Network security Series three build Web penetration platform (ASP)

One of the biggest problems in learning or teaching cyber security is how to set up a variety of experiments. If find the real website practiced hand, on the one hand has the loophole website already difficult to find, on the other hand even if can find the existence loophole website, that also exists the legal aspect risk, so the best way is to build the experiment environment by oneself.

In the experimental environment, the system platform is of course choosing vmware+win2003 (Win2003 is the preferred operating system for network security experiments); The difficulty is how to solve the infiltration platform? Penetration platform to include the Web server and vulnerability site two parts. After a 51cto of rummaging, finally found a solution. Here first describes how to build an ASP Web penetration platform.

First, build a Web server

To build a Web server that supports ASP, the formal method should be iis+access or iis+mssql, but it is too cumbersome to build a server in an experimental environment. It is recommended to quickly build an ASP server Software-Small Cyclone Aspweb server. This software fully supports access and MSSQL database, after installing the software, just copy the site files to the Software installation directory in the Wwwroot folder.

650) this.width=650; "title=" 1.jpg "alt=" wkiom1qwggfq_py9aaffxf1yrye443.jpg "src=" http://s3.51cto.com/wyfs02/M00/ 4b/ad/wkiom1qwggfq_py9aaffxf1yrye443.jpg "/>

Software:

Second, configure the penetration target website

In 51cto finally found a 2.0 version of the Southern Data site template, so old template estimates no one will use, but it provides us with a great experimental platform, because there are a variety of classic loopholes in the site. I have done some simple processing on this site to make it more consistent with our experimental requirements:

When used, simply copy all the extracted files to the Wwwroot folder. Homepage interface of the website:

650) this.width=650; "title=" 2.jpg "alt=" wkiol1qwhbixtfjoaannobbedm0749.jpg "src=" http://s3.51cto.com/wyfs02/M00/ 4b/af/wkiol1qwhbixtfjoaannobbedm0749.jpg "/>

In this way, an ASP infiltration platform is set up, then you can do SQL injection.

This article from "a pot of turbid wine" blog, reproduced please contact the author!

Network security Series three build Web penetration platform (ASP)