Test the security of our school server

SQL = "SELECT PWD, Answer from [MEMBER] where userid = '" & userid & "' and answer = '" & answer & "'" such a low-level error will also make, at this time, you only need to construct a special username and password according to SQL , Such as: 'or' 1 '=' 1, the program will turn this:

SQL = "SELECT PWD, Answer from [MEMBER] where userid =" & 'or'1' = 1 & "and pass =" & answer "or is a logical operator, when two conditions are judged, as long as one of them is established, Then, the equation will be established, and in the language, it is true (established) in 1, then in this line of statement, "and" verification of the original statement will no longer continue, because "1 = 1" and "OR" 语 为 为. In this way, we can submit 'or' 1 '=' 1 from the beginning. No matter what we are in what text box, we will submit 'or' 1 '=' 1 This can go to the next page smoothly. In this case, we use 'or' 1 '=' 1 to log in as a username and password. What will it be? The experiment proves that the landing is successful, because the link to display personal data is changed, there is Normally display personal information, I found that the real name is not changed, indicating that there is a certain ID to identify the user, so directly view the web source code to find this important thing: It turned out to rely on this hiddenfield to distinguish the user, then if I have modified the value of Value, can I modify other users? Take my previous registration, replace my number 2001010xxx, Then modify the relative connection in , save as an HTM file, then submit the information I need to modify. Let's take a look at my information, I have been revised, so if I know any user's Hiddenfield, You can modify its information, it is still not chaotic? This is put on one side ... This problem can write a function to prohibit it from external submission data to be resolved. However, this vulnerability is a bit limited, if you want to change a user, you must know Hiddenfield. Value, otherwise it can only be changed. However, since this file is like this, I think the entries verification program should be the same. I tried to log in, success, all members' information matters, and add and modify the administrator, do What can be. This problem is actually very simple. It is possible to handle input characters. It turns out that I thought I used the replace () function, please teach the wind, I know that the MID () function can be solved well. Add a judgment.

US = MID (INPUT, I, 1) IF US = "" OR US = "" or US = "%" or US = "<" 000 = ">" = "&" ten responsponse.redirect " ERROR_PAGE.ASP "Response.end) You can check the characters entered by the user, of course, you should try more to check some special characters. This line of code means checking the input characters, if there are spaces, single quotes, percentages, and <","> "to redirect to ERROR_PAGE.ASP this page. Although "Haiyang Top Network ASP Troja" has the ability of the school server, we still have to start from the school's procedure, otherwise it is meaningless, "Haiyang Top Network ASP Trojan" is only acting as a viewing code. Character. Question II usually some data call files will have some SQL INJECTION vulnerabilities, such as Show.asp, ShowAnasp, Shownews.asp, Showuser.asp, etc., because these files are easy to ignore check variables, I see a shownews.asp file . Open immediately, the original code is as follows (because this file is too large, limited to the space, I removed a lot of html code):

<% OPTION Explicit%> <% DIM SQL, RS, RSC, THEDATE DIM REVIEWABLE, ABOUTNEWS SET RS = Server.createObject ("AdoDb.Recordset") ' Find the number of related news and whether to open comment rights rs.open "Select * from news_parameter where parameterid = 1", conn, 1 ,1 if not rs.bof and not rs.eof damoutnews = rs ("Aboutnews") IF = RS ( "reviewable") = 1 then reviewable = 1 else reviewable = 0 end if else aboutnews = 5 reviewable = 1 end if rs.close set rs = nothing set rs = server.createobject ( "adodb.recordset") sql = "update News set hits = hits where newsid = "& cstr (" newsid "))) Conn.execute SQL IF session (" purview ") =" "Then Rs.Open" Select * from news where newsid = "& cstr (Request ("NEWSID")) & "And Audit = 1", CONN, 1, 1 Else Rs.open "Select * from news where newsid =" & cstr (Request ("newsid"), conn, 1, 1 end if If Err.Number <> 0 Then Response.write "Database Error" Else if rs.bof and rs.eof the rs.close response.write "This news does not exist or have not reviewed" else%>