above similar problem does not occur.

(C) Preliminary Analysis of the Cause: We only gave ASPnet the permission to write folders and did not have the permission to modify them. Therefore, once a file is written, its content cannot be modified ,*. LDB cannot be deleted.

If you have to solve this problem, you can further release the permission:
A) D:/wwwroot/test/data/folder to give the user ASPnet the following permissions:
Reject allowed
Full Control □□
Change √ □
Read and run √ □
List folder directories √ □
Read √ □
Write √ □

B) D: The/wwwroot/test/data/db1.mdb file itself grants the user ASPnet the following permissions:
√ Allow propagation of inherited permissions from parent to this object

1.5 is included in the experiment. In another case, we open and edit db1.mdb in access and access ASP. NET at the same time.

(A) If db1.mdb is a database created by Access 2000, we find that there is no problem.

(B) If db1.mdb is a database created by Access XP, the following error occurs:

The server error in the "/Zhao" application.
------------------------------------------------
You cannot use ''; the file is already in use.
Note: An unhandled exception occurs during the execution of the current Web request. Check the stack trace information for details about the error and the source of the error in the code.
Exception details: system. Data. oledb. oledbexception: you cannot use ''. The file is in use.

(C) Preliminary Analysis of the cause: the ACCESS database is a single-user single-threaded database. When we open and edit database files in access, we actually open the database as the current Windows user (such as administrator, ASP. by default, ASP net virtual users (affiliated to the users group) are used. They are lower than the Administrator level and cannot "snatch" permissions with the Administrator. Therefore, a conflict error occurs. We do not need to discuss the situation where Access 2000 ignores this issue. It may be that ACCESS 2000 does not consider so many factors.

1.6: Change the db1.mdb attribute to "read-only". Both Access 2000 and Access XP have the same error messages as those in access 1.2.

(2) experiment conclusion

(1) first, let's repeat the origin of the NTFS permission settings for Access database files:

In ASP. by default, net accesses and operates databases as a virtual user called ASPnet, you can see this user in "Control Panel"-"Administrative Tools"-"Computer Management"-"local users and groups"-"users". The default value is:

Full name: ASP. NET computer account
The account used to run the ASP. NET auxiliary route (aspnet_wp.exe.
Affiliated to: Users Group.

Using a user in the Users group to perform file operations and database operations is much less risky than using an Administrators Group. This is also ASP. net in terms of security.

Since such a user needs to access and operate the database file itself, we need to grant it certain NTFS permissions to allow its access. Obviously, if you do not have the NTFS permission, ASPnet will be unable to access and operate the database, and the errors shown in the above experiment will appear.

(2) After the above experiment, we already know that the following NTFS permission settings can meet general requirements:

A) D:/wwwroot/test/data/folder to give the user ASPnet the following permissions:
Reject allowed
Full Control □□
Modify □□
Read and run √ □
List folder directories √ □
Read √ □
Write √ □

B) D: The/wwwroot/test/data/db1.mdb file itself grants the user ASPnet the following permissions:
√ Allow propagation of inherited permissions from parent to this object

At the same time, we also noticed that whether db1.mdb is a "read-only" file also affects asp net access.

(3) The preceding permission settings can be set directly to the ASPNET user, the Users Group, or the Everyone group. Because ASPnet is affiliated to the users group, you can set permissions for ASPnet through the user group.

(4) set the NTFS permission in the "properties" dialog box-"security" tab after right-clicking a file or folder. Generally, you can give the Adminitrators group a "full control" permission, and do not easily tick the "deny". For the NTFS permission setting skills, consult the network administrator and network security experts.

Note: Partition in fat and FAT32 format does not support NTFS permission.

(5) For Windows 2000 series and Windows Server 2003 series, the "Security" tab is easily found by default, but the "Security" tab in Windows XP Professional is disabled by default, you can remove "√" from "use simple sharing (recommended)" in "Advanced Settings" on the "control panel"-"Folder Options"-"View" tab, after "OK", follow the above method again to see the "Security" tab.

==============
To sum up, the 2, 3, and 4 methods are the most basic and effective methods to prevent database downloads. They are applicable to network administrators with server jurisdiction, it is also suitable for VM users. We recommend that each producer use these three methods at the same time.

If you have jurisdiction over the server, we recommend that you add Method 9 to improve the security of your access database.

Assume that the website is exposed to a brute-force database (attackers can obtain the database URL through various channels ). To prevent weak web systems, this means that the database will be downloaded back by attackers and all background data on the website will be leaked.