See {
Tagshow (Event)
} "> Click the Baidu Post Bar image to jump to {
Tagshow (Event)
} "> The webpage is very curious, so I studied and obtained the production method.
I. asp version.
Click the picture on the Baidu Post Bar to jump to your designated website. It's amazing!
Use {
Tagshow (Event)
} "> Code can be implemented.
Click the image to jump to another SP-induced page.
What is the cause of this vulnerability:
First, in your {
Tagshow (Event)
} "> Create an ASP file on the server and set it to a cited file, such as index. asp.
Take ASP as an example:
<%
If instr (request. servervariables ("http_referer"), "Baidu")> 0 then
Url = "test.jpg"
Else url = http://www.jokeba.com
End if
Response. Redirect (URL)
%>
<HTML xmlns = "http://www.w3.org/1999/xhtml">
<Head runat = "server">
<Title> </title>
</Head>
<Body>
<Form ID = "form1" runat = "server">
</Form>
</Body>
</Html>
Save the preceding code as index. asp, and save the url = "test.jpg" image file as test.jpg.
Put it together with index. asp.
Why is this code executed? Because no signature verification code is added to the image, that is, image information is not filtered.
Ii. Asp.net
Usage: Open the ASP. NET file in notepad, and redirect the file {
Tagshow (Event)
} "> Change the address.
Upload the file named 1.jpg to a server that supports Asp.net 2.0. Use {
Tagshow (Event)
} "> The network address can be used to send an image in the Baidu Post Bar.
The ASP. NET code is:
<% @ Page Language = "C #" %>
<! Doctype HTML public "-// W3C // dtd xhtml 1.0 transitional // en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<SCRIPT runat = "server">
Protected void page_load (Object sender, eventargs E)
{
Bool flag = true;
Try
{
Flag = request. urlreferrer. absoluteuri. Contains ("baby ");
}
Finally
{
If (FLAG)
{
Response. Redirect (http://www.jokeba.com /);
}
Else
Response. Redirect ("1.jpg ");
}
}
</SCRIPT>
<HTML xmlns = "http://www.w3.org/1999/xhtml">
<Head runat = "server">
<Title> image jump </title>
</Head>
<Body>
<Form ID = "form1" runat = "server">
</Form>
</Body>
</Html>
If you still do not understand, reply to the post.
Conclusion: The idea is the same. for example, <a href = "/article/uploadfiles/200907/20090723020257738 .jpg is a folder with an image. Then, the 1.jpg file contains a default homepage file .. that is, a vulnerability in IIS is captured ..
For details, see.
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
