Write to ASP. NET programmers: security issues on websites

On the Internet, we often see news about the website being infected with Trojans and the homepage being modified. In fact, these problems may be caused by many factors, such as servers and website programs... However, overflow has been valued and constantly improved, and server system vulnerabilities are not so easy to discover. Third-party software security must also be ensured.

It may take some time for you to create a project. There are also many security issues in the program. It should also be summarized. This project is a CMS system. The system uses ASP. NET. During development, we found that Microsoft has implemented many security measures, but some new programmers do not know how to enable them. The following is a brief introduction:

1: SQL Injection
2: XSS
3: CSRF
4. File Upload

1: SQL Injection
Cause:
In fact, this problem exists in many websites. That is, directly concatenate SQL statements in the program. Some readers may not understand it. The following is a description of user authentication during logon:
Code:
SQL statement during verification: select * from where user = "+ txtUsername. Text +" and pwd = "+ txtPwd. Text +"
This section describes how to query a user from a database and verify the user name and password.
It seems that there is no problem, but there is a hidden problem. Username: admin Password: admin,
Select * from where user = admin and pwd = admin
If the user and password are correct, they can be verified. If my user name is asdf or 1 = 1 -- password: Enter at will.
Let's look at the statement:
Select * from where user = 'asdf or 1 = 1 -- and pwd =
What do you see after execution? If the program simply determines the number of returned records, this method can be verified.
If the execution statement is a SA user and the system administrator is added through xp_mongoshell, the server will be taken down.
Solution:
(1): this problem is mainly caused by the input of special characters. We can filter the entered user name and password into special characters.
(2): this problem can be solved by passing in parameters through the Stored Procedure (Note: splicing is not allowed in the stored procedure, otherwise it will be the same as it has never been stored ).
2: XSS (Cross-Site Scripting)
Cause:
This is also sometimes called HTML injection. Similar to SQL injection, it does not have special characters for processing. You can submit HTML tags to reconstruct the website. In fact, the validateRequest attribute is enabled on the asp.net webpage by default. All HTML tags will be verified by. NET:

However, if exceptions are directly thrown to the user, the user experience is poor.
Solution:
(1): Disable request verification by setting validateRequest = false in the Page command or configuration section. Then, we perform HtmlEncode on the data submitted by the user, this problem will not occur after encoding (ASP. NET encoding method: Server. htmlEncode (string )).
(2): The second method is to filter out special characters. This method is not recommended. If you want to enter a smaller sign (<), it will also be filtered out.
3: CSRF (Cross-Site Request Forgery)
Cause: I personally think that csrf is convenient in the case of Ajax, because it can be operated by your authenticated user if you do not know it, this is also known as browser hijacking. If you have passed the verification of a website, you will perform operations on the website as your role. For example, if you are an administrator, you can add other users to the Management Group, however, if someone constructs a link to add an administrator and is clicked by the Administrator, the corresponding operation will also be performed. for specific reasons, refer to the article CSRF written by lake2-Attack and Defense
Solution:
This is also mentioned in lake2's article. The verification code is added when the information is modified. Or add a Session token (ASP. NET already provides an automatic defense method, that is, use the page property ViewStateUserKey. set its value in the Page_Init method. This. ViewStateUserKey = Session. SessionID ).
4. File Upload
Cause:
If your website uses an online editor, such as FCKEditor and eWeb, and you have not completed file upload, the website will be quickly tampered with after the website goes online.
Solution:
In fact, I have written this article in my previous notes: FCKEditor Security Configuration