Can not remember on which Web site to see, in general, for verification Code calibration, it is easy to write the following:
Copy Code code as follows:
<%
If Request.Form ("Securitycode") = Session ("Securitycode") Then
' Todo:database operations
Else
Response.Write "Security Code incorrect!"
End If
%>
The verification code picture produces the session ("Securitycode") and saves the correct authentication code value, then obtains the user to submit the authentication code value, then two pairs of a pair if the same is the verification code is correct, otherwise the authentication code is wrong. There is nothing wrong with such an algorithm on the surface, but for a particular case it will make the verification code useless.
First of all, we know that there is a core of the above algorithm is that we want to access the file that produces the verification code image will have a session to save the value of the verification code, and then the user's input can be correctly compared to the What would you get if you were to construct a form that would bypass the code picture file and then commit it? Session ("Securitycode") does not exist as NULL, if the user authentication code at this time do not input, then verify the code checksum is not the same. OK, here's the key to exploiting the vulnerability is the session of the Verification Code, and it's easy to let the server not generate this session so that the attack becomes possible.
The solution is also easy to verify that the session of the verification code is empty or verify that the user entered the validation code is legitimate, the key to constructing a security form is never trust the user's input. This security issue is resolved by using the validation code session and the user-entered double insurance method:
Copy Code code as follows:
' STR is the verification code to verify, Len is the verification code length
Function issecuritycodevalid (str, len)
Issecuritycodevalid = Not CBool (_
IsEmpty (str) or CStr (str) = "" or Len (str) <len)
End Function
If Issecuritycodevalid (Request.Form ("Securitycode"), 4) and _
Issecuritycodevalid (Session ("Securitycode"), 4) and _
Request.Form ("Securitycode") = Session ("Securitycode") Then
' Todo:database operations
Else
Response.Write "Security Code incorrect!"
End If
